From abc98d343cbd43283eee02886c3a89bd3328ed38 Mon Sep 17 00:00:00 2001 From: Joas Schilling Date: Mon, 14 Aug 2023 18:59:50 +0200 Subject: [PATCH] feat(security): Add a "testing mode" for bruteforce protection that doesn't sleep Signed-off-by: Joas Schilling --- config/config.sample.php | 13 +++++++++++++ lib/private/Security/Bruteforce/Throttler.php | 8 ++++++-- 2 files changed, 19 insertions(+), 2 deletions(-) diff --git a/config/config.sample.php b/config/config.sample.php index 210d0a8e8ce..77783021939 100644 --- a/config/config.sample.php +++ b/config/config.sample.php @@ -352,6 +352,19 @@ $CONFIG = [ */ 'auth.bruteforce.protection.enabled' => true, +/** + * Whether the bruteforce protection shipped with Nextcloud should be set to testing mode. + * + * In testing mode bruteforce attempts are still recorded, but the requests do + * not sleep/wait for the specified time. They will still abort with + * "429 Too Many Requests" when the maximum delay is reached. + * Enabling this is discouraged for security reasons + * and should only be done for debugging and on CI when running tests. + * + * Defaults to ``false`` + */ +'auth.bruteforce.protection.testing' => false, + /** * Whether the rate limit protection shipped with Nextcloud should be enabled or not. * diff --git a/lib/private/Security/Bruteforce/Throttler.php b/lib/private/Security/Bruteforce/Throttler.php index cfd88801fcf..2ee4c23cd1e 100644 --- a/lib/private/Security/Bruteforce/Throttler.php +++ b/lib/private/Security/Bruteforce/Throttler.php @@ -280,7 +280,9 @@ class Throttler implements IThrottler { */ public function sleepDelay(string $ip, string $action = ''): int { $delay = $this->getDelay($ip, $action); - usleep($delay * 1000); + if (!$this->config->getSystemValueBool('auth.bruteforce.protection.testing')) { + usleep($delay * 1000); + } return $delay; } @@ -304,7 +306,9 @@ class Throttler implements IThrottler { 'delay' => $delay, ]); } - usleep($delay * 1000); + if (!$this->config->getSystemValueBool('auth.bruteforce.protection.testing')) { + usleep($delay * 1000); + } return $delay; } }