nextcloud / server

lib/private/Security/RateLimiting/Backend/MemoryCache.php

Indentation +57 added lines, -57 removed lines

@@ -32,69 +32,69 @@
  * @package OC\Security\RateLimiting\Backend
  */
 class MemoryCache implements IBackend {
-	/** @var ICache */
-	private $cache;
-	/** @var ITimeFactory */
-	private $timeFactory;
+    /** @var ICache */
+    private $cache;
+    /** @var ITimeFactory */
+    private $timeFactory;
 
-	/**
-	 * @param ICacheFactory $cacheFactory
-	 * @param ITimeFactory $timeFactory
-	 */
-	public function __construct(ICacheFactory $cacheFactory,
-								ITimeFactory $timeFactory) {
-		$this->cache = $cacheFactory->create(__CLASS__);
-		$this->timeFactory = $timeFactory;
-	}
+    /**
+     * @param ICacheFactory $cacheFactory
+     * @param ITimeFactory $timeFactory
+     */
+    public function __construct(ICacheFactory $cacheFactory,
+                                ITimeFactory $timeFactory) {
+        $this->cache = $cacheFactory->create(__CLASS__);
+        $this->timeFactory = $timeFactory;
+    }
 
-	/**
-	 * @param string $methodIdentifier
-	 * @param string $userIdentifier
-	 * @return string
-	 */
-	private function hash($methodIdentifier, $userIdentifier) {
-		return hash('sha512', $methodIdentifier . $userIdentifier);
-	}
+    /**
+     * @param string $methodIdentifier
+     * @param string $userIdentifier
+     * @return string
+     */
+    private function hash($methodIdentifier, $userIdentifier) {
+        return hash('sha512', $methodIdentifier . $userIdentifier);
+    }
 
-	/**
-	 * @param string $identifier
-	 * @return array
-	 */
-	private function getExistingAttempts($identifier) {
-		$cachedAttempts = json_decode($this->cache->get($identifier), true);
-		if(is_array($cachedAttempts)) {
-			return $cachedAttempts;
-		}
+    /**
+     * @param string $identifier
+     * @return array
+     */
+    private function getExistingAttempts($identifier) {
+        $cachedAttempts = json_decode($this->cache->get($identifier), true);
+        if(is_array($cachedAttempts)) {
+            return $cachedAttempts;
+        }
 
-		return [];
-	}
+        return [];
+    }
 
-	/**
-	 * {@inheritDoc}
-	 */
-	public function getAttempts($methodIdentifier, $userIdentifier, $seconds) {
-		$identifier = $this->hash($methodIdentifier, $userIdentifier);
-		$existingAttempts = $this->getExistingAttempts($identifier);
+    /**
+     * {@inheritDoc}
+     */
+    public function getAttempts($methodIdentifier, $userIdentifier, $seconds) {
+        $identifier = $this->hash($methodIdentifier, $userIdentifier);
+        $existingAttempts = $this->getExistingAttempts($identifier);
 
-		$count = 0;
-		$currentTime = $this->timeFactory->getTime();
-		/** @var array $existingAttempts */
-		foreach ($existingAttempts as $attempt) {
-			if(($attempt + $seconds) > $currentTime) {
-				$count++;
-			}
-		}
+        $count = 0;
+        $currentTime = $this->timeFactory->getTime();
+        /** @var array $existingAttempts */
+        foreach ($existingAttempts as $attempt) {
+            if(($attempt + $seconds) > $currentTime) {
+                $count++;
+            }
+        }
 
-		return $count;
-	}
+        return $count;
+    }
 
-	/**
-	 * {@inheritDoc}
-	 */
-	public function registerAttempt($methodIdentifier, $userIdentifier, $timestamp) {
-		$identifier = $this->hash($methodIdentifier, $userIdentifier);
-		$existingAttempts = $this->getExistingAttempts($identifier);
-		$existingAttempts[] = (string)$timestamp;
-		$this->cache->set($identifier, json_encode($existingAttempts));
-	}
+    /**
+     * {@inheritDoc}
+     */
+    public function registerAttempt($methodIdentifier, $userIdentifier, $timestamp) {
+        $identifier = $this->hash($methodIdentifier, $userIdentifier);
+        $existingAttempts = $this->getExistingAttempts($identifier);
+        $existingAttempts[] = (string)$timestamp;
+        $this->cache->set($identifier, json_encode($existingAttempts));
+    }
 }

Spacing +4 added lines, -4 removed lines

@@ -53,7 +53,7 @@ 
 	 * @return string
 	 */
 	private function hash($methodIdentifier, $userIdentifier) {
-		return hash('sha512', $methodIdentifier . $userIdentifier);
+		return hash('sha512', $methodIdentifier.$userIdentifier);
 	}
 
 	/**
@@ -62,7 +62,7 @@ 
 	 */
 	private function getExistingAttempts($identifier) {
 		$cachedAttempts = json_decode($this->cache->get($identifier), true);
-		if(is_array($cachedAttempts)) {
+		if (is_array($cachedAttempts)) {
 			return $cachedAttempts;
 		}
 
@@ -80,7 +80,7 @@ 
 		$currentTime = $this->timeFactory->getTime();
 		/** @var array $existingAttempts */
 		foreach ($existingAttempts as $attempt) {
-			if(($attempt + $seconds) > $currentTime) {
+			if (($attempt + $seconds) > $currentTime) {
 				$count++;
 			}
 		}
@@ -94,7 +94,7 @@ 
 	public function registerAttempt($methodIdentifier, $userIdentifier, $timestamp) {
 		$identifier = $this->hash($methodIdentifier, $userIdentifier);
 		$existingAttempts = $this->getExistingAttempts($identifier);
-		$existingAttempts[] = (string)$timestamp;
+		$existingAttempts[] = (string) $timestamp;
 		$this->cache->set($identifier, json_encode($existingAttempts));
 	}
 }

lib/private/Security/RateLimiting/Limiter.php

Indentation +67 added lines, -67 removed lines

@@ -30,77 +30,77 @@
 use OCP\IUserSession;
 
 class Limiter {
-	/** @var IBackend */
-	private $backend;
-	/** @var ITimeFactory */
-	private $timeFactory;
+    /** @var IBackend */
+    private $backend;
+    /** @var ITimeFactory */
+    private $timeFactory;
 
-	/**
-	 * @param IUserSession $userSession
-	 * @param IRequest $request
-	 * @param ITimeFactory $timeFactory
-	 * @param IBackend $backend
-	 */
-	public function __construct(IUserSession $userSession,
-								IRequest $request,
-								ITimeFactory $timeFactory,
-								IBackend $backend) {
-		$this->backend = $backend;
-		$this->timeFactory = $timeFactory;
-	}
+    /**
+     * @param IUserSession $userSession
+     * @param IRequest $request
+     * @param ITimeFactory $timeFactory
+     * @param IBackend $backend
+     */
+    public function __construct(IUserSession $userSession,
+                                IRequest $request,
+                                ITimeFactory $timeFactory,
+                                IBackend $backend) {
+        $this->backend = $backend;
+        $this->timeFactory = $timeFactory;
+    }
 
-	/**
-	 * @param string $methodIdentifier
-	 * @param string $userIdentifier
-	 * @param int $period
-	 * @param int $limit
-	 * @throws RateLimitExceededException
-	 */
-	private function register($methodIdentifier,
-							  $userIdentifier,
-							  $period,
-							  $limit) {
-		$existingAttempts = $this->backend->getAttempts($methodIdentifier, $userIdentifier, (int)$period);
-		if ($existingAttempts >= (int)$limit) {
-			throw new RateLimitExceededException();
-		}
+    /**
+     * @param string $methodIdentifier
+     * @param string $userIdentifier
+     * @param int $period
+     * @param int $limit
+     * @throws RateLimitExceededException
+     */
+    private function register($methodIdentifier,
+                                $userIdentifier,
+                                $period,
+                                $limit) {
+        $existingAttempts = $this->backend->getAttempts($methodIdentifier, $userIdentifier, (int)$period);
+        if ($existingAttempts >= (int)$limit) {
+            throw new RateLimitExceededException();
+        }
 
-		$this->backend->registerAttempt($methodIdentifier, $userIdentifier, $this->timeFactory->getTime());
-	}
+        $this->backend->registerAttempt($methodIdentifier, $userIdentifier, $this->timeFactory->getTime());
+    }
 
-	/**
-	 * Registers attempt for an anonymous request
-	 *
-	 * @param string $identifier
-	 * @param int $anonLimit
-	 * @param int $anonPeriod
-	 * @param string $ip
-	 * @throws RateLimitExceededException
-	 */
-	public function registerAnonRequest($identifier,
-										$anonLimit,
-										$anonPeriod,
-										$ip) {
-		$ipSubnet = (new IpAddress($ip))->getSubnet();
+    /**
+     * Registers attempt for an anonymous request
+     *
+     * @param string $identifier
+     * @param int $anonLimit
+     * @param int $anonPeriod
+     * @param string $ip
+     * @throws RateLimitExceededException
+     */
+    public function registerAnonRequest($identifier,
+                                        $anonLimit,
+                                        $anonPeriod,
+                                        $ip) {
+        $ipSubnet = (new IpAddress($ip))->getSubnet();
 
-		$anonHashIdentifier = hash('sha512', 'anon::' . $identifier . $ipSubnet);
-		$this->register($identifier, $anonHashIdentifier, $anonPeriod, $anonLimit);
-	}
+        $anonHashIdentifier = hash('sha512', 'anon::' . $identifier . $ipSubnet);
+        $this->register($identifier, $anonHashIdentifier, $anonPeriod, $anonLimit);
+    }
 
-	/**
-	 * Registers attempt for an authenticated request
-	 *
-	 * @param string $identifier
-	 * @param int $userLimit
-	 * @param int $userPeriod
-	 * @param IUser $user
-	 * @throws RateLimitExceededException
-	 */
-	public function registerUserRequest($identifier,
-										$userLimit,
-										$userPeriod,
-										IUser $user) {
-		$userHashIdentifier = hash('sha512', 'user::' . $identifier . $user->getUID());
-		$this->register($identifier, $userHashIdentifier, $userPeriod, $userLimit);
-	}
+    /**
+     * Registers attempt for an authenticated request
+     *
+     * @param string $identifier
+     * @param int $userLimit
+     * @param int $userPeriod
+     * @param IUser $user
+     * @throws RateLimitExceededException
+     */
+    public function registerUserRequest($identifier,
+                                        $userLimit,
+                                        $userPeriod,
+                                        IUser $user) {
+        $userHashIdentifier = hash('sha512', 'user::' . $identifier . $user->getUID());
+        $this->register($identifier, $userHashIdentifier, $userPeriod, $userLimit);
+    }
 }

Spacing +4 added lines, -4 removed lines

@@ -60,8 +60,8 @@ 
 							  $userIdentifier,
 							  $period,
 							  $limit) {
-		$existingAttempts = $this->backend->getAttempts($methodIdentifier, $userIdentifier, (int)$period);
-		if ($existingAttempts >= (int)$limit) {
+		$existingAttempts = $this->backend->getAttempts($methodIdentifier, $userIdentifier, (int) $period);
+		if ($existingAttempts >= (int) $limit) {
 			throw new RateLimitExceededException();
 		}
 
@@ -83,7 +83,7 @@ 
 										$ip) {
 		$ipSubnet = (new IpAddress($ip))->getSubnet();
 
-		$anonHashIdentifier = hash('sha512', 'anon::' . $identifier . $ipSubnet);
+		$anonHashIdentifier = hash('sha512', 'anon::'.$identifier.$ipSubnet);
 		$this->register($identifier, $anonHashIdentifier, $anonPeriod, $anonLimit);
 	}
 
@@ -100,7 +100,7 @@ 
 										$userLimit,
 										$userPeriod,
 										IUser $user) {
-		$userHashIdentifier = hash('sha512', 'user::' . $identifier . $user->getUID());
+		$userHashIdentifier = hash('sha512', 'user::'.$identifier.$user->getUID());
 		$this->register($identifier, $userHashIdentifier, $userPeriod, $userLimit);
 	}
 }

lib/private/Security/RateLimiting/Exception/RateLimitExceededException.php

Indentation +3 added lines, -3 removed lines

@@ -25,7 +25,7 @@
 use OCP\AppFramework\Http;
 
 class RateLimitExceededException extends SecurityException {
-	public function __construct() {
-		parent::__construct('Rate limit exceeded', Http::STATUS_TOO_MANY_REQUESTS);
-	}
+    public function __construct() {
+        parent::__construct('Rate limit exceeded', Http::STATUS_TOO_MANY_REQUESTS);
+    }
 }

lib/private/Security/Normalizer/IpAddress.php

Indentation +70 added lines, -70 removed lines

@@ -28,79 +28,79 @@
  * @package OC\Security\Normalizer
  */
 class IpAddress {
-	/** @var string */
-	private $ip;
+    /** @var string */
+    private $ip;
 
-	/**
-	 * @param string $ip IP to normalized
-	 */
-	public function __construct($ip) {
-		$this->ip = $ip;
-	}
+    /**
+     * @param string $ip IP to normalized
+     */
+    public function __construct($ip) {
+        $this->ip = $ip;
+    }
 
-	/**
-	 * Return the given subnet for an IPv4 address and mask bits
-	 *
-	 * @param string $ip
-	 * @param int $maskBits
-	 * @return string
-	 */
-	private function getIPv4Subnet($ip,
-								   $maskBits = 32) {
-		$binary = \inet_pton($ip);
-		for ($i = 32; $i > $maskBits; $i -= 8) {
-			$j = \intdiv($i, 8) - 1;
-			$k = (int) \min(8, $i - $maskBits);
-			$mask = (0xff - ((pow(2, $k)) - 1));
-			$int = \unpack('C', $binary[$j]);
-			$binary[$j] = \pack('C', $int[1] & $mask);
-		}
-		return \inet_ntop($binary).'/'.$maskBits;
-	}
+    /**
+     * Return the given subnet for an IPv4 address and mask bits
+     *
+     * @param string $ip
+     * @param int $maskBits
+     * @return string
+     */
+    private function getIPv4Subnet($ip,
+                                    $maskBits = 32) {
+        $binary = \inet_pton($ip);
+        for ($i = 32; $i > $maskBits; $i -= 8) {
+            $j = \intdiv($i, 8) - 1;
+            $k = (int) \min(8, $i - $maskBits);
+            $mask = (0xff - ((pow(2, $k)) - 1));
+            $int = \unpack('C', $binary[$j]);
+            $binary[$j] = \pack('C', $int[1] & $mask);
+        }
+        return \inet_ntop($binary).'/'.$maskBits;
+    }
 
-	/**
-	 * Return the given subnet for an IPv6 address and mask bits
-	 *
-	 * @param string $ip
-	 * @param int $maskBits
-	 * @return string
-	 */
-	private function getIPv6Subnet($ip, $maskBits = 48) {
-		$binary = \inet_pton($ip);
-		for ($i = 128; $i > $maskBits; $i -= 8) {
-			$j = \intdiv($i, 8) - 1;
-			$k = (int) \min(8, $i - $maskBits);
-			$mask = (0xff - ((pow(2, $k)) - 1));
-			$int = \unpack('C', $binary[$j]);
-			$binary[$j] = \pack('C', $int[1] & $mask);
-		}
-		return \inet_ntop($binary).'/'.$maskBits;
-	}
+    /**
+     * Return the given subnet for an IPv6 address and mask bits
+     *
+     * @param string $ip
+     * @param int $maskBits
+     * @return string
+     */
+    private function getIPv6Subnet($ip, $maskBits = 48) {
+        $binary = \inet_pton($ip);
+        for ($i = 128; $i > $maskBits; $i -= 8) {
+            $j = \intdiv($i, 8) - 1;
+            $k = (int) \min(8, $i - $maskBits);
+            $mask = (0xff - ((pow(2, $k)) - 1));
+            $int = \unpack('C', $binary[$j]);
+            $binary[$j] = \pack('C', $int[1] & $mask);
+        }
+        return \inet_ntop($binary).'/'.$maskBits;
+    }
 
-	/**
-	 * Gets either the /32 (IPv4) or the /128 (IPv6) subnet of an IP address
-	 *
-	 * @return string
-	 */
-	public function getSubnet() {
-		if (\preg_match('/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/', $this->ip)) {
-			return $this->getIPv4Subnet(
-				$this->ip,
-				32
-			);
-		}
-		return $this->getIPv6Subnet(
-			$this->ip,
-			128
-		);
-	}
+    /**
+     * Gets either the /32 (IPv4) or the /128 (IPv6) subnet of an IP address
+     *
+     * @return string
+     */
+    public function getSubnet() {
+        if (\preg_match('/^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/', $this->ip)) {
+            return $this->getIPv4Subnet(
+                $this->ip,
+                32
+            );
+        }
+        return $this->getIPv6Subnet(
+            $this->ip,
+            128
+        );
+    }
 
-	/**
-	 * Returns the specified IP address
-	 *
-	 * @return string
-	 */
-	public function __toString() {
-		return $this->ip;
-	}
+    /**
+     * Returns the specified IP address
+     *
+     * @return string
+     */
+    public function __toString() {
+        return $this->ip;
+    }
 }

lib/private/Security/Bruteforce/Throttler.php

Indentation +203 added lines, -203 removed lines

@@ -43,207 +43,207 @@
  * @package OC\Security\Bruteforce
  */
 class Throttler {
-	const LOGIN_ACTION = 'login';
-
-	/** @var IDBConnection */
-	private $db;
-	/** @var ITimeFactory */
-	private $timeFactory;
-	/** @var ILogger */
-	private $logger;
-	/** @var IConfig */
-	private $config;
-
-	/**
-	 * @param IDBConnection $db
-	 * @param ITimeFactory $timeFactory
-	 * @param ILogger $logger
-	 * @param IConfig $config
-	 */
-	public function __construct(IDBConnection $db,
-								ITimeFactory $timeFactory,
-								ILogger $logger,
-								IConfig $config) {
-		$this->db = $db;
-		$this->timeFactory = $timeFactory;
-		$this->logger = $logger;
-		$this->config = $config;
-	}
-
-	/**
-	 * Convert a number of seconds into the appropriate DateInterval
-	 *
-	 * @param int $expire
-	 * @return \DateInterval
-	 */
-	private function getCutoff($expire) {
-		$d1 = new \DateTime();
-		$d2 = clone $d1;
-		$d2->sub(new \DateInterval('PT' . $expire . 'S'));
-		return $d2->diff($d1);
-	}
-
-	/**
-	 * Register a failed attempt to bruteforce a security control
-	 *
-	 * @param string $action
-	 * @param string $ip
-	 * @param array $metadata Optional metadata logged to the database
-	 */
-	public function registerAttempt($action,
-									$ip,
-									array $metadata = []) {
-		// No need to log if the bruteforce protection is disabled
-		if($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
-			return;
-		}
-
-		$ipAddress = new IpAddress($ip);
-		$values = [
-			'action' => $action,
-			'occurred' => $this->timeFactory->getTime(),
-			'ip' => (string)$ipAddress,
-			'subnet' => $ipAddress->getSubnet(),
-			'metadata' => json_encode($metadata),
-		];
-
-		$this->logger->notice(
-			sprintf(
-				'Bruteforce attempt from "%s" detected for action "%s".',
-				$ip,
-				$action
-			),
-			[
-				'app' => 'core',
-			]
-		);
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->insert('bruteforce_attempts');
-		foreach($values as $column => $value) {
-			$qb->setValue($column, $qb->createNamedParameter($value));
-		}
-		$qb->execute();
-	}
-
-	/**
-	 * Check if the IP is whitelisted
-	 *
-	 * @param string $ip
-	 * @return bool
-	 */
-	private function isIPWhitelisted($ip) {
-		$keys = $this->config->getAppKeys('bruteForce');
-		$keys = array_filter($keys, function($key) {
-			$regex = '/^whitelist_/S';
-			return preg_match($regex, $key) === 1;
-		});
-
-		if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
-			$type = 4;
-		} else if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
-			$type = 6;
-		} else {
-			return false;
-		}
-
-		$ip = inet_pton($ip);
-
-		foreach ($keys as $key) {
-			$cidr = $this->config->getAppValue('bruteForce', $key, null);
-
-			$cx = explode('/', $cidr);
-			$addr = $cx[0];
-			$mask = (int)$cx[1];
-
-			// Do not compare ipv4 to ipv6
-			if (($type === 4 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) ||
-				($type === 6 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
-				continue;
-			}
-
-			$addr = inet_pton($addr);
-
-			$valid = true;
-			for($i = 0; $i < $mask; $i++) {
-				$part = ord($addr[(int)($i/8)]);
-				$orig = ord($ip[(int)($i/8)]);
-
-				$part = $part & (15 << (1 - ($i % 2)));
-				$orig = $orig & (15 << (1 - ($i % 2)));
-
-				if ($part !== $orig) {
-					$valid = false;
-					break;
-				}
-			}
-
-			if ($valid === true) {
-				return true;
-			}
-		}
-
-		return false;
-
-	}
-
-	/**
-	 * Get the throttling delay (in milliseconds)
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @return int
-	 */
-	public function getDelay($ip, $action = '') {
-		$ipAddress = new IpAddress($ip);
-		if ($this->isIPWhitelisted((string)$ipAddress)) {
-			return 0;
-		}
-
-		$cutoffTime = (new \DateTime())
-			->sub($this->getCutoff(43200))
-			->getTimestamp();
-
-		$qb = $this->db->getQueryBuilder();
-		$qb->select('*')
-			->from('bruteforce_attempts')
-			->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
-			->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())));
-
-		if ($action !== '') {
-			$qb->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)));
-		}
-
-		$attempts = count($qb->execute()->fetchAll());
-
-		if ($attempts === 0) {
-			return 0;
-		}
-
-		$maxDelay = 30;
-		$firstDelay = 0.1;
-		if ($attempts > (8 * PHP_INT_SIZE - 1))  {
-			// Don't ever overflow. Just assume the maxDelay time:s
-			$firstDelay = $maxDelay;
-		} else {
-			$firstDelay *= pow(2, $attempts);
-			if ($firstDelay > $maxDelay) {
-				$firstDelay = $maxDelay;
-			}
-		}
-		return (int) \ceil($firstDelay * 1000);
-	}
-
-	/**
-	 * Will sleep for the defined amount of time
-	 *
-	 * @param string $ip
-	 * @param string $action optionally filter by action
-	 * @return int the time spent sleeping
-	 */
-	public function sleepDelay($ip, $action = '') {
-		$delay = $this->getDelay($ip, $action);
-		usleep($delay * 1000);
-		return $delay;
-	}
+    const LOGIN_ACTION = 'login';
+
+    /** @var IDBConnection */
+    private $db;
+    /** @var ITimeFactory */
+    private $timeFactory;
+    /** @var ILogger */
+    private $logger;
+    /** @var IConfig */
+    private $config;
+
+    /**
+     * @param IDBConnection $db
+     * @param ITimeFactory $timeFactory
+     * @param ILogger $logger
+     * @param IConfig $config
+     */
+    public function __construct(IDBConnection $db,
+                                ITimeFactory $timeFactory,
+                                ILogger $logger,
+                                IConfig $config) {
+        $this->db = $db;
+        $this->timeFactory = $timeFactory;
+        $this->logger = $logger;
+        $this->config = $config;
+    }
+
+    /**
+     * Convert a number of seconds into the appropriate DateInterval
+     *
+     * @param int $expire
+     * @return \DateInterval
+     */
+    private function getCutoff($expire) {
+        $d1 = new \DateTime();
+        $d2 = clone $d1;
+        $d2->sub(new \DateInterval('PT' . $expire . 'S'));
+        return $d2->diff($d1);
+    }
+
+    /**
+     * Register a failed attempt to bruteforce a security control
+     *
+     * @param string $action
+     * @param string $ip
+     * @param array $metadata Optional metadata logged to the database
+     */
+    public function registerAttempt($action,
+                                    $ip,
+                                    array $metadata = []) {
+        // No need to log if the bruteforce protection is disabled
+        if($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
+            return;
+        }
+
+        $ipAddress = new IpAddress($ip);
+        $values = [
+            'action' => $action,
+            'occurred' => $this->timeFactory->getTime(),
+            'ip' => (string)$ipAddress,
+            'subnet' => $ipAddress->getSubnet(),
+            'metadata' => json_encode($metadata),
+        ];
+
+        $this->logger->notice(
+            sprintf(
+                'Bruteforce attempt from "%s" detected for action "%s".',
+                $ip,
+                $action
+            ),
+            [
+                'app' => 'core',
+            ]
+        );
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->insert('bruteforce_attempts');
+        foreach($values as $column => $value) {
+            $qb->setValue($column, $qb->createNamedParameter($value));
+        }
+        $qb->execute();
+    }
+
+    /**
+     * Check if the IP is whitelisted
+     *
+     * @param string $ip
+     * @return bool
+     */
+    private function isIPWhitelisted($ip) {
+        $keys = $this->config->getAppKeys('bruteForce');
+        $keys = array_filter($keys, function($key) {
+            $regex = '/^whitelist_/S';
+            return preg_match($regex, $key) === 1;
+        });
+
+        if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) {
+            $type = 4;
+        } else if (filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6)) {
+            $type = 6;
+        } else {
+            return false;
+        }
+
+        $ip = inet_pton($ip);
+
+        foreach ($keys as $key) {
+            $cidr = $this->config->getAppValue('bruteForce', $key, null);
+
+            $cx = explode('/', $cidr);
+            $addr = $cx[0];
+            $mask = (int)$cx[1];
+
+            // Do not compare ipv4 to ipv6
+            if (($type === 4 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) ||
+                ($type === 6 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6))) {
+                continue;
+            }
+
+            $addr = inet_pton($addr);
+
+            $valid = true;
+            for($i = 0; $i < $mask; $i++) {
+                $part = ord($addr[(int)($i/8)]);
+                $orig = ord($ip[(int)($i/8)]);
+
+                $part = $part & (15 << (1 - ($i % 2)));
+                $orig = $orig & (15 << (1 - ($i % 2)));
+
+                if ($part !== $orig) {
+                    $valid = false;
+                    break;
+                }
+            }
+
+            if ($valid === true) {
+                return true;
+            }
+        }
+
+        return false;
+
+    }
+
+    /**
+     * Get the throttling delay (in milliseconds)
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @return int
+     */
+    public function getDelay($ip, $action = '') {
+        $ipAddress = new IpAddress($ip);
+        if ($this->isIPWhitelisted((string)$ipAddress)) {
+            return 0;
+        }
+
+        $cutoffTime = (new \DateTime())
+            ->sub($this->getCutoff(43200))
+            ->getTimestamp();
+
+        $qb = $this->db->getQueryBuilder();
+        $qb->select('*')
+            ->from('bruteforce_attempts')
+            ->where($qb->expr()->gt('occurred', $qb->createNamedParameter($cutoffTime)))
+            ->andWhere($qb->expr()->eq('subnet', $qb->createNamedParameter($ipAddress->getSubnet())));
+
+        if ($action !== '') {
+            $qb->andWhere($qb->expr()->eq('action', $qb->createNamedParameter($action)));
+        }
+
+        $attempts = count($qb->execute()->fetchAll());
+
+        if ($attempts === 0) {
+            return 0;
+        }
+
+        $maxDelay = 30;
+        $firstDelay = 0.1;
+        if ($attempts > (8 * PHP_INT_SIZE - 1))  {
+            // Don't ever overflow. Just assume the maxDelay time:s
+            $firstDelay = $maxDelay;
+        } else {
+            $firstDelay *= pow(2, $attempts);
+            if ($firstDelay > $maxDelay) {
+                $firstDelay = $maxDelay;
+            }
+        }
+        return (int) \ceil($firstDelay * 1000);
+    }
+
+    /**
+     * Will sleep for the defined amount of time
+     *
+     * @param string $ip
+     * @param string $action optionally filter by action
+     * @return int the time spent sleeping
+     */
+    public function sleepDelay($ip, $action = '') {
+        $delay = $this->getDelay($ip, $action);
+        usleep($delay * 1000);
+        return $delay;
+    }
 }

Spacing +10 added lines, -10 removed lines

@@ -79,7 +79,7 @@ 
 	private function getCutoff($expire) {
 		$d1 = new \DateTime();
 		$d2 = clone $d1;
-		$d2->sub(new \DateInterval('PT' . $expire . 'S'));
+		$d2->sub(new \DateInterval('PT'.$expire.'S'));
 		return $d2->diff($d1);
 	}
 
@@ -94,7 +94,7 @@ 
 									$ip,
 									array $metadata = []) {
 		// No need to log if the bruteforce protection is disabled
-		if($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
+		if ($this->config->getSystemValue('auth.bruteforce.protection.enabled', true) === false) {
 			return;
 		}
 
@@ -102,7 +102,7 @@ 
 		$values = [
 			'action' => $action,
 			'occurred' => $this->timeFactory->getTime(),
-			'ip' => (string)$ipAddress,
+			'ip' => (string) $ipAddress,
 			'subnet' => $ipAddress->getSubnet(),
 			'metadata' => json_encode($metadata),
 		];
@@ -120,7 +120,7 @@ 
 
 		$qb = $this->db->getQueryBuilder();
 		$qb->insert('bruteforce_attempts');
-		foreach($values as $column => $value) {
+		foreach ($values as $column => $value) {
 			$qb->setValue($column, $qb->createNamedParameter($value));
 		}
 		$qb->execute();
@@ -154,7 +154,7 @@ 
 
 			$cx = explode('/', $cidr);
 			$addr = $cx[0];
-			$mask = (int)$cx[1];
+			$mask = (int) $cx[1];
 
 			// Do not compare ipv4 to ipv6
 			if (($type === 4 && !filter_var($addr, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4)) ||
@@ -165,9 +165,9 @@ 
 			$addr = inet_pton($addr);
 
 			$valid = true;
-			for($i = 0; $i < $mask; $i++) {
-				$part = ord($addr[(int)($i/8)]);
-				$orig = ord($ip[(int)($i/8)]);
+			for ($i = 0; $i < $mask; $i++) {
+				$part = ord($addr[(int) ($i / 8)]);
+				$orig = ord($ip[(int) ($i / 8)]);
 
 				$part = $part & (15 << (1 - ($i % 2)));
 				$orig = $orig & (15 << (1 - ($i % 2)));
@@ -196,7 +196,7 @@ 
 	 */
 	public function getDelay($ip, $action = '') {
 		$ipAddress = new IpAddress($ip);
-		if ($this->isIPWhitelisted((string)$ipAddress)) {
+		if ($this->isIPWhitelisted((string) $ipAddress)) {
 			return 0;
 		}
 
@@ -222,7 +222,7 @@ 
 
 		$maxDelay = 30;
 		$firstDelay = 0.1;
-		if ($attempts > (8 * PHP_INT_SIZE - 1))  {
+		if ($attempts > (8 * PHP_INT_SIZE - 1)) {
 			// Don't ever overflow. Just assume the maxDelay time:s
 			$firstDelay = $maxDelay;
 		} else {