Module failure_tracker 

Authentication failure tracking and account lockout (NIAP CA PP FIA_AFL.1).

FIA_AFL.1 requires the TSF to detect when a configurable number of unsuccessful authentication attempts occur for an authentication event and, on reaching that threshold, take a defined action. Kipuka’s action is a time-boxed lockout: once an identity accumulates max_failures failures within failure_window, further attempts are refused for lockout_duration regardless of whether the presented credential is valid.

Keying

The tracker keys on the claimed identity (e.g. the HTTP Basic username / OTP entity-id), never on a client-supplied network address. An attacker can spoof X-Forwarded-For at will, so mixing it into the lockout key would let them both evade their own lockout and lock out arbitrary victims. The claimed identity is the value FIA_AFL.1 is written against (“the user”) and is known even when authentication fails, so it is the correct key.

Concurrency and memory

State is a single parking_lot::Mutex<HashMap<..>>. Records are pruned opportunistically and capped at 10,000 identities. At capacity, existing counters and lockouts are retained; new identities continue through credential verification without acquiring a tracker entry until capacity becomes available. Capacity exhaustion must never lock out unrelated valid credentials.

Disabled mode

max_failures == 0 disables the control entirely — every call returns LockoutStatus::Allowed and no state is retained. This preserves the behavior of deployments that have not opted in.

Structs

FailureTracker

Tracks authentication failures and enforces FIA_AFL.1 lockout.

LockoutPolicy

Lockout policy parameters (from [auth_lockout] config).

Enums

LockoutStatus

Outcome of a lockout check or a recorded failure.