Detailed Description

Per-peer brute-force lockout for HTTP auth (PC_ENABLE_AUTH_LOCKOUT).

Tracks consecutive failed authentications per source address in a fixed BSS table (no heap). The key is the full family-tagged address (pc_ip), so an IPv4 and an IPv6 peer are always distinct buckets and no attacker can share or poison another address's state through a lossy hash collision. After PC_AUTH_LOCKOUT_THRESHOLD consecutive failures an address is locked out for PC_AUTH_LOCKOUT_BASE_MS, doubling on each further failure up to PC_AUTH_LOCKOUT_MAX_MS; a successful auth clears the address. Compiled only when PC_ENABLE_AUTH_LOCKOUT is set (the host unit tests enable it and drive it with a synthetic millisecond clock). An unspecified address (family pc_ip_family::PC_IP_NONE or all-zero) is untrackable and is never locked.

Author: Douglas Quigg (dstroy0)

Date: 2026

Definition in file auth_lockout.h.