Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable27] fix: Add bruteforce protection to federation endpoint #43715

Merged
merged 1 commit into from
Feb 21, 2024
Merged

[stable27] fix: Add bruteforce protection to federation endpoint #43715

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion apps/federation/lib/Controller/OCSAuthAPIController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\BackgroundJob\IJobList;
use OCP\IRequest;
use OCP\Security\Bruteforce\IThrottler;
use OCP\Security\ISecureRandom;
use Psr\Log\LoggerInterface;

Expand All @@ -53,6 +54,7 @@ class OCSAuthAPIController extends OCSController {
private DbHandler $dbHandler;
private LoggerInterface $logger;
private ITimeFactory $timeFactory;
private IThrottler $throttler;

public function __construct(
string $appName,
Expand All @@ -62,7 +64,8 @@ public function __construct(
TrustedServers $trustedServers,
DbHandler $dbHandler,
LoggerInterface $logger,
ITimeFactory $timeFactory
ITimeFactory $timeFactory,
IThrottler $throttler
) {
parent::__construct($appName, $request);

Expand All @@ -72,13 +75,15 @@ public function __construct(
$this->dbHandler = $dbHandler;
$this->logger = $logger;
$this->timeFactory = $timeFactory;
$this->throttler = $throttler;
}

/**
* Request received to ask remote server for a shared secret, for legacy end-points
*
* @NoCSRFRequired
* @PublicPage
* @BruteForceProtection(action=federationSharedSecret)
* @throws OCSForbiddenException
*/
public function requestSharedSecretLegacy(string $url, string $token): DataResponse {
Expand All @@ -91,6 +96,7 @@ public function requestSharedSecretLegacy(string $url, string $token): DataRespo
*
* @NoCSRFRequired
* @PublicPage
* @BruteForceProtection(action=federationSharedSecret)
* @throws OCSForbiddenException
*/
public function getSharedSecretLegacy(string $url, string $token): DataResponse {
Expand All @@ -102,10 +108,12 @@ public function getSharedSecretLegacy(string $url, string $token): DataResponse
*
* @NoCSRFRequired
* @PublicPage
* @BruteForceProtection(action=federationSharedSecret)
* @throws OCSForbiddenException
*/
public function requestSharedSecret(string $url, string $token): DataResponse {
if ($this->trustedServers->isTrustedServer($url) === false) {
$this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
$this->logger->error('remote server not trusted (' . $url . ') while requesting shared secret', ['app' => 'federation']);
throw new OCSForbiddenException();
}
Expand Down Expand Up @@ -138,15 +146,18 @@ public function requestSharedSecret(string $url, string $token): DataResponse {
*
* @NoCSRFRequired
* @PublicPage
* @BruteForceProtection(action=federationSharedSecret)
* @throws OCSForbiddenException
*/
public function getSharedSecret(string $url, string $token): DataResponse {
if ($this->trustedServers->isTrustedServer($url) === false) {
$this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
$this->logger->error('remote server not trusted (' . $url . ') while getting shared secret', ['app' => 'federation']);
throw new OCSForbiddenException();
}

if ($this->isValidToken($url, $token) === false) {
$this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
$expectedToken = $this->dbHandler->getToken($url);
$this->logger->error(
'remote server (' . $url . ') didn\'t send a valid token (got "' . $token . '" but expected "'. $expectedToken . '") while getting shared secret',
Expand Down
20 changes: 18 additions & 2 deletions apps/federation/tests/Controller/OCSAuthAPIControllerTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
use OCP\AppFramework\OCS\OCSForbiddenException;
use OCP\AppFramework\Utility\ITimeFactory;
use OCP\IRequest;
use OCP\Security\Bruteforce\IThrottler;
use OCP\Security\ISecureRandom;
use Psr\Log\LoggerInterface;
use Test\TestCase;
Expand Down Expand Up @@ -60,6 +61,9 @@ class OCSAuthAPIControllerTest extends TestCase {
/** @var \PHPUnit\Framework\MockObject\MockObject|ITimeFactory */
private $timeFactory;

/** @var \PHPUnit\Framework\MockObject\MockObject|IThrottler */
private $throttler;

private OCSAuthAPIController $ocsAuthApi;

/** @var int simulated timestamp */
Expand All @@ -75,6 +79,7 @@ protected function setUp(): void {
$this->jobList = $this->createMock(JobList::class);
$this->logger = $this->createMock(LoggerInterface::class);
$this->timeFactory = $this->createMock(ITimeFactory::class);
$this->throttler = $this->createMock(IThrottler::class);

$this->ocsAuthApi = new OCSAuthAPIController(
'federation',
Expand All @@ -84,7 +89,8 @@ protected function setUp(): void {
$this->trustedServers,
$this->dbHandler,
$this->logger,
$this->timeFactory
$this->timeFactory,
$this->throttler
);

$this->timeFactory->method('getTime')
Expand All @@ -109,8 +115,14 @@ public function testRequestSharedSecret(string $token, string $localToken, bool
} else {
$this->jobList->expects($this->never())->method('add');
$this->jobList->expects($this->never())->method('remove');
if (!$isTrustedServer) {
$this->throttler->expects($this->once())
->method('registerAttempt')
->with('federationSharedSecret');
}
}


try {
$this->ocsAuthApi->requestSharedSecret($url, $token);
$this->assertTrue($ok);
Expand Down Expand Up @@ -145,7 +157,8 @@ public function testGetSharedSecret(bool $isTrustedServer, bool $isValidToken, b
$this->trustedServers,
$this->dbHandler,
$this->logger,
$this->timeFactory
$this->timeFactory,
$this->throttler
]
)->setMethods(['isValidToken'])->getMock();

Expand All @@ -163,6 +176,9 @@ public function testGetSharedSecret(bool $isTrustedServer, bool $isValidToken, b
} else {
$this->secureRandom->expects($this->never())->method('generate');
$this->trustedServers->expects($this->never())->method('addSharedSecret');
$this->throttler->expects($this->once())
->method('registerAttempt')
->with('federationSharedSecret');
}

try {
Expand Down
Loading