1
0

OCSAuthAPIController.php 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209
  1. <?php
  2. /**
  3. * @copyright Copyright (c) 2016, ownCloud, Inc.
  4. *
  5. * @author Bjoern Schiessle <bjoern@schiessle.org>
  6. * @author Björn Schießle <bjoern@schiessle.org>
  7. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  8. * @author Lukas Reschke <lukas@statuscode.ch>
  9. * @author Morris Jobke <hey@morrisjobke.de>
  10. * @author Robin Appelman <robin@icewind.nl>
  11. * @author Roeland Jago Douma <roeland@famdouma.nl>
  12. * @author Thomas Müller <thomas.mueller@tmit.eu>
  13. *
  14. * @license AGPL-3.0
  15. *
  16. * This code is free software: you can redistribute it and/or modify
  17. * it under the terms of the GNU Affero General Public License, version 3,
  18. * as published by the Free Software Foundation.
  19. *
  20. * This program is distributed in the hope that it will be useful,
  21. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  22. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  23. * GNU Affero General Public License for more details.
  24. *
  25. * You should have received a copy of the GNU Affero General Public License, version 3,
  26. * along with this program. If not, see <http://www.gnu.org/licenses/>
  27. *
  28. */
  29. namespace OCA\Federation\Controller;
  30. use OCA\Federation\DbHandler;
  31. use OCA\Federation\TrustedServers;
  32. use OCP\AppFramework\Http;
  33. use OCP\AppFramework\Http\Attribute\OpenAPI;
  34. use OCP\AppFramework\Http\DataResponse;
  35. use OCP\AppFramework\OCS\OCSForbiddenException;
  36. use OCP\AppFramework\OCSController;
  37. use OCP\AppFramework\Utility\ITimeFactory;
  38. use OCP\BackgroundJob\IJobList;
  39. use OCP\IRequest;
  40. use OCP\Security\Bruteforce\IThrottler;
  41. use OCP\Security\ISecureRandom;
  42. use Psr\Log\LoggerInterface;
  43. /**
  44. * Class OCSAuthAPI
  45. *
  46. * OCS API end-points to exchange shared secret between two connected Nextclouds
  47. *
  48. * @package OCA\Federation\Controller
  49. */
  50. #[OpenAPI(scope: OpenAPI::SCOPE_FEDERATION)]
  51. class OCSAuthAPIController extends OCSController {
  52. private ISecureRandom $secureRandom;
  53. private IJobList $jobList;
  54. private TrustedServers $trustedServers;
  55. private DbHandler $dbHandler;
  56. private LoggerInterface $logger;
  57. private ITimeFactory $timeFactory;
  58. private IThrottler $throttler;
  59. public function __construct(
  60. string $appName,
  61. IRequest $request,
  62. ISecureRandom $secureRandom,
  63. IJobList $jobList,
  64. TrustedServers $trustedServers,
  65. DbHandler $dbHandler,
  66. LoggerInterface $logger,
  67. ITimeFactory $timeFactory,
  68. IThrottler $throttler
  69. ) {
  70. parent::__construct($appName, $request);
  71. $this->secureRandom = $secureRandom;
  72. $this->jobList = $jobList;
  73. $this->trustedServers = $trustedServers;
  74. $this->dbHandler = $dbHandler;
  75. $this->logger = $logger;
  76. $this->timeFactory = $timeFactory;
  77. $this->throttler = $throttler;
  78. }
  79. /**
  80. * Request received to ask remote server for a shared secret, for legacy end-points
  81. *
  82. * @NoCSRFRequired
  83. * @PublicPage
  84. * @BruteForceProtection(action=federationSharedSecret)
  85. *
  86. * @param string $url URL of the server
  87. * @param string $token Token of the server
  88. * @return DataResponse<Http::STATUS_OK, array<empty>, array{}>
  89. * @throws OCSForbiddenException Requesting shared secret is not allowed
  90. *
  91. * 200: Shared secret requested successfully
  92. */
  93. public function requestSharedSecretLegacy(string $url, string $token): DataResponse {
  94. return $this->requestSharedSecret($url, $token);
  95. }
  96. /**
  97. * Create shared secret and return it, for legacy end-points
  98. *
  99. * @NoCSRFRequired
  100. * @PublicPage
  101. * @BruteForceProtection(action=federationSharedSecret)
  102. *
  103. * @param string $url URL of the server
  104. * @param string $token Token of the server
  105. * @return DataResponse<Http::STATUS_OK, array{sharedSecret: string}, array{}>
  106. * @throws OCSForbiddenException Getting shared secret is not allowed
  107. *
  108. * 200: Shared secret returned
  109. */
  110. public function getSharedSecretLegacy(string $url, string $token): DataResponse {
  111. return $this->getSharedSecret($url, $token);
  112. }
  113. /**
  114. * Request received to ask remote server for a shared secret
  115. *
  116. * @NoCSRFRequired
  117. * @PublicPage
  118. * @BruteForceProtection(action=federationSharedSecret)
  119. *
  120. * @param string $url URL of the server
  121. * @param string $token Token of the server
  122. * @return DataResponse<Http::STATUS_OK, array<empty>, array{}>
  123. * @throws OCSForbiddenException Requesting shared secret is not allowed
  124. *
  125. * 200: Shared secret requested successfully
  126. */
  127. public function requestSharedSecret(string $url, string $token): DataResponse {
  128. if ($this->trustedServers->isTrustedServer($url) === false) {
  129. $this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
  130. $this->logger->error('remote server not trusted (' . $url . ') while requesting shared secret', ['app' => 'federation']);
  131. throw new OCSForbiddenException();
  132. }
  133. // if both server initiated the exchange of the shared secret the greater
  134. // token wins
  135. $localToken = $this->dbHandler->getToken($url);
  136. if (strcmp($localToken, $token) > 0) {
  137. $this->logger->info(
  138. 'remote server (' . $url . ') presented lower token. We will initiate the exchange of the shared secret.',
  139. ['app' => 'federation']
  140. );
  141. throw new OCSForbiddenException();
  142. }
  143. $this->jobList->add(
  144. 'OCA\Federation\BackgroundJob\GetSharedSecret',
  145. [
  146. 'url' => $url,
  147. 'token' => $token,
  148. 'created' => $this->timeFactory->getTime()
  149. ]
  150. );
  151. return new DataResponse();
  152. }
  153. /**
  154. * Create shared secret and return it
  155. *
  156. * @NoCSRFRequired
  157. * @PublicPage
  158. * @BruteForceProtection(action=federationSharedSecret)
  159. *
  160. * @param string $url URL of the server
  161. * @param string $token Token of the server
  162. * @return DataResponse<Http::STATUS_OK, array{sharedSecret: string}, array{}>
  163. * @throws OCSForbiddenException Getting shared secret is not allowed
  164. *
  165. * 200: Shared secret returned
  166. */
  167. public function getSharedSecret(string $url, string $token): DataResponse {
  168. if ($this->trustedServers->isTrustedServer($url) === false) {
  169. $this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
  170. $this->logger->error('remote server not trusted (' . $url . ') while getting shared secret', ['app' => 'federation']);
  171. throw new OCSForbiddenException();
  172. }
  173. if ($this->isValidToken($url, $token) === false) {
  174. $this->throttler->registerAttempt('federationSharedSecret', $this->request->getRemoteAddress());
  175. $expectedToken = $this->dbHandler->getToken($url);
  176. $this->logger->error(
  177. 'remote server (' . $url . ') didn\'t send a valid token (got "' . $token . '" but expected "'. $expectedToken . '") while getting shared secret',
  178. ['app' => 'federation']
  179. );
  180. throw new OCSForbiddenException();
  181. }
  182. $sharedSecret = $this->secureRandom->generate(32);
  183. $this->trustedServers->addSharedSecret($url, $sharedSecret);
  184. return new DataResponse([
  185. 'sharedSecret' => $sharedSecret
  186. ]);
  187. }
  188. protected function isValidToken(string $url, string $token): bool {
  189. $storedToken = $this->dbHandler->getToken($url);
  190. return hash_equals($storedToken, $token);
  191. }
  192. }