Skip to content

Commit

Permalink
Migrate Bruteforce Throttle check to SetupCheck API
Browse files Browse the repository at this point in the history
Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>
  • Loading branch information
come-nc committed Nov 13, 2023
1 parent 7495236 commit fe8b5d4
Show file tree
Hide file tree
Showing 8 changed files with 74 additions and 79 deletions.
1 change: 1 addition & 0 deletions apps/settings/composer/composer/autoload_classmap.php
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@
'OCA\\Settings\\Settings\\Personal\\Security\\TwoFactor' => $baseDir . '/../lib/Settings/Personal/Security/TwoFactor.php',
'OCA\\Settings\\Settings\\Personal\\Security\\WebAuthn' => $baseDir . '/../lib/Settings/Personal/Security/WebAuthn.php',
'OCA\\Settings\\Settings\\Personal\\ServerDevNotice' => $baseDir . '/../lib/Settings/Personal/ServerDevNotice.php',
'OCA\\Settings\\SetupChecks\\BruteForceThrottler' => $baseDir . '/../lib/SetupChecks/BruteForceThrottler.php',
'OCA\\Settings\\SetupChecks\\CheckUserCertificates' => $baseDir . '/../lib/SetupChecks/CheckUserCertificates.php',
'OCA\\Settings\\SetupChecks\\DefaultPhoneRegionSet' => $baseDir . '/../lib/SetupChecks/DefaultPhoneRegionSet.php',
'OCA\\Settings\\SetupChecks\\EmailTestSuccessful' => $baseDir . '/../lib/SetupChecks/EmailTestSuccessful.php',
Expand Down
1 change: 1 addition & 0 deletions apps/settings/composer/composer/autoload_static.php
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,7 @@ class ComposerStaticInitSettings
'OCA\\Settings\\Settings\\Personal\\Security\\TwoFactor' => __DIR__ . '/..' . '/../lib/Settings/Personal/Security/TwoFactor.php',
'OCA\\Settings\\Settings\\Personal\\Security\\WebAuthn' => __DIR__ . '/..' . '/../lib/Settings/Personal/Security/WebAuthn.php',
'OCA\\Settings\\Settings\\Personal\\ServerDevNotice' => __DIR__ . '/..' . '/../lib/Settings/Personal/ServerDevNotice.php',
'OCA\\Settings\\SetupChecks\\BruteForceThrottler' => __DIR__ . '/..' . '/../lib/SetupChecks/BruteForceThrottler.php',
'OCA\\Settings\\SetupChecks\\CheckUserCertificates' => __DIR__ . '/..' . '/../lib/SetupChecks/CheckUserCertificates.php',
'OCA\\Settings\\SetupChecks\\DefaultPhoneRegionSet' => __DIR__ . '/..' . '/../lib/SetupChecks/DefaultPhoneRegionSet.php',
'OCA\\Settings\\SetupChecks\\EmailTestSuccessful' => __DIR__ . '/..' . '/../lib/SetupChecks/EmailTestSuccessful.php',
Expand Down
2 changes: 2 additions & 0 deletions apps/settings/lib/AppInfo/Application.php
Original file line number Diff line number Diff line change
Expand Up @@ -48,6 +48,7 @@
use OCA\Settings\Search\AppSearch;
use OCA\Settings\Search\SectionSearch;
use OCA\Settings\Search\UserSearch;
use OCA\Settings\SetupChecks\BruteForceThrottler;
use OCA\Settings\SetupChecks\CheckUserCertificates;
use OCA\Settings\SetupChecks\DefaultPhoneRegionSet;
use OCA\Settings\SetupChecks\EmailTestSuccessful;
Expand Down Expand Up @@ -156,6 +157,7 @@ public function register(IRegistrationContext $context): void {
Util::getDefaultEmailAddress('no-reply')
);
});
$context->registerSetupCheck(BruteForceThrottler::class);
$context->registerSetupCheck(CheckUserCertificates::class);
$context->registerSetupCheck(DefaultPhoneRegionSet::class);
$context->registerSetupCheck(EmailTestSuccessful::class);
Expand Down
7 changes: 0 additions & 7 deletions apps/settings/lib/Controller/CheckSetupController.php
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,6 @@
use OCP\IURLGenerator;
use OCP\Lock\ILockingProvider;
use OCP\Notification\IManager;
use OCP\Security\Bruteforce\IThrottler;
use OCP\SetupCheck\ISetupCheckManager;
use Psr\Log\LoggerInterface;

Expand Down Expand Up @@ -108,8 +107,6 @@ class CheckSetupController extends Controller {
private $iniGetWrapper;
/** @var IDBConnection */
private $connection;
/** @var IThrottler */
private $throttler;
/** @var ITempManager */
private $tempManager;
/** @var IManager */
Expand All @@ -134,7 +131,6 @@ public function __construct($AppName,
IDateTimeFormatter $dateTimeFormatter,
IniGetWrapper $iniGetWrapper,
IDBConnection $connection,
IThrottler $throttler,
ITempManager $tempManager,
IManager $manager,
IAppManager $appManager,
Expand All @@ -150,7 +146,6 @@ public function __construct($AppName,
$this->logger = $logger;
$this->dispatcher = $dispatcher;
$this->db = $db;
$this->throttler = $throttler;
$this->lockingProvider = $lockingProvider;
$this->dateTimeFormatter = $dateTimeFormatter;
$this->iniGetWrapper = $iniGetWrapper;
Expand Down Expand Up @@ -725,8 +720,6 @@ public function check() {
'cronInfo' => $this->getLastCronInfo(),
'cronErrors' => $this->getCronErrors(),
'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(),
'isBruteforceThrottled' => $this->throttler->getAttempts($this->request->getRemoteAddress()) !== 0,
'bruteforceRemoteAddress' => $this->request->getRemoteAddress(),
'isUsedTlsLibOutdated' => $this->isUsedTlsLibOutdated(),
'forwardedForHeadersWorking' => $this->forwardedForHeadersWorking(),
'reverseProxyDocs' => $this->urlGenerator->linkToDocs('admin-reverse-proxy'),
Expand Down
70 changes: 70 additions & 0 deletions apps/settings/lib/SetupChecks/BruteForceThrottler.php
Original file line number Diff line number Diff line change
@@ -0,0 +1,70 @@
<?php

declare(strict_types=1);

/**
* @copyright Copyright (c) 2023 Côme Chilliet <come.chilliet@nextcloud.com>
*
* @author Côme Chilliet <come.chilliet@nextcloud.com>
*
* @license GNU AGPL version 3 or any later version
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as
* published by the Free Software Foundation, either version 3 of the
* License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
*/

namespace OCA\Settings\SetupChecks;

use OCP\IL10N;
use OCP\IRequest;
use OCP\IURLGenerator;
use OCP\Security\Bruteforce\IThrottler;
use OCP\SetupCheck\ISetupCheck;
use OCP\SetupCheck\SetupResult;

class BruteForceThrottler implements ISetupCheck {
public function __construct(
private IL10N $l10n,
private IURLGenerator $urlGenerator,
private IRequest $request,
private IThrottler $throttler,
) {
}

public function getCategory(): string {
return 'system';
}

public function getName(): string {
return $this->l10n->t('Bruteforce Throttle');
}

public function run(): SetupResult {
$address = $this->request->getRemoteAddress();
if ($address === '') {
return SetupResult::info(
$this->l10n->t('Your remote address could not be determined.')
);
} elseif ($this->throttler->showBruteforceWarning($address)) {
return SetupResult::error(
$this->l10n->t('Your remote address was identified as "%s" and is bruteforce throttled at the moment slowing down the performance of various requests. If the remote address is not your address this can be an indication that a proxy is not configured correctly.', $address),
$this->urlGenerator->linkToDocs('admin-reverse-proxy')
);
} else {
return SetupResult::success(
$this->l10n->t('Your remote address "%s" is not bruteforce throttled.', $address)
);
}
}
}
9 changes: 0 additions & 9 deletions apps/settings/tests/Controller/CheckSetupControllerTest.php
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,6 @@
use OCP\IURLGenerator;
use OCP\Lock\ILockingProvider;
use OCP\Notification\IManager;
use OCP\Security\Bruteforce\IThrottler;
use OCP\SetupCheck\ISetupCheckManager;
use PHPUnit\Framework\MockObject\MockObject;
use Psr\Http\Message\ResponseInterface;
Expand Down Expand Up @@ -91,7 +90,6 @@ class CheckSetupControllerTest extends TestCase {
private $dispatcher;
/** @var Connection|\PHPUnit\Framework\MockObject\MockObject */
private $db;
private IThrottler $throttler;
/** @var ILockingProvider|\PHPUnit\Framework\MockObject\MockObject */
private $lockingProvider;
/** @var IDateTimeFormatter|\PHPUnit\Framework\MockObject\MockObject */
Expand Down Expand Up @@ -142,7 +140,6 @@ protected function setUp(): void {
$this->logger = $this->getMockBuilder(LoggerInterface::class)->getMock();
$this->db = $this->getMockBuilder(Connection::class)
->disableOriginalConstructor()->getMock();
$this->throttler = $this->createMock(IThrottler::class);
$this->lockingProvider = $this->getMockBuilder(ILockingProvider::class)->getMock();
$this->dateTimeFormatter = $this->getMockBuilder(IDateTimeFormatter::class)->getMock();
$this->iniGetWrapper = $this->getMockBuilder(IniGetWrapper::class)->getMock();
Expand All @@ -169,7 +166,6 @@ protected function setUp(): void {
$this->dateTimeFormatter,
$this->iniGetWrapper,
$this->connection,
$this->throttler,
$this->tempManager,
$this->notificationManager,
$this->appManager,
Expand Down Expand Up @@ -441,8 +437,6 @@ public function testCheck() {
'imageMagickLacksSVGSupport' => false,
'isFairUseOfFreePushService' => false,
'temporaryDirectoryWritable' => false,
'isBruteforceThrottled' => false,
'bruteforceRemoteAddress' => '',
'generic' => [],
]
);
Expand All @@ -466,7 +460,6 @@ public function testGetCurlVersion() {
$this->dateTimeFormatter,
$this->iniGetWrapper,
$this->connection,
$this->throttler,
$this->tempManager,
$this->notificationManager,
$this->appManager,
Expand Down Expand Up @@ -1193,7 +1186,6 @@ public function testIsMysqlUsedWithoutUTF8MB4(string $db, bool $useUTF8MB4, bool
$this->dateTimeFormatter,
$this->iniGetWrapper,
$this->connection,
$this->throttler,
$this->tempManager,
$this->notificationManager,
$this->appManager,
Expand Down Expand Up @@ -1247,7 +1239,6 @@ public function testIsEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed(string $m
$this->dateTimeFormatter,
$this->iniGetWrapper,
$this->connection,
$this->throttler,
$this->tempManager,
$this->notificationManager,
$this->appManager,
Expand Down
8 changes: 0 additions & 8 deletions core/js/setupchecks.js
Original file line number Diff line number Diff line change
Expand Up @@ -180,14 +180,6 @@
var afterCall = function(data, statusText, xhr) {
var messages = [];
if (xhr.status === 200 && data) {
if (data.isBruteforceThrottled) {
messages.push({
msg: t('core', 'Your remote address was identified as "{remoteAddress}" and is bruteforce throttled at the moment slowing down the performance of various requests. If the remote address is not your address this can be an indication that a proxy is not configured correctly. Further information can be found in the {linkstart}documentation ↗{linkend}.', { remoteAddress: data.bruteforceRemoteAddress })
.replace('{linkstart}', '<a target="_blank" rel="noreferrer noopener" class="external" href="' + data.reverseProxyDocs + '">')
.replace('{linkend}', '</a>'),
type: OC.SetupChecks.MESSAGE_TYPE_ERROR
});
}
if (data.suggestedOverwriteCliURL !== '') {
messages.push({
msg: t('core', 'Please make sure to set the "overwrite.cli.url" option in your config.php file to the URL that your users mainly use to access this Nextcloud. Suggestion: "{suggestedOverwriteCliURL}". Otherwise there might be problems with the URL generation via cron. (It is possible though that the suggested URL is not the URL that your users mainly use to access this Nextcloud. Best is to double check this in any case.)', {suggestedOverwriteCliURL: data.suggestedOverwriteCliURL}),
Expand Down
55 changes: 0 additions & 55 deletions core/js/tests/specs/setupchecksSpec.js
Original file line number Diff line number Diff line change
Expand Up @@ -535,61 +535,6 @@ describe('OC.SetupChecks tests', function() {
});
});

it('should return an error if the admin IP is bruteforce throttled', function(done) {
var async = OC.SetupChecks.checkSetup();

suite.server.requests[0].respond(
200,
{
'Content-Type': 'application/json',
},
JSON.stringify({
suggestedOverwriteCliURL: '',
isFairUseOfFreePushService: true,
isBruteforceThrottled: true,
bruteforceRemoteAddress: '::1',
forwardedForHeadersWorking: true,
reverseProxyDocs: 'https://docs.nextcloud.com/foo/bar.html',
isCorrectMemcachedPHPModuleInstalled: true,
hasPassedCodeIntegrityCheck: true,
OpcacheSetupRecommendations: [],
isSettimelimitAvailable: true,
missingIndexes: [],
missingPrimaryKeys: [],
missingColumns: [],
cronErrors: [],
cronInfo: {
diffInSeconds: 0
},
appDirsWithDifferentOwner: [],
isImagickEnabled: true,
areWebauthnExtensionsEnabled: true,
pendingBigIntConversionColumns: [],
isMysqlUsedWithoutUTF8MB4: false,
isEnoughTempSpaceAvailableIfS3PrimaryStorageIsUsed: true,
reverseProxyGeneratedURL: 'https://server',
temporaryDirectoryWritable: true,
generic: {
network: {
"Internet connectivity": {
severity: "success",
description: null,
linkToDoc: null
}
},
},
})
);

async.done(function( data, s, x ){
expect(data).toEqual([{
msg: 'Your remote address was identified as "::1" and is bruteforce throttled at the moment slowing down the performance of various requests. If the remote address is not your address this can be an indication that a proxy is not configured correctly. Further information can be found in the <a target="_blank" rel="noreferrer noopener" class="external" href="https://docs.nextcloud.com/foo/bar.html">documentation ↗</a>.',
type: OC.SetupChecks.MESSAGE_TYPE_ERROR
}]);
done();
});
});

it('should return an error if set_time_limit is unavailable', function(done) {
var async = OC.SetupChecks.checkSetup();

Expand Down

0 comments on commit fe8b5d4

Please sign in to comment.