feat(OCC): Add a command to get the bruteforce state of an IP

Signed-off-by: Joas Schilling <coding@schilljs.com>

diff --git a/core/Command/Security/BruteforceAttempts.php b/core/Command/Security/BruteforceAttempts.php
new file mode 100644 (file)
index 0000000..9cbf446
--- /dev/null
+++ b/core/Command/Security/BruteforceAttempts.php
@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2023 Joas Schilling <coding@schilljs.com>
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Core\Command\Security;
+
+use OC\Core\Command\Base;
+use OC\Security\Bruteforce\Throttler;
+use OCP\Security\Bruteforce\IThrottler;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class BruteforceAttempts extends Base {
+       /** @var Throttler */
+       protected IThrottler $throttler;
+
+       public function __construct(
+               IThrottler $throttler,
+       ) {
+               parent::__construct();
+               $this->throttler = $throttler;
+       }
+
+       protected function configure(): void {
+               parent::configure();
+               $this
+                       ->setName('security:bruteforce:attempts')
+                       ->setDescription('resets bruteforce attempts for given IP address')
+                       ->addArgument(
+                               'ipaddress',
+                               InputArgument::REQUIRED,
+                               'IP address for which the attempts are to be reset',
+                       )
+                       ->addArgument(
+                               'action',
+                               InputArgument::OPTIONAL,
+                               'Only count attempts for the given action',
+                       )
+               ;
+       }
+
+       protected function execute(InputInterface $input, OutputInterface $output): int {
+               $ip = $input->getArgument('ipaddress');
+
+               if (!filter_var($ip, FILTER_VALIDATE_IP)) {
+                       $output->writeln('<error>"' . $ip . '" is not a valid IP address</error>');
+                       return 1;
+               }
+
+               $data = [
+                       'allow-listed' => $this->throttler->isIPWhitelisted($ip),
+                       'attempts' => $this->throttler->getAttempts(
+                               $ip,
+                               (string) $input->getArgument('action'),
+                       ),
+                       'delay' => $this->throttler->getDelay(
+                               $ip,
+                               (string) $input->getArgument('action'),
+                       ),
+               ];
+
+               $this->writeArrayInOutputFormat($input, $output, $data);
+
+               return 0;
+       }
+}

diff --git a/core/Command/Security/BruteforceResetAttempts.php b/core/Command/Security/BruteforceResetAttempts.php
new file mode 100644 (file)
index 0000000..3966bd7
--- /dev/null
+++ b/core/Command/Security/BruteforceResetAttempts.php
@@ -0,0 +1,64 @@
+<?php
+
+declare(strict_types=1);
+/**
+ * @copyright Copyright (c) 2020, Johannes Riedel (johannes@johannes-riedel.de)
+ *
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Johannes Riedel <joeried@users.noreply.github.com>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Core\Command\Security;
+
+use OC\Core\Command\Base;
+use OCP\Security\Bruteforce\IThrottler;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputInterface;
+use Symfony\Component\Console\Output\OutputInterface;
+
+class BruteforceResetAttempts extends Base {
+       protected IThrottler $throttler;
+
+       public function __construct(IThrottler $throttler) {
+               $this->throttler = $throttler;
+               parent::__construct();
+       }
+
+       protected function configure(): void {
+               $this
+                       ->setName('security:bruteforce:reset')
+                       ->setDescription('resets bruteforce attempts for given IP address')
+                       ->addArgument(
+                               'ipaddress',
+                               InputArgument::REQUIRED,
+                               'IP address for which the attempts are to be reset'
+                       );
+       }
+
+       protected function execute(InputInterface $input, OutputInterface $output): int {
+               $ip = $input->getArgument('ipaddress');
+
+               if (!filter_var($ip, FILTER_VALIDATE_IP)) {
+                       $output->writeln('<error>"' . $ip . '" is not a valid IP address</error>');
+                       return 1;
+               }
+
+               $this->throttler->resetDelayForIP($ip);
+               return 0;
+       }
+}

diff --git a/core/Command/Security/ResetBruteforceAttempts.php b/core/Command/Security/ResetBruteforceAttempts.php
deleted file mode 100644 (file)
index 8def087..0000000
--- a/core/Command/Security/ResetBruteforceAttempts.php
+++ /dev/null
@@ -1,62 +0,0 @@
-<?php
-/**
- * @copyright Copyright (c) 2020, Johannes Riedel (johannes@johannes-riedel.de)
- *
- * @author Joas Schilling <coding@schilljs.com>
- * @author Johannes Riedel <joeried@users.noreply.github.com>
- *
- * @license GNU AGPL version 3 or any later version
- *
- * This program is free software: you can redistribute it and/or modify
- * it under the terms of the GNU Affero General Public License as
- * published by the Free Software Foundation, either version 3 of the
- * License, or (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- * GNU Affero General Public License for more details.
- *
- * You should have received a copy of the GNU Affero General Public License
- * along with this program. If not, see <http://www.gnu.org/licenses/>.
- *
- */
-namespace OC\Core\Command\Security;
-
-use OC\Core\Command\Base;
-use OC\Security\Bruteforce\Throttler;
-use Symfony\Component\Console\Input\InputArgument;
-use Symfony\Component\Console\Input\InputInterface;
-use Symfony\Component\Console\Output\OutputInterface;
-
-class ResetBruteforceAttempts extends Base {
-       protected Throttler $throttler;
-
-       public function __construct(Throttler $throttler) {
-               $this->throttler = $throttler;
-               parent::__construct();
-       }
-
-       protected function configure() {
-               $this
-                       ->setName('security:bruteforce:reset')
-                       ->setDescription('resets bruteforce attemps for given IP address')
-                       ->addArgument(
-                               'ipaddress',
-                               InputArgument::REQUIRED,
-                               'IP address for which the attempts are to be reset'
-                       );
-       }
-
-       protected function execute(InputInterface $input, OutputInterface $output): int {
-               $ip = $input->getArgument('ipaddress');
-
-               if (!filter_var($ip, FILTER_VALIDATE_IP)) {
-                       $output->writeln('<error>"' . $ip . '" is not a valid IP address</error>');
-                       return 1;
-               }
-
-               $this->throttler->resetDelayForIP($ip);
-               return 0;
-       }
-}

diff --git a/core/register_command.php b/core/register_command.php
index 32cd4099618f1cca1f8946df650a1bdadac237f7..0efeed7cd334356e44f33ec5a6c2a3861dd092d5 100644 (file)
--- a/core/register_command.php
+++ b/core/register_command.php
@@ -209,7 +209,8 @@ if (\OC::$server->getConfig()->getSystemValue('installed', false)) {
        $application->add(new OC\Core\Command\Security\ListCertificates(\OC::$server->getCertificateManager(), \OC::$server->getL10N('core')));
        $application->add(new OC\Core\Command\Security\ImportCertificate(\OC::$server->getCertificateManager()));
        $application->add(new OC\Core\Command\Security\RemoveCertificate(\OC::$server->getCertificateManager()));
-       $application->add(new OC\Core\Command\Security\ResetBruteforceAttempts(\OC::$server->getBruteForceThrottler()));
+       $application->add(\OC::$server->get(\OC\Core\Command\Security\BruteforceAttempts::class));
+       $application->add(\OC::$server->get(\OC\Core\Command\Security\BruteforceResetAttempts::class));
 } else {
        $application->add(\OC::$server->get(\OC\Core\Command\Maintenance\Install::class));
 }

diff --git a/lib/composer/composer/autoload_classmap.php b/lib/composer/composer/autoload_classmap.php
index 443b013ceddf5b1d2b35b7a58f9f01862c629bd5..5b543ad55b939b2896c56c2eb48c942db397e162 100644 (file)
--- a/lib/composer/composer/autoload_classmap.php
+++ b/lib/composer/composer/autoload_classmap.php
@@ -1002,10 +1002,11 @@ return array(
     'OC\\Core\\Command\\Preview\\Generate' => $baseDir . '/core/Command/Preview/Generate.php',
     'OC\\Core\\Command\\Preview\\Repair' => $baseDir . '/core/Command/Preview/Repair.php',
     'OC\\Core\\Command\\Preview\\ResetRenderedTexts' => $baseDir . '/core/Command/Preview/ResetRenderedTexts.php',
+    'OC\\Core\\Command\\Security\\BruteforceAttempts' => $baseDir . '/core/Command/Security/BruteforceAttempts.php',
+    'OC\\Core\\Command\\Security\\BruteforceResetAttempts' => $baseDir . '/core/Command/Security/BruteforceResetAttempts.php',
     'OC\\Core\\Command\\Security\\ImportCertificate' => $baseDir . '/core/Command/Security/ImportCertificate.php',
     'OC\\Core\\Command\\Security\\ListCertificates' => $baseDir . '/core/Command/Security/ListCertificates.php',
     'OC\\Core\\Command\\Security\\RemoveCertificate' => $baseDir . '/core/Command/Security/RemoveCertificate.php',
-    'OC\\Core\\Command\\Security\\ResetBruteforceAttempts' => $baseDir . '/core/Command/Security/ResetBruteforceAttempts.php',
     'OC\\Core\\Command\\Status' => $baseDir . '/core/Command/Status.php',
     'OC\\Core\\Command\\SystemTag\\Add' => $baseDir . '/core/Command/SystemTag/Add.php',
     'OC\\Core\\Command\\SystemTag\\Delete' => $baseDir . '/core/Command/SystemTag/Delete.php',

diff --git a/lib/composer/composer/autoload_static.php b/lib/composer/composer/autoload_static.php
index 82d51e30edd7e6967a1828e54413bc1d5ba9a6ba..19e2f3393d6fef8d0a5cc5ae8364122094c365e1 100644 (file)
--- a/lib/composer/composer/autoload_static.php
+++ b/lib/composer/composer/autoload_static.php
@@ -1035,10 +1035,11 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\Core\\Command\\Preview\\Generate' => __DIR__ . '/../../..' . '/core/Command/Preview/Generate.php',
         'OC\\Core\\Command\\Preview\\Repair' => __DIR__ . '/../../..' . '/core/Command/Preview/Repair.php',
         'OC\\Core\\Command\\Preview\\ResetRenderedTexts' => __DIR__ . '/../../..' . '/core/Command/Preview/ResetRenderedTexts.php',
+        'OC\\Core\\Command\\Security\\BruteforceAttempts' => __DIR__ . '/../../..' . '/core/Command/Security/BruteforceAttempts.php',
+        'OC\\Core\\Command\\Security\\BruteforceResetAttempts' => __DIR__ . '/../../..' . '/core/Command/Security/BruteforceResetAttempts.php',
         'OC\\Core\\Command\\Security\\ImportCertificate' => __DIR__ . '/../../..' . '/core/Command/Security/ImportCertificate.php',
         'OC\\Core\\Command\\Security\\ListCertificates' => __DIR__ . '/../../..' . '/core/Command/Security/ListCertificates.php',
         'OC\\Core\\Command\\Security\\RemoveCertificate' => __DIR__ . '/../../..' . '/core/Command/Security/RemoveCertificate.php',
-        'OC\\Core\\Command\\Security\\ResetBruteforceAttempts' => __DIR__ . '/../../..' . '/core/Command/Security/ResetBruteforceAttempts.php',
         'OC\\Core\\Command\\Status' => __DIR__ . '/../../..' . '/core/Command/Status.php',
         'OC\\Core\\Command\\SystemTag\\Add' => __DIR__ . '/../../..' . '/core/Command/SystemTag/Add.php',
         'OC\\Core\\Command\\SystemTag\\Delete' => __DIR__ . '/../../..' . '/core/Command/SystemTag/Delete.php',