From fe8b5d47ae2f7281b5de237943c780d7b8f64c17 Mon Sep 17 00:00:00 2001 From: Côme Chilliet Date: Mon, 13 Nov 2023 16:24:16 +0100 Subject: Migrate Bruteforce Throttle check to SetupCheck API MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Côme Chilliet --- apps/settings/lib/AppInfo/Application.php | 2 + .../lib/Controller/CheckSetupController.php | 7 --- .../lib/SetupChecks/BruteForceThrottler.php | 70 ++++++++++++++++++++++ 3 files changed, 72 insertions(+), 7 deletions(-) create mode 100644 apps/settings/lib/SetupChecks/BruteForceThrottler.php (limited to 'apps/settings/lib') diff --git a/apps/settings/lib/AppInfo/Application.php b/apps/settings/lib/AppInfo/Application.php index 1693ec302e5..6f4a94bdda9 100644 --- a/apps/settings/lib/AppInfo/Application.php +++ b/apps/settings/lib/AppInfo/Application.php @@ -48,6 +48,7 @@ use OCA\Settings\Middleware\SubadminMiddleware; use OCA\Settings\Search\AppSearch; use OCA\Settings\Search\SectionSearch; use OCA\Settings\Search\UserSearch; +use OCA\Settings\SetupChecks\BruteForceThrottler; use OCA\Settings\SetupChecks\CheckUserCertificates; use OCA\Settings\SetupChecks\DefaultPhoneRegionSet; use OCA\Settings\SetupChecks\EmailTestSuccessful; @@ -156,6 +157,7 @@ class Application extends App implements IBootstrap { Util::getDefaultEmailAddress('no-reply') ); }); + $context->registerSetupCheck(BruteForceThrottler::class); $context->registerSetupCheck(CheckUserCertificates::class); $context->registerSetupCheck(DefaultPhoneRegionSet::class); $context->registerSetupCheck(EmailTestSuccessful::class); diff --git a/apps/settings/lib/Controller/CheckSetupController.php b/apps/settings/lib/Controller/CheckSetupController.php index 0d5e94dd047..6d74a670a07 100644 --- a/apps/settings/lib/Controller/CheckSetupController.php +++ b/apps/settings/lib/Controller/CheckSetupController.php @@ -78,7 +78,6 @@ use OCP\ITempManager; use OCP\IURLGenerator; use OCP\Lock\ILockingProvider; use OCP\Notification\IManager; -use OCP\Security\Bruteforce\IThrottler; use OCP\SetupCheck\ISetupCheckManager; use Psr\Log\LoggerInterface; @@ -108,8 +107,6 @@ class CheckSetupController extends Controller { private $iniGetWrapper; /** @var IDBConnection */ private $connection; - /** @var IThrottler */ - private $throttler; /** @var ITempManager */ private $tempManager; /** @var IManager */ @@ -134,7 +131,6 @@ class CheckSetupController extends Controller { IDateTimeFormatter $dateTimeFormatter, IniGetWrapper $iniGetWrapper, IDBConnection $connection, - IThrottler $throttler, ITempManager $tempManager, IManager $manager, IAppManager $appManager, @@ -150,7 +146,6 @@ class CheckSetupController extends Controller { $this->logger = $logger; $this->dispatcher = $dispatcher; $this->db = $db; - $this->throttler = $throttler; $this->lockingProvider = $lockingProvider; $this->dateTimeFormatter = $dateTimeFormatter; $this->iniGetWrapper = $iniGetWrapper; @@ -725,8 +720,6 @@ Raw output 'cronInfo' => $this->getLastCronInfo(), 'cronErrors' => $this->getCronErrors(), 'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(), - 'isBruteforceThrottled' => $this->throttler->getAttempts($this->request->getRemoteAddress()) !== 0, - 'bruteforceRemoteAddress' => $this->request->getRemoteAddress(), 'isUsedTlsLibOutdated' => $this->isUsedTlsLibOutdated(), 'forwardedForHeadersWorking' => $this->forwardedForHeadersWorking(), 'reverseProxyDocs' => $this->urlGenerator->linkToDocs('admin-reverse-proxy'), diff --git a/apps/settings/lib/SetupChecks/BruteForceThrottler.php b/apps/settings/lib/SetupChecks/BruteForceThrottler.php new file mode 100644 index 00000000000..6c1efd56bc1 --- /dev/null +++ b/apps/settings/lib/SetupChecks/BruteForceThrottler.php @@ -0,0 +1,70 @@ + + * + * @author Côme Chilliet + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OCA\Settings\SetupChecks; + +use OCP\IL10N; +use OCP\IRequest; +use OCP\IURLGenerator; +use OCP\Security\Bruteforce\IThrottler; +use OCP\SetupCheck\ISetupCheck; +use OCP\SetupCheck\SetupResult; + +class BruteForceThrottler implements ISetupCheck { + public function __construct( + private IL10N $l10n, + private IURLGenerator $urlGenerator, + private IRequest $request, + private IThrottler $throttler, + ) { + } + + public function getCategory(): string { + return 'system'; + } + + public function getName(): string { + return $this->l10n->t('Bruteforce Throttle'); + } + + public function run(): SetupResult { + $address = $this->request->getRemoteAddress(); + if ($address === '') { + return SetupResult::info( + $this->l10n->t('Your remote address could not be determined.') + ); + } elseif ($this->throttler->showBruteforceWarning($address)) { + return SetupResult::error( + $this->l10n->t('Your remote address was identified as "%s" and is bruteforce throttled at the moment slowing down the performance of various requests. If the remote address is not your address this can be an indication that a proxy is not configured correctly.', $address), + $this->urlGenerator->linkToDocs('admin-reverse-proxy') + ); + } else { + return SetupResult::success( + $this->l10n->t('Your remote address "%s" is not bruteforce throttled.', $address) + ); + } + } +} -- cgit v1.2.3