includes/auth/ThrottlePreAuthenticationProvider.php

   1 <?php
   2 /**
   3  * This program is free software; you can redistribute it and/or modify
   4  * it under the terms of the GNU General Public License as published by
   5  * the Free Software Foundation; either version 2 of the License, or
   6  * (at your option) any later version.
   7  *
   8  * This program is distributed in the hope that it will be useful,
   9  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  10  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  11  * GNU General Public License for more details.
  12  *
  13  * You should have received a copy of the GNU General Public License along
  14  * with this program; if not, write to the Free Software Foundation, Inc.,
  15  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  16  * http://www.gnu.org/copyleft/gpl.html
  17  *
  18  * @file
  19  * @ingroup Auth
  20  */
  21
  22 namespace MediaWiki\Auth;
  23
  24 use BagOStuff;
  25 use Config;
  26
  27 /**
  28  * A pre-authentication provider to throttle authentication actions.
  29  *
  30  * Adding this provider will throttle account creations and primary authentication attempts
  31  * (more specifically, any authentication that returns FAIL on failure). Secondary authentication
  32  * cannot be easily throttled on a framework level (since it would typically return UI on failure);
  33  * secondary providers are expected to do their own throttling.
  34  * @ingroup Auth
  35  * @since 1.27
  36  */
  37 class ThrottlePreAuthenticationProvider extends AbstractPreAuthenticationProvider {
  38         /** @var array */
  39         protected $throttleSettings;
  40
  41         /** @var Throttler */
  42         protected $accountCreationThrottle;
  43
  44         /** @var Throttler */
  45         protected $passwordAttemptThrottle;
  46
  47         /** @var BagOStuff */
  48         protected $cache;
  49
  50         /**
  51          * @param array $params
  52          *  - accountCreationThrottle: (array) Condition array for the account creation throttle; an array
  53          *    of arrays in a format like $wgPasswordAttemptThrottle, passed to the Throttler constructor.
  54          *  - passwordAttemptThrottle: (array) Condition array for the password attempt throttle, in the
  55          *    same format as accountCreationThrottle.
  56          *  - cache: (BagOStuff) Where to store the throttle, defaults to the local cluster instance.
  57          */
  58         public function __construct( $params = [] ) {
  59                 $this->throttleSettings = array_intersect_key( $params,
  60                         [ 'accountCreationThrottle' => true, 'passwordAttemptThrottle' => true ] );
  61                 $this->cache = isset( $params['cache'] ) ? $params['cache'] :
  62                         \ObjectCache::getLocalClusterInstance();
  63         }
  64
  65         public function setConfig( Config $config ) {
  66                 parent::setConfig( $config );
  67
  68                 // @codeCoverageIgnoreStart
  69                 $this->throttleSettings += [
  70                 // @codeCoverageIgnoreEnd
  71                         'accountCreationThrottle' => [ [
  72                                 'count' => $this->config->get( 'AccountCreationThrottle' ),
  73                                 'seconds' => 86400,
  74                         ] ],
  75                         'passwordAttemptThrottle' => $this->config->get( 'PasswordAttemptThrottle' ),
  76                 ];
  77
  78                 if ( !empty( $this->throttleSettings['accountCreationThrottle'] ) ) {
  79                         $this->accountCreationThrottle = new Throttler(
  80                                 $this->throttleSettings['accountCreationThrottle'], [
  81                                         'type' => 'acctcreate',
  82                                         'cache' => $this->cache,
  83                                 ]
  84                         );
  85                 }
  86                 if ( !empty( $this->throttleSettings['passwordAttemptThrottle'] ) ) {
  87                         $this->passwordAttemptThrottle = new Throttler(
  88                                 $this->throttleSettings['passwordAttemptThrottle'], [
  89                                         'type' => 'password',
  90                                         'cache' => $this->cache,
  91                                 ]
  92                         );
  93                 }
  94         }
  95
  96         public function testForAccountCreation( $user, $creator, array $reqs ) {
  97                 if ( !$this->accountCreationThrottle || !$creator->isPingLimitable() ) {
  98                         return \StatusValue::newGood();
  99                 }
 100
 101                 $ip = $this->manager->getRequest()->getIP();
 102
 103                 if ( !\Hooks::run( 'ExemptFromAccountCreationThrottle', [ $ip ] ) ) {
 104                         $this->logger->debug( __METHOD__ . ": a hook allowed account creation w/o throttle\n" );
 105                         return \StatusValue::newGood();
 106                 }
 107
 108                 $result = $this->accountCreationThrottle->increase( null, $ip, __METHOD__ );
 109                 if ( $result ) {
 110                         return \StatusValue::newFatal( 'acct_creation_throttle_hit', $result['count'] );
 111                 }
 112
 113                 return \StatusValue::newGood();
 114         }
 115
 116         public function testForAuthentication( array $reqs ) {
 117                 if ( !$this->passwordAttemptThrottle ) {
 118                         return \StatusValue::newGood();
 119                 }
 120
 121                 $ip = $this->manager->getRequest()->getIP();
 122                 try {
 123                         $username = AuthenticationRequest::getUsernameFromRequests( $reqs );
 124                 } catch ( \UnexpectedValueException $e ) {
 125                         $username = '';
 126                 }
 127
 128                 // Get everything this username could normalize to, and throttle each one individually.
 129                 // If nothing uses usernames, just throttle by IP.
 130                 $usernames = $this->manager->normalizeUsername( $username );
 131                 $result = false;
 132                 foreach ( $usernames as $name ) {
 133                         $r = $this->passwordAttemptThrottle->increase( $name, $ip, __METHOD__ );
 134                         if ( $r && ( !$result || $result['wait'] < $r['wait'] ) ) {
 135                                 $result = $r;
 136                         }
 137                 }
 138
 139                 if ( $result ) {
 140                         $message = wfMessage( 'login-throttled' )->durationParams( $result['wait'] );
 141                         return \StatusValue::newFatal( $message );
 142                 } else {
 143                         $this->manager->setAuthenticationSessionData( 'LoginThrottle',
 144                                 [ 'users' => $usernames, 'ip' => $ip ] );
 145                         return \StatusValue::newGood();
 146                 }
 147         }
 148
 149         /**
 150          * @param null|\User $user
 151          * @param AuthenticationResponse $response
 152          */
 153         public function postAuthentication( $user, AuthenticationResponse $response ) {
 154                 if ( $response->status !== AuthenticationResponse::PASS ) {
 155                         return;
 156                 } elseif ( !$this->passwordAttemptThrottle ) {
 157                         return;
 158                 }
 159
 160                 $data = $this->manager->getAuthenticationSessionData( 'LoginThrottle' );
 161                 if ( !$data ) {
 162                         $this->logger->error( 'throttler data not found for {user}', [ 'user' => $user->getName() ] );
 163                         return;
 164                 }
 165
 166                 foreach ( $data['users'] as $name ) {
 167                         $this->passwordAttemptThrottle->clear( $name, $data['ip'] );
 168                 }
 169         }
 170 }