Security hardening: TLS, HMAC auth, rate limiting, privacy fixes

[leetcrypt]

Summary

Security hardening + encrypted file transfer for cmd-chat. All changes maintain the SRP + Fernet architecture. Zero new dependencies.

Security Fixes

• TLS by default — auto-generated self-signed certs at ~/.cmd-chat/certs/
• Session key removed from wire — no longer returned in /srp/verify response
• HMAC WebSocket auth — ws_token verified with hmac.compare_digest()
• Admin-only /clear — requires Bearer token (printed at server start)
• Password hidden — env var or interactive getpass instead of CLI arg
• IPs removed — user_ip deleted from Message model
• Rate limiting — 10 req/min/IP on SRP endpoints
• Message cap — 1000 max (prevents RAM DoS)
• Access log off — disabled HTTP request logging
• Username sanitization — prevents rich markup injection
• Dead code removed — 4 unused functions from helpers.py
• requirements.txt — fixed broken UTF-16 encoding

Encrypted File Transfer

New commands: /send <filepath>, /accept, /reject

• Files chunked (64KB), encrypted with room Fernet key, relayed via WebSocket
• SHA-256 integrity verification on receipt
• Server never sees file content (E2E encrypted)
• 50MB max, saved to ./downloads/ with collision-safe naming
• Zero server changes — server remains a dumb encrypted relay

Lab Environment

lab/setup-lab.sh — one-command tmux lab with server + 2 chat clients.

---

Setup

git clone https://github.com/diorwave/cmd-chat.git
cd cmd-chat
pip install -r requirements.txt

Hosting

# Password prompted securely
python3 cmd_chat.py serve 0.0.0.0 3000

# Or use helper script (shows IPs + friend instructions)
./lab/host-chat.sh

Connecting

python3 cmd_chat.py connect SERVER_IP 3000 yourname --insecure

--insecure skips cert verification for self-signed certs.

Securing the Connection

Tailscale (recommended): Both install Tailscale. Use Tailscale IP (tailscale ip -4). Encrypted WireGuard tunnel, zero port forwarding, works across NATs.

python3 cmd_chat.py connect 100.x.x.x 3000 theirname --insecure

LAN: Use local IP. No port forwarding. Both devices must be on same network.

python3 cmd_chat.py connect 192.168.1.x 3000 theirname --insecure

Public internet: Requires router port forwarding (TCP 3000). Use real TLS certs via --cert/--key if exposing to internet.

Sharing the Password

Share out-of-band (never through the chat):

1. In person — tell them verbally
2. Signal — disappearing message (30s)
3. One-time link — onetimesecret.com (self-destructs after one view)
4. Split — half via Telegram, half via SMS

CLI Flags

Flag	Server	Client	Purpose
--password, -p	yes	yes	Room password (prompts if omitted)
--cert	yes	—	Custom TLS certificate path
--key	yes	—	Custom TLS private key path
--no-tls	yes	yes	Disable TLS (dev/LAN only)
--insecure, -k	—	yes	Skip TLS cert verification

Chat Commands

Command	Action
/send <filepath>	Propose file transfer
/accept	Accept pending file offer
/reject	Decline pending file offer
q	Disconnect

Test Plan

• 79 existing tests pass
• TLS auto-cert generation
• SRP auth over HTTPS/WSS
• Message encryption between 2 users
• /clear requires admin Bearer token
• Rate limiter returns 429 after threshold
• File transfer: send → accept → SHA-256 verified
• File transfer: send → reject → sender notified
• Lab script runs end-to-end