Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(security): Add a bruteforce protection backend base on memcache #39870

Merged
merged 7 commits into from
Aug 22, 2023

Conversation

nickvergessen
Copy link
Member

@nickvergessen nickvergessen commented Aug 14, 2023

TODO

  • Add memcache based bruteforce protection backend
  • Add a commend to read the state
  • Expose the throttle delay as a custom header
  • Add a testing mode to allow integration testing
  • Show admins when they are throttled
    Bildschirmfoto vom 2023-08-17 08-56-15

Checklist

@nickvergessen nickvergessen added this to the Nextcloud 28 milestone Aug 14, 2023
@nickvergessen nickvergessen self-assigned this Aug 14, 2023
@nickvergessen nickvergessen marked this pull request as draft August 14, 2023 17:20
config/config.sample.php Outdated Show resolved Hide resolved
core/Command/Security/BruteforceAttempts.php Fixed Show fixed Hide fixed

$data = [
'allow-listed' => $this->throttler->isIPWhitelisted($ip),
'attempts' => $this->throttler->getAttempts(

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getAttempts has been marked as deprecated
$ip,
(string) $input->getArgument('action'),
),
'delay' => $this->throttler->getDelay(

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getDelay has been marked as deprecated
@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch 3 times, most recently from 9bae121 to 2a6e4be Compare August 16, 2023 07:21
@icewind1991
Copy link
Member

I've created a similar bruteforce stats command recently: #39580

@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch from 2a6e4be to 0c7bc29 Compare August 16, 2023 10:15
@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch from e33b647 to 90bfa01 Compare August 17, 2023 07:01
@nickvergessen
Copy link
Member Author

/backport to stable27

@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch 2 times, most recently from 6816c17 to 3d9b2ad Compare August 18, 2023 11:02
@nickvergessen nickvergessen added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Aug 18, 2023
@nickvergessen nickvergessen marked this pull request as ready for review August 18, 2023 11:03
@nickvergessen nickvergessen requested a review from artonge August 18, 2023 11:04
@@ -920,6 +925,8 @@
'cronInfo' => $this->getLastCronInfo(),
'cronErrors' => $this->getCronErrors(),
'isFairUseOfFreePushService' => $this->isFairUseOfFreePushService(),
'isBruteforceThrottled' => $this->throttler->getAttempts($this->request->getRemoteAddress()) !== 0,

Check notice

Code scanning / Psalm

DeprecatedMethod

The method OCP\Security\Bruteforce\IThrottler::getAttempts has been marked as deprecated
@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch from 3d9b2ad to 09cba0d Compare August 21, 2023 14:36
@nickvergessen nickvergessen requested a review from Altahrim August 21, 2023 14:37
@nickvergessen nickvergessen force-pushed the perf/noid/memcache-bfp-backend branch from 09cba0d to bed3ffb Compare August 21, 2023 14:40
@nickvergessen nickvergessen merged commit 82835ea into master Aug 22, 2023
@nickvergessen nickvergessen deleted the perf/noid/memcache-bfp-backend branch August 22, 2023 06:32
@backportbot-nextcloud
Copy link

The backport to stable27 failed. Please do this backport manually.

# Switch to the target branch and update it
git checkout stable27
git pull origin stable27

# Create the new backport branch
git checkout -b fix/foo-stable27

# Cherry pick the change from the commit sha1 of the change against the default branch
# This might cause conflicts. Resolve them.
git cherry-pick abc123

# Push the cherry pick commit to the remote repository and open a pull request
git push origin fix/foo-stable27

More info at https://docs.nextcloud.com/server/latest/developer_manual/getting_started/development_process.html#manual-backport

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants