From b2fd283a300d0c5b260d50bbf6ab7574b24dafe9 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Tue, 15 Aug 2023 08:27:01 +0200 Subject: feat(OCC): Add a command to get the bruteforce state of an IP Signed-off-by: Joas Schilling --- core/Command/Security/BruteforceAttempts.php | 87 +++++++++++++++++++++++ core/Command/Security/BruteforceResetAttempts.php | 63 ++++++++++++++++ core/Command/Security/ResetBruteforceAttempts.php | 61 ---------------- core/register_command.php | 3 +- 4 files changed, 152 insertions(+), 62 deletions(-) create mode 100644 core/Command/Security/BruteforceAttempts.php create mode 100644 core/Command/Security/BruteforceResetAttempts.php delete mode 100644 core/Command/Security/ResetBruteforceAttempts.php (limited to 'core') diff --git a/core/Command/Security/BruteforceAttempts.php b/core/Command/Security/BruteforceAttempts.php new file mode 100644 index 00000000000..9cbf446958d --- /dev/null +++ b/core/Command/Security/BruteforceAttempts.php @@ -0,0 +1,87 @@ + + * + * @author Joas Schilling + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ +namespace OC\Core\Command\Security; + +use OC\Core\Command\Base; +use OC\Security\Bruteforce\Throttler; +use OCP\Security\Bruteforce\IThrottler; +use Symfony\Component\Console\Input\InputArgument; +use Symfony\Component\Console\Input\InputInterface; +use Symfony\Component\Console\Output\OutputInterface; + +class BruteforceAttempts extends Base { + /** @var Throttler */ + protected IThrottler $throttler; + + public function __construct( + IThrottler $throttler, + ) { + parent::__construct(); + $this->throttler = $throttler; + } + + protected function configure(): void { + parent::configure(); + $this + ->setName('security:bruteforce:attempts') + ->setDescription('resets bruteforce attempts for given IP address') + ->addArgument( + 'ipaddress', + InputArgument::REQUIRED, + 'IP address for which the attempts are to be reset', + ) + ->addArgument( + 'action', + InputArgument::OPTIONAL, + 'Only count attempts for the given action', + ) + ; + } + + protected function execute(InputInterface $input, OutputInterface $output): int { + $ip = $input->getArgument('ipaddress'); + + if (!filter_var($ip, FILTER_VALIDATE_IP)) { + $output->writeln('"' . $ip . '" is not a valid IP address'); + return 1; + } + + $data = [ + 'allow-listed' => $this->throttler->isIPWhitelisted($ip), + 'attempts' => $this->throttler->getAttempts( + $ip, + (string) $input->getArgument('action'), + ), + 'delay' => $this->throttler->getDelay( + $ip, + (string) $input->getArgument('action'), + ), + ]; + + $this->writeArrayInOutputFormat($input, $output, $data); + + return 0; + } +} diff --git a/core/Command/Security/BruteforceResetAttempts.php b/core/Command/Security/BruteforceResetAttempts.php new file mode 100644 index 00000000000..40d7c6848b2 --- /dev/null +++ b/core/Command/Security/BruteforceResetAttempts.php @@ -0,0 +1,63 @@ + + * @author Johannes Riedel + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ +namespace OC\Core\Command\Security; + +use OC\Core\Command\Base; +use OCP\Security\Bruteforce\IThrottler; +use Symfony\Component\Console\Input\InputArgument; +use Symfony\Component\Console\Input\InputInterface; +use Symfony\Component\Console\Output\OutputInterface; + +class BruteforceResetAttempts extends Base { + public function __construct( + protected IThrottler $throttler, + ) { + parent::__construct(); + } + + protected function configure(): void { + $this + ->setName('security:bruteforce:reset') + ->setDescription('resets bruteforce attempts for given IP address') + ->addArgument( + 'ipaddress', + InputArgument::REQUIRED, + 'IP address for which the attempts are to be reset' + ); + } + + protected function execute(InputInterface $input, OutputInterface $output): int { + $ip = $input->getArgument('ipaddress'); + + if (!filter_var($ip, FILTER_VALIDATE_IP)) { + $output->writeln('"' . $ip . '" is not a valid IP address'); + return 1; + } + + $this->throttler->resetDelayForIP($ip); + return 0; + } +} diff --git a/core/Command/Security/ResetBruteforceAttempts.php b/core/Command/Security/ResetBruteforceAttempts.php deleted file mode 100644 index c0bc265c8f5..00000000000 --- a/core/Command/Security/ResetBruteforceAttempts.php +++ /dev/null @@ -1,61 +0,0 @@ - - * @author Johannes Riedel - * - * @license GNU AGPL version 3 or any later version - * - * This program is free software: you can redistribute it and/or modify - * it under the terms of the GNU Affero General Public License as - * published by the Free Software Foundation, either version 3 of the - * License, or (at your option) any later version. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU Affero General Public License for more details. - * - * You should have received a copy of the GNU Affero General Public License - * along with this program. If not, see . - * - */ -namespace OC\Core\Command\Security; - -use OC\Core\Command\Base; -use OC\Security\Bruteforce\Throttler; -use Symfony\Component\Console\Input\InputArgument; -use Symfony\Component\Console\Input\InputInterface; -use Symfony\Component\Console\Output\OutputInterface; - -class ResetBruteforceAttempts extends Base { - public function __construct( - protected Throttler $throttler, - ) { - parent::__construct(); - } - - protected function configure() { - $this - ->setName('security:bruteforce:reset') - ->setDescription('resets bruteforce attemps for given IP address') - ->addArgument( - 'ipaddress', - InputArgument::REQUIRED, - 'IP address for which the attempts are to be reset' - ); - } - - protected function execute(InputInterface $input, OutputInterface $output): int { - $ip = $input->getArgument('ipaddress'); - - if (!filter_var($ip, FILTER_VALIDATE_IP)) { - $output->writeln('"' . $ip . '" is not a valid IP address'); - return 1; - } - - $this->throttler->resetDelayForIP($ip); - return 0; - } -} diff --git a/core/register_command.php b/core/register_command.php index df39ad4484c..c9b6cc99901 100644 --- a/core/register_command.php +++ b/core/register_command.php @@ -209,7 +209,8 @@ if (\OC::$server->getConfig()->getSystemValue('installed', false)) { $application->add(new OC\Core\Command\Security\ListCertificates(\OC::$server->getCertificateManager(), \OC::$server->getL10N('core'))); $application->add(new OC\Core\Command\Security\ImportCertificate(\OC::$server->getCertificateManager())); $application->add(new OC\Core\Command\Security\RemoveCertificate(\OC::$server->getCertificateManager())); - $application->add(new OC\Core\Command\Security\ResetBruteforceAttempts(\OC::$server->getBruteForceThrottler())); + $application->add(\OC::$server->get(\OC\Core\Command\Security\BruteforceAttempts::class)); + $application->add(\OC::$server->get(\OC\Core\Command\Security\BruteforceResetAttempts::class)); } else { $application->add(\OC::$server->get(\OC\Core\Command\Maintenance\Install::class)); } -- cgit v1.2.3