You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

106 lines
3.1 KiB

3 years ago
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2017 Lukas Reschke <lukas@statuscode.ch>
  5. *
  6. * @author Lukas Reschke <lukas@statuscode.ch>
  7. * @author Roeland Jago Douma <roeland@famdouma.nl>
  8. *
  9. * @license GNU AGPL version 3 or any later version
  10. *
  11. * This program is free software: you can redistribute it and/or modify
  12. * it under the terms of the GNU Affero General Public License as
  13. * published by the Free Software Foundation, either version 3 of the
  14. * License, or (at your option) any later version.
  15. *
  16. * This program is distributed in the hope that it will be useful,
  17. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  18. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  19. * GNU Affero General Public License for more details.
  20. *
  21. * You should have received a copy of the GNU Affero General Public License
  22. * along with this program. If not, see <http://www.gnu.org/licenses/>.
  23. *
  24. */
  25. namespace OC\Security\RateLimiting;
  26. use OC\Security\Normalizer\IpAddress;
  27. use OC\Security\RateLimiting\Backend\IBackend;
  28. use OC\Security\RateLimiting\Exception\RateLimitExceededException;
  29. use OCP\AppFramework\Utility\ITimeFactory;
  30. use OCP\IUser;
  31. class Limiter {
  32. /** @var IBackend */
  33. private $backend;
  34. /** @var ITimeFactory */
  35. private $timeFactory;
  36. /**
  37. * @param ITimeFactory $timeFactory
  38. * @param IBackend $backend
  39. */
  40. public function __construct(ITimeFactory $timeFactory,
  41. IBackend $backend) {
  42. $this->backend = $backend;
  43. $this->timeFactory = $timeFactory;
  44. }
  45. /**
  46. * @param string $methodIdentifier
  47. * @param string $userIdentifier
  48. * @param int $period
  49. * @param int $limit
  50. * @throws RateLimitExceededException
  51. */
  52. private function register(string $methodIdentifier,
  53. string $userIdentifier,
  54. int $period,
  55. int $limit): void {
  56. $existingAttempts = $this->backend->getAttempts($methodIdentifier, $userIdentifier, $period);
  57. if ($existingAttempts >= $limit) {
  58. throw new RateLimitExceededException();
  59. }
  60. $this->backend->registerAttempt($methodIdentifier, $userIdentifier, $this->timeFactory->getTime());
  61. }
  62. /**
  63. * Registers attempt for an anonymous request
  64. *
  65. * @param string $identifier
  66. * @param int $anonLimit
  67. * @param int $anonPeriod
  68. * @param string $ip
  69. * @throws RateLimitExceededException
  70. */
  71. public function registerAnonRequest(string $identifier,
  72. int $anonLimit,
  73. int $anonPeriod,
  74. string $ip): void {
  75. $ipSubnet = (new IpAddress($ip))->getSubnet();
  76. $anonHashIdentifier = hash('sha512', 'anon::' . $identifier . $ipSubnet);
  77. $this->register($identifier, $anonHashIdentifier, $anonPeriod, $anonLimit);
  78. }
  79. /**
  80. * Registers attempt for an authenticated request
  81. *
  82. * @param string $identifier
  83. * @param int $userLimit
  84. * @param int $userPeriod
  85. * @param IUser $user
  86. * @throws RateLimitExceededException
  87. */
  88. public function registerUserRequest(string $identifier,
  89. int $userLimit,
  90. int $userPeriod,
  91. IUser $user): void {
  92. $userHashIdentifier = hash('sha512', 'user::' . $identifier . $user->getUID());
  93. $this->register($identifier, $userHashIdentifier, $userPeriod, $userLimit);
  94. }
  95. }