nextcloud / server

lib/private/Repair/AddBruteForceCleanupJob.php

Indentation +11 added lines, -11 removed lines

@@ -32,18 +32,18 @@
 
 class AddBruteForceCleanupJob implements IRepairStep {
 
-	/** @var IJobList */
-	protected $jobList;
+    /** @var IJobList */
+    protected $jobList;
 
-	public function __construct(IJobList $jobList) {
-		$this->jobList = $jobList;
-	}
+    public function __construct(IJobList $jobList) {
+        $this->jobList = $jobList;
+    }
 
-	public function getName() {
-		return 'Add job to cleanup the bruteforce entries';
-	}
+    public function getName() {
+        return 'Add job to cleanup the bruteforce entries';
+    }
 
-	public function run(IOutput $output) {
-		$this->jobList->add(CleanupJob::class);
-	}
+    public function run(IOutput $output) {
+        $this->jobList->add(CleanupJob::class);
+    }
 }

lib/private/Repair.php

Indentation +176 added lines, -176 removed lines

@@ -71,180 +71,180 @@
 
 class Repair implements IOutput {
 
-	/** @var IRepairStep[] */
-	private $repairSteps;
-
-	/** @var EventDispatcherInterface */
-	private $dispatcher;
-
-	/** @var string */
-	private $currentStep;
-
-	/**
-	 * Creates a new repair step runner
-	 *
-	 * @param IRepairStep[] $repairSteps array of RepairStep instances
-	 * @param EventDispatcherInterface $dispatcher
-	 */
-	public function __construct(array $repairSteps, EventDispatcherInterface $dispatcher) {
-		$this->repairSteps = $repairSteps;
-		$this->dispatcher = $dispatcher;
-	}
-
-	/**
-	 * Run a series of repair steps for common problems
-	 */
-	public function run() {
-		if (count($this->repairSteps) === 0) {
-			$this->emit('\OC\Repair', 'info', ['No repair steps available']);
-
-			return;
-		}
-		// run each repair step
-		foreach ($this->repairSteps as $step) {
-			$this->currentStep = $step->getName();
-			$this->emit('\OC\Repair', 'step', [$this->currentStep]);
-			$step->run($this);
-		}
-	}
-
-	/**
-	 * Add repair step
-	 *
-	 * @param IRepairStep|string $repairStep repair step
-	 * @throws \Exception
-	 */
-	public function addStep($repairStep) {
-		if (is_string($repairStep)) {
-			try {
-				$s = \OC::$server->query($repairStep);
-			} catch (QueryException $e) {
-				if (class_exists($repairStep)) {
-					$s = new $repairStep();
-				} else {
-					throw new \Exception("Repair step '$repairStep' is unknown");
-				}
-			}
-
-			if ($s instanceof IRepairStep) {
-				$this->repairSteps[] = $s;
-			} else {
-				throw new \Exception("Repair step '$repairStep' is not of type \\OCP\\Migration\\IRepairStep");
-			}
-		} else {
-			$this->repairSteps[] = $repairStep;
-		}
-	}
-
-	/**
-	 * Returns the default repair steps to be run on the
-	 * command line or after an upgrade.
-	 *
-	 * @return IRepairStep[]
-	 */
-	public static function getRepairSteps() {
-		return [
-			new Collation(\OC::$server->getConfig(), \OC::$server->getLogger(), \OC::$server->getDatabaseConnection(), false),
-			new RepairMimeTypes(\OC::$server->getConfig()),
-			new CleanTags(\OC::$server->getDatabaseConnection(), \OC::$server->getUserManager()),
-			new RepairInvalidShares(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection()),
-			new MoveUpdaterStepFile(\OC::$server->getConfig()),
-			new FixMountStorages(\OC::$server->getDatabaseConnection()),
-			new AddLogRotateJob(\OC::$server->getJobList()),
-			new ClearFrontendCaches(\OC::$server->getMemCacheFactory(), \OC::$server->query(SCSSCacher::class), \OC::$server->query(JSCombiner::class)),
-			new ClearGeneratedAvatarCache(\OC::$server->getConfig(), \OC::$server->query(AvatarManager::class)),
-			new AddPreviewBackgroundCleanupJob(\OC::$server->getJobList()),
-			new AddCleanupUpdaterBackupsJob(\OC::$server->getJobList()),
-			new CleanupCardDAVPhotoCache(\OC::$server->getConfig(), \OC::$server->getAppDataDir('dav-photocache'), \OC::$server->getLogger()),
-			new AddClenupLoginFlowV2BackgroundJob(\OC::$server->getJobList()),
-			new RemoveLinkShares(\OC::$server->getDatabaseConnection(), \OC::$server->getConfig(), \OC::$server->getGroupManager(), \OC::$server->getNotificationManager(), \OC::$server->query(ITimeFactory::class)),
-			new ClearCollectionsAccessCache(\OC::$server->getConfig(), \OC::$server->query(IManager::class)),
-			\OC::$server->query(ResetGeneratedAvatarFlag::class),
-			\OC::$server->query(EncryptionLegacyCipher::class),
-			\OC::$server->query(EncryptionMigration::class),
-			\OC::$server->get(ShippedDashboardEnable::class),
-			\OC::$server->get(AddBruteForceCleanupJob::class),
-		];
-	}
-
-	/**
-	 * Returns expensive repair steps to be run on the
-	 * command line with a special option.
-	 *
-	 * @return IRepairStep[]
-	 */
-	public static function getExpensiveRepairSteps() {
-		return [
-			new OldGroupMembershipShares(\OC::$server->getDatabaseConnection(), \OC::$server->getGroupManager())
-		];
-	}
-
-	/**
-	 * Returns the repair steps to be run before an
-	 * upgrade.
-	 *
-	 * @return IRepairStep[]
-	 */
-	public static function getBeforeUpgradeRepairSteps() {
-		$connection = \OC::$server->getDatabaseConnection();
-		$config = \OC::$server->getConfig();
-		$steps = [
-			new Collation(\OC::$server->getConfig(), \OC::$server->getLogger(), $connection, true),
-			new SqliteAutoincrement($connection),
-			new SaveAccountsTableData($connection, $config),
-			new DropAccountTermsTable($connection)
-		];
-
-		return $steps;
-	}
-
-	/**
-	 * @param string $scope
-	 * @param string $method
-	 * @param array $arguments
-	 */
-	public function emit($scope, $method, array $arguments = []) {
-		if (!is_null($this->dispatcher)) {
-			$this->dispatcher->dispatch("$scope::$method",
-				new GenericEvent("$scope::$method", $arguments));
-		}
-	}
-
-	public function info($string) {
-		// for now just emit as we did in the past
-		$this->emit('\OC\Repair', 'info', [$string]);
-	}
-
-	/**
-	 * @param string $message
-	 */
-	public function warning($message) {
-		// for now just emit as we did in the past
-		$this->emit('\OC\Repair', 'warning', [$message]);
-	}
-
-	/**
-	 * @param int $max
-	 */
-	public function startProgress($max = 0) {
-		// for now just emit as we did in the past
-		$this->emit('\OC\Repair', 'startProgress', [$max, $this->currentStep]);
-	}
-
-	/**
-	 * @param int $step
-	 * @param string $description
-	 */
-	public function advance($step = 1, $description = '') {
-		// for now just emit as we did in the past
-		$this->emit('\OC\Repair', 'advance', [$step, $description]);
-	}
-
-	/**
-	 * @param int $max
-	 */
-	public function finishProgress() {
-		// for now just emit as we did in the past
-		$this->emit('\OC\Repair', 'finishProgress', []);
-	}
+    /** @var IRepairStep[] */
+    private $repairSteps;
+
+    /** @var EventDispatcherInterface */
+    private $dispatcher;
+
+    /** @var string */
+    private $currentStep;
+
+    /**
+     * Creates a new repair step runner
+     *
+     * @param IRepairStep[] $repairSteps array of RepairStep instances
+     * @param EventDispatcherInterface $dispatcher
+     */
+    public function __construct(array $repairSteps, EventDispatcherInterface $dispatcher) {
+        $this->repairSteps = $repairSteps;
+        $this->dispatcher = $dispatcher;
+    }
+
+    /**
+     * Run a series of repair steps for common problems
+     */
+    public function run() {
+        if (count($this->repairSteps) === 0) {
+            $this->emit('\OC\Repair', 'info', ['No repair steps available']);
+
+            return;
+        }
+        // run each repair step
+        foreach ($this->repairSteps as $step) {
+            $this->currentStep = $step->getName();
+            $this->emit('\OC\Repair', 'step', [$this->currentStep]);
+            $step->run($this);
+        }
+    }
+
+    /**
+     * Add repair step
+     *
+     * @param IRepairStep|string $repairStep repair step
+     * @throws \Exception
+     */
+    public function addStep($repairStep) {
+        if (is_string($repairStep)) {
+            try {
+                $s = \OC::$server->query($repairStep);
+            } catch (QueryException $e) {
+                if (class_exists($repairStep)) {
+                    $s = new $repairStep();
+                } else {
+                    throw new \Exception("Repair step '$repairStep' is unknown");
+                }
+            }
+
+            if ($s instanceof IRepairStep) {
+                $this->repairSteps[] = $s;
+            } else {
+                throw new \Exception("Repair step '$repairStep' is not of type \\OCP\\Migration\\IRepairStep");
+            }
+        } else {
+            $this->repairSteps[] = $repairStep;
+        }
+    }
+
+    /**
+     * Returns the default repair steps to be run on the
+     * command line or after an upgrade.
+     *
+     * @return IRepairStep[]
+     */
+    public static function getRepairSteps() {
+        return [
+            new Collation(\OC::$server->getConfig(), \OC::$server->getLogger(), \OC::$server->getDatabaseConnection(), false),
+            new RepairMimeTypes(\OC::$server->getConfig()),
+            new CleanTags(\OC::$server->getDatabaseConnection(), \OC::$server->getUserManager()),
+            new RepairInvalidShares(\OC::$server->getConfig(), \OC::$server->getDatabaseConnection()),
+            new MoveUpdaterStepFile(\OC::$server->getConfig()),
+            new FixMountStorages(\OC::$server->getDatabaseConnection()),
+            new AddLogRotateJob(\OC::$server->getJobList()),
+            new ClearFrontendCaches(\OC::$server->getMemCacheFactory(), \OC::$server->query(SCSSCacher::class), \OC::$server->query(JSCombiner::class)),
+            new ClearGeneratedAvatarCache(\OC::$server->getConfig(), \OC::$server->query(AvatarManager::class)),
+            new AddPreviewBackgroundCleanupJob(\OC::$server->getJobList()),
+            new AddCleanupUpdaterBackupsJob(\OC::$server->getJobList()),
+            new CleanupCardDAVPhotoCache(\OC::$server->getConfig(), \OC::$server->getAppDataDir('dav-photocache'), \OC::$server->getLogger()),
+            new AddClenupLoginFlowV2BackgroundJob(\OC::$server->getJobList()),
+            new RemoveLinkShares(\OC::$server->getDatabaseConnection(), \OC::$server->getConfig(), \OC::$server->getGroupManager(), \OC::$server->getNotificationManager(), \OC::$server->query(ITimeFactory::class)),
+            new ClearCollectionsAccessCache(\OC::$server->getConfig(), \OC::$server->query(IManager::class)),
+            \OC::$server->query(ResetGeneratedAvatarFlag::class),
+            \OC::$server->query(EncryptionLegacyCipher::class),
+            \OC::$server->query(EncryptionMigration::class),
+            \OC::$server->get(ShippedDashboardEnable::class),
+            \OC::$server->get(AddBruteForceCleanupJob::class),
+        ];
+    }
+
+    /**
+     * Returns expensive repair steps to be run on the
+     * command line with a special option.
+     *
+     * @return IRepairStep[]
+     */
+    public static function getExpensiveRepairSteps() {
+        return [
+            new OldGroupMembershipShares(\OC::$server->getDatabaseConnection(), \OC::$server->getGroupManager())
+        ];
+    }
+
+    /**
+     * Returns the repair steps to be run before an
+     * upgrade.
+     *
+     * @return IRepairStep[]
+     */
+    public static function getBeforeUpgradeRepairSteps() {
+        $connection = \OC::$server->getDatabaseConnection();
+        $config = \OC::$server->getConfig();
+        $steps = [
+            new Collation(\OC::$server->getConfig(), \OC::$server->getLogger(), $connection, true),
+            new SqliteAutoincrement($connection),
+            new SaveAccountsTableData($connection, $config),
+            new DropAccountTermsTable($connection)
+        ];
+
+        return $steps;
+    }
+
+    /**
+     * @param string $scope
+     * @param string $method
+     * @param array $arguments
+     */
+    public function emit($scope, $method, array $arguments = []) {
+        if (!is_null($this->dispatcher)) {
+            $this->dispatcher->dispatch("$scope::$method",
+                new GenericEvent("$scope::$method", $arguments));
+        }
+    }
+
+    public function info($string) {
+        // for now just emit as we did in the past
+        $this->emit('\OC\Repair', 'info', [$string]);
+    }
+
+    /**
+     * @param string $message
+     */
+    public function warning($message) {
+        // for now just emit as we did in the past
+        $this->emit('\OC\Repair', 'warning', [$message]);
+    }
+
+    /**
+     * @param int $max
+     */
+    public function startProgress($max = 0) {
+        // for now just emit as we did in the past
+        $this->emit('\OC\Repair', 'startProgress', [$max, $this->currentStep]);
+    }
+
+    /**
+     * @param int $step
+     * @param string $description
+     */
+    public function advance($step = 1, $description = '') {
+        // for now just emit as we did in the past
+        $this->emit('\OC\Repair', 'advance', [$step, $description]);
+    }
+
+    /**
+     * @param int $max
+     */
+    public function finishProgress() {
+        // for now just emit as we did in the past
+        $this->emit('\OC\Repair', 'finishProgress', []);
+    }
 }

lib/private/Security/Bruteforce/CleanupJob.php

Indentation +20 added lines, -20 removed lines

@@ -32,24 +32,24 @@
 
 class CleanupJob extends TimedJob {
 
-	/** @var IDBConnection */
-	private $connection;
-
-	public function __construct(ITimeFactory $time, IDBConnection $connection) {
-		parent::__construct($time);
-		$this->connection = $connection;
-
-		// Run once a day
-		$this->setInterval(3600 * 24);
-	}
-
-	protected function run($argument) {
-		// Delete all entries more than 48 hours old
-		$time = $this->time->getTime() - (48 * 3600);
-
-		$qb = $this->connection->getQueryBuilder();
-		$qb->delete('bruteforce_attempts')
-			->where($qb->expr()->lt('occurred', $qb->createNamedParameter($time), IQueryBuilder::PARAM_INT));
-		$qb->execute();
-	}
+    /** @var IDBConnection */
+    private $connection;
+
+    public function __construct(ITimeFactory $time, IDBConnection $connection) {
+        parent::__construct($time);
+        $this->connection = $connection;
+
+        // Run once a day
+        $this->setInterval(3600 * 24);
+    }
+
+    protected function run($argument) {
+        // Delete all entries more than 48 hours old
+        $time = $this->time->getTime() - (48 * 3600);
+
+        $qb = $this->connection->getQueryBuilder();
+        $qb->delete('bruteforce_attempts')
+            ->where($qb->expr()->lt('occurred', $qb->createNamedParameter($time), IQueryBuilder::PARAM_INT));
+        $qb->execute();
+    }
 }

lib/private/Security/Bruteforce/Throttler.php

Indentation +303 added lines, -303 removed lines

@@ -54,307 +54,307 @@
  * @package OC\Security\Bruteforce
  */
 class Throttler {
-	public const LOGIN_ACTION = 'login';
-	public const MAX_DELAY = 25;
-	public const MAX_DELAY_MS = 25000; // in milliseconds
-	public const MAX_ATTEMPTS = 10;
-
-	/** @var IDBConnection */
-	private $db;
-	/** @var ITimeFactory */
-	private $timeFactory;
-	/** @var ILogger */
-	private $logger;
-	/** @var IConfig */
-	private $config;
-
-	/**
-	 * @param IDBConnection $db
-	 * @param ITimeFactory $timeFactory
-	 * @param ILogger $logger
-	 * @param IConfig $config
-	 */
-	public function __construct(IDBConnection $db,
-								ITimeFactory $timeFactory,
-								ILogger $logger,
-								IConfig $config) {
-		$this->db = $db;
-		$this->timeFactory = $timeFactory;
-		$this->logger = $logger;
-		$this->config = $config;
-	}
-
-	/**
-	 * Convert a number of seconds into the appropriate DateInterval
-	 *
-	 * @param int $expire
-	 * @return \DateInterval
-	 */
-	private function getCutoff(int $expire): \DateInterval {
-		$d1 = new \DateTime();
-		$d2 = clone $d1;
-		$d2->sub(new \DateInterval('PT' . $expire . 'S'));
-		return $d2->diff($d1);
-	}
-
-	/**
-	 *  Calculate the cut off timestamp
-	 *
-	 * @param float $maxAgeHours
-	 * @return int
-	 */
-	private function getCutoffTimestamp(float $maxAgeHours = 12.0): int {
-		return (new \DateTime())
-			->sub($this->getCutoff((int) ($maxAgeHours * 3600)))
-			->getTimestamp();
-	}
-
-	/**
-	 * Register a failed attempt to bruteforce a security control
-	 *
-	 * @param string $action
-	 * @param string $ip
-	 * @param array $metadata Optional metadata logged to the database
-	 */
-	public function registerAttempt(string $action,
-									string $ip,
-									array $metadata = []): void {
-		// No need to log if the bruteforce protection is disabled
-		if ($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
-			return;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		$values = [
-			'action' => $action,
-			'occurred' => $this->timeFactory->getTime(),
-			'ip' => (string)$ipAddress,
-			'subnet' => $ipAddress->getSubnet(),
-			'metadata' => json_encode($metadata),
-		];
-
-		$this->logger->notice(
-			sprintf(
-				'Bruteforce attempt from "%s" detected for action "%s".',
-				$ip,
-				$action
-			),
-			[
-				'app' => 'core',
-			]
-		);
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->insert('bruteforce_attempts');
-		foreach ($values as $column => $value) {
-			$qb->setValue($column, $qb->createNamedParameter($value));
-		}
-		$qb->execute();
-	}
-
-	/**
-	 * Check if the IP is whitelisted
-	 *
-	 * @param string $ip
-	 * @return bool
-	 */
-	private function isIPWhitelisted(string $ip): bool {
-		if ($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
-			return true;
-		}
-
-		$keys = $this->config->getAppKeys('bruteForce');
-		$keys = array_filter($keys, function ($key) {
-			return 0 === strpos($key, 'whitelist_');
-		});
-
-		if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-			$type = 4;
-		} elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-			$type = 6;
-		} else {
-			return false;
-		}
-
-		$ip = inet_pton($ip);
-
-		foreach ($keys as $key) {
-			$cidr = $this->config->getAppValue('bruteForce', $key, null);
-
-			$cx = explode('/', $cidr);
-			$addr = $cx[0];
-			$mask = (int)$cx[1];
-
-			// Do not compare ipv4 to ipv6
-			if (($type === 4 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) ||
-				($type === 6 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
-				continue;
-			}
-
-			$addr = inet_pton($addr);
-
-			$valid = true;
-			for ($i = 0; $i < $mask; $i++) {
-				$part = ord($addr[(int)($i / 8)]);
-				$orig = ord($ip[(int)($i / 8)]);
-
-				$bitmask = 1 << (7 - ($i % 8));
-
-				$part = $part & $bitmask;
-				$orig = $orig & $bitmask;
-
-				if ($part !== $orig) {
-					$valid = false;
-					break;
-				}
-			}
-
-			if ($valid === true) {
-				return true;
-			}
-		}
-
-		return false;
-	}
-
-	/**
-	 * Get the throttling delay (in milliseconds)
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @param float $maxAgeHours
-	 * @return int
-	 */
-	public function getAttempts(string $ip, string $action = '', float $maxAgeHours = 12): int {
-		if ($maxAgeHours > 48) {
-			$this->logger->error('Bruteforce has to use less than 48 hours');
-			$maxAgeHours = 48;
-		}
-
-		if ($ip === '') {
-			return 0;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		if ($this->isIPWhitelisted((string)$ipAddress)) {
-			return 0;
-		}
-
-		$cutoffTime = $this->getCutoffTimestamp($maxAgeHours);
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->select($qb->func()->count('*', 'attempts'))
-			->from('bruteforce_attempts')
-			->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
-			->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())));
-
-		if ($action !== '') {
-			$qb->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)));
-		}
-
-		$result = $qb->execute();
-		$row = $result->fetch();
-		$result->closeCursor();
-
-		return (int) $row['attempts'];
-	}
-
-	/**
-	 * Get the throttling delay (in milliseconds)
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @return int
-	 */
-	public function getDelay(string $ip, string $action = ''): int {
-		$attempts = $this->getAttempts($ip, $action);
-		if ($attempts === 0) {
-			return 0;
-		}
-
-		$firstDelay = 0.1;
-		if ($attempts > self::MAX_ATTEMPTS) {
-			// Don't ever overflow. Just assume the maxDelay time:s
-			return self::MAX_DELAY_MS;
-		}
-
-		$delay = $firstDelay * 2 ** $attempts;
-		if ($delay > self::MAX_DELAY) {
-			return self::MAX_DELAY_MS;
-		}
-		return (int) \ceil($delay * 1000);
-	}
-
-	/**
-	 * Reset the throttling delay for an IP address, action and metadata
-	 *
-	 * @param string $ip
-	 * @param string $action
-	 * @param array $metadata
-	 */
-	public function resetDelay(string $ip, string $action, array $metadata): void {
-		$ipAddress = new IpAddress($ip);
-		if ($this->isIPWhitelisted((string)$ipAddress)) {
-			return;
-		}
-
-		$cutoffTime = $this->getCutoffTimestamp();
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete('bruteforce_attempts')
-			->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
-			->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())))
-			->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)))
-			->andWhere($qb->expr()->eq('metadata', $qb->createNamedParameter(json_encode($metadata))));
-
-		$qb->execute();
-	}
-
-	/**
-	 * Reset the throttling delay for an IP address
-	 *
-	 * @param string $ip
-	 */
-	public function resetDelayForIP($ip) {
-		$cutoffTime = $this->getCutoffTimestamp();
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->delete('bruteforce_attempts')
-			->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
-			->andWhere($qb->expr()->eq('ip', $qb->createNamedParameter($ip)));
-
-		$qb->execute();
-	}
-
-	/**
-	 * Will sleep for the defined amount of time
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @return int the time spent sleeping
-	 */
-	public function sleepDelay(string $ip, string $action = ''): int {
-		$delay = $this->getDelay($ip, $action);
-		usleep($delay * 1000);
-		return $delay;
-	}
-
-	/**
-	 * Will sleep for the defined amount of time unless maximum was reached in the last 30 minutes
-	 * In this case a "429 Too Many Request" exception is thrown
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @return int the time spent sleeping
-	 * @throws MaxDelayReached when reached the maximum
-	 */
-	public function sleepDelayOrThrowOnMax(string $ip, string $action = ''): int {
-		$delay = $this->getDelay($ip, $action);
-		if (($delay === self::MAX_DELAY_MS) && $this->getAttempts($ip, $action, 0.5) > self::MAX_ATTEMPTS) {
-			// If the ip made too many attempts within the last 30 mins we don't execute anymore
-			throw new MaxDelayReached('Reached maximum delay');
-		}
-		usleep($delay * 1000);
-		return $delay;
-	}
+    public const LOGIN_ACTION = 'login';
+    public const MAX_DELAY = 25;
+    public const MAX_DELAY_MS = 25000; // in milliseconds
+    public const MAX_ATTEMPTS = 10;
+
+    /** @var IDBConnection */
+    private $db;
+    /** @var ITimeFactory */
+    private $timeFactory;
+    /** @var ILogger */
+    private $logger;
+    /** @var IConfig */
+    private $config;
+
+    /**
+     * @param IDBConnection $db
+     * @param ITimeFactory $timeFactory
+     * @param ILogger $logger
+     * @param IConfig $config
+     */
+    public function __construct(IDBConnection $db,
+                                ITimeFactory $timeFactory,
+                                ILogger $logger,
+                                IConfig $config) {
+        $this->db = $db;
+        $this->timeFactory = $timeFactory;
+        $this->logger = $logger;
+        $this->config = $config;
+    }
+
+    /**
+     * Convert a number of seconds into the appropriate DateInterval
+     *
+     * @param int $expire
+     * @return \DateInterval
+     */
+    private function getCutoff(int $expire): \DateInterval {
+        $d1 = new \DateTime();
+        $d2 = clone $d1;
+        $d2->sub(new \DateInterval('PT' . $expire . 'S'));
+        return $d2->diff($d1);
+    }
+
+    /**
+     *  Calculate the cut off timestamp
+     *
+     * @param float $maxAgeHours
+     * @return int
+     */
+    private function getCutoffTimestamp(float $maxAgeHours = 12.0): int {
+        return (new \DateTime())
+            ->sub($this->getCutoff((int) ($maxAgeHours * 3600)))
+            ->getTimestamp();
+    }
+
+    /**
+     * Register a failed attempt to bruteforce a security control
+     *
+     * @param string $action
+     * @param string $ip
+     * @param array $metadata Optional metadata logged to the database
+     */
+    public function registerAttempt(string $action,
+                                    string $ip,
+                                    array $metadata = []): void {
+        // No need to log if the bruteforce protection is disabled
+        if ($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
+            return;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        $values = [
+            'action' => $action,
+            'occurred' => $this->timeFactory->getTime(),
+            'ip' => (string)$ipAddress,
+            'subnet' => $ipAddress->getSubnet(),
+            'metadata' => json_encode($metadata),
+        ];
+
+        $this->logger->notice(
+            sprintf(
+                'Bruteforce attempt from "%s" detected for action "%s".',
+                $ip,
+                $action
+            ),
+            [
+                'app' => 'core',
+            ]
+        );
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->insert('bruteforce_attempts');
+        foreach ($values as $column => $value) {
+            $qb->setValue($column, $qb->createNamedParameter($value));
+        }
+        $qb->execute();
+    }
+
+    /**
+     * Check if the IP is whitelisted
+     *
+     * @param string $ip
+     * @return bool
+     */
+    private function isIPWhitelisted(string $ip): bool {
+        if ($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
+            return true;
+        }
+
+        $keys = $this->config->getAppKeys('bruteForce');
+        $keys = array_filter($keys, function ($key) {
+            return 0 === strpos($key, 'whitelist_');
+        });
+
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            $type = 4;
+        } elseif (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+            $type = 6;
+        } else {
+            return false;
+        }
+
+        $ip = inet_pton($ip);
+
+        foreach ($keys as $key) {
+            $cidr = $this->config->getAppValue('bruteForce', $key, null);
+
+            $cx = explode('/', $cidr);
+            $addr = $cx[0];
+            $mask = (int)$cx[1];
+
+            // Do not compare ipv4 to ipv6
+            if (($type === 4 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) ||
+                ($type === 6 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
+                continue;
+            }
+
+            $addr = inet_pton($addr);
+
+            $valid = true;
+            for ($i = 0; $i < $mask; $i++) {
+                $part = ord($addr[(int)($i / 8)]);
+                $orig = ord($ip[(int)($i / 8)]);
+
+                $bitmask = 1 << (7 - ($i % 8));
+
+                $part = $part & $bitmask;
+                $orig = $orig & $bitmask;
+
+                if ($part !== $orig) {
+                    $valid = false;
+                    break;
+                }
+            }
+
+            if ($valid === true) {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    /**
+     * Get the throttling delay (in milliseconds)
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @param float $maxAgeHours
+     * @return int
+     */
+    public function getAttempts(string $ip, string $action = '', float $maxAgeHours = 12): int {
+        if ($maxAgeHours > 48) {
+            $this->logger->error('Bruteforce has to use less than 48 hours');
+            $maxAgeHours = 48;
+        }
+
+        if ($ip === '') {
+            return 0;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        if ($this->isIPWhitelisted((string)$ipAddress)) {
+            return 0;
+        }
+
+        $cutoffTime = $this->getCutoffTimestamp($maxAgeHours);
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->select($qb->func()->count('*', 'attempts'))
+            ->from('bruteforce_attempts')
+            ->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
+            ->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())));
+
+        if ($action !== '') {
+            $qb->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)));
+        }
+
+        $result = $qb->execute();
+        $row = $result->fetch();
+        $result->closeCursor();
+
+        return (int) $row['attempts'];
+    }
+
+    /**
+     * Get the throttling delay (in milliseconds)
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @return int
+     */
+    public function getDelay(string $ip, string $action = ''): int {
+        $attempts = $this->getAttempts($ip, $action);
+        if ($attempts === 0) {
+            return 0;
+        }
+
+        $firstDelay = 0.1;
+        if ($attempts > self::MAX_ATTEMPTS) {
+            // Don't ever overflow. Just assume the maxDelay time:s
+            return self::MAX_DELAY_MS;
+        }
+
+        $delay = $firstDelay * 2 ** $attempts;
+        if ($delay > self::MAX_DELAY) {
+            return self::MAX_DELAY_MS;
+        }
+        return (int) \ceil($delay * 1000);
+    }
+
+    /**
+     * Reset the throttling delay for an IP address, action and metadata
+     *
+     * @param string $ip
+     * @param string $action
+     * @param array $metadata
+     */
+    public function resetDelay(string $ip, string $action, array $metadata): void {
+        $ipAddress = new IpAddress($ip);
+        if ($this->isIPWhitelisted((string)$ipAddress)) {
+            return;
+        }
+
+        $cutoffTime = $this->getCutoffTimestamp();
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete('bruteforce_attempts')
+            ->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
+            ->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())))
+            ->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)))
+            ->andWhere($qb->expr()->eq('metadata', $qb->createNamedParameter(json_encode($metadata))));
+
+        $qb->execute();
+    }
+
+    /**
+     * Reset the throttling delay for an IP address
+     *
+     * @param string $ip
+     */
+    public function resetDelayForIP($ip) {
+        $cutoffTime = $this->getCutoffTimestamp();
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->delete('bruteforce_attempts')
+            ->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
+            ->andWhere($qb->expr()->eq('ip', $qb->createNamedParameter($ip)));
+
+        $qb->execute();
+    }
+
+    /**
+     * Will sleep for the defined amount of time
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @return int the time spent sleeping
+     */
+    public function sleepDelay(string $ip, string $action = ''): int {
+        $delay = $this->getDelay($ip, $action);
+        usleep($delay * 1000);
+        return $delay;
+    }
+
+    /**
+     * Will sleep for the defined amount of time unless maximum was reached in the last 30 minutes
+     * In this case a "429 Too Many Request" exception is thrown
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @return int the time spent sleeping
+     * @throws MaxDelayReached when reached the maximum
+     */
+    public function sleepDelayOrThrowOnMax(string $ip, string $action = ''): int {
+        $delay = $this->getDelay($ip, $action);
+        if (($delay === self::MAX_DELAY_MS) && $this->getAttempts($ip, $action, 0.5) > self::MAX_ATTEMPTS) {
+            // If the ip made too many attempts within the last 30 mins we don't execute anymore
+            throw new MaxDelayReached('Reached maximum delay');
+        }
+        usleep($delay * 1000);
+        return $delay;
+    }
 }