|
| 1 | +// Copyright 2024 The Matrix.org Foundation C.I.C. |
| 2 | +// |
| 3 | +// Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | +// you may not use this file except in compliance with the License. |
| 5 | +// You may obtain a copy of the License at |
| 6 | +// |
| 7 | +// http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | +// |
| 9 | +// Unless required by applicable law or agreed to in writing, software |
| 10 | +// distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | +// See the License for the specific language governing permissions and |
| 13 | +// limitations under the License. |
| 14 | + |
| 15 | +use std::{num::NonZeroU32, time::Duration}; |
| 16 | + |
| 17 | +use governor::Quota; |
| 18 | +use schemars::JsonSchema; |
| 19 | +use serde::{de::Error as _, Deserialize, Serialize}; |
| 20 | + |
| 21 | +use crate::ConfigurationSection; |
| 22 | + |
| 23 | +/// Configuration related to sending emails |
| 24 | +#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)] |
| 25 | +pub struct RateLimitingConfig { |
| 26 | + /// Login-specific rate limits |
| 27 | + #[serde(default)] |
| 28 | + pub login: LoginRateLimitingConfig, |
| 29 | +} |
| 30 | + |
| 31 | +#[derive(Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)] |
| 32 | +pub struct LoginRateLimitingConfig { |
| 33 | + /// Controls how many login attempts are permitted |
| 34 | + /// based on source address. |
| 35 | + /// This can protect against brute force login attempts. |
| 36 | + /// |
| 37 | + /// Note: this limit also applies to password checks when a user attempts to |
| 38 | + /// change their own password. |
| 39 | + #[serde(default = "default_login_per_address")] |
| 40 | + pub per_address: RateLimiterConfiguration, |
| 41 | + /// Controls how many login attempts are permitted |
| 42 | + /// based on the account that is being attempted to be logged into. |
| 43 | + /// This can protect against a distributed brute force attack |
| 44 | + /// but should be set high enough to prevent someone's account being |
| 45 | + /// casually locked out. |
| 46 | + /// |
| 47 | + /// Note: this limit also applies to password checks when a user attempts to |
| 48 | + /// change their own password. |
| 49 | + #[serde(default = "default_login_per_account")] |
| 50 | + pub per_account: RateLimiterConfiguration, |
| 51 | +} |
| 52 | + |
| 53 | +#[derive(Copy, Clone, Debug, Serialize, Deserialize, JsonSchema, PartialEq)] |
| 54 | +pub struct RateLimiterConfiguration { |
| 55 | + /// A one-off burst of actions that the user can perform |
| 56 | + /// in one go without waiting. |
| 57 | + pub burst: NonZeroU32, |
| 58 | + /// How quickly the allowance replenishes, in number of actions per second. |
| 59 | + /// Can be fractional to replenish slower. |
| 60 | + pub per_second: f64, |
| 61 | +} |
| 62 | + |
| 63 | +impl ConfigurationSection for RateLimitingConfig { |
| 64 | + const PATH: Option<&'static str> = Some("rate_limiting"); |
| 65 | + |
| 66 | + fn validate(&self, figment: &figment::Figment) -> Result<(), figment::Error> { |
| 67 | + let metadata = figment.find_metadata(Self::PATH.unwrap()); |
| 68 | + |
| 69 | + let error_on_nested_field = |
| 70 | + |mut error: figment::error::Error, container: &'static str, field: &'static str| { |
| 71 | + error.metadata = metadata.cloned(); |
| 72 | + error.profile = Some(figment::Profile::Default); |
| 73 | + error.path = vec![ |
| 74 | + Self::PATH.unwrap().to_owned(), |
| 75 | + container.to_owned(), |
| 76 | + field.to_owned(), |
| 77 | + ]; |
| 78 | + error |
| 79 | + }; |
| 80 | + |
| 81 | + // Check one limiter's configuration for errors |
| 82 | + let error_on_limiter = |
| 83 | + |limiter: &RateLimiterConfiguration| -> Option<figment::error::Error> { |
| 84 | + let recip = limiter.per_second.recip(); |
| 85 | + // period must be at least 1 nanosecond according to the governor library |
| 86 | + if recip < 1.0e-9 || !recip.is_finite() { |
| 87 | + return Some(figment::error::Error::custom( |
| 88 | + "`per_second` must be a number that is more than zero and less than 1_000_000_000 (1e9)", |
| 89 | + )); |
| 90 | + } |
| 91 | + |
| 92 | + None |
| 93 | + }; |
| 94 | + |
| 95 | + if let Some(error) = error_on_limiter(&self.login.per_address) { |
| 96 | + return Err(error_on_nested_field(error, "login", "per_address")); |
| 97 | + } |
| 98 | + if let Some(error) = error_on_limiter(&self.login.per_account) { |
| 99 | + return Err(error_on_nested_field(error, "login", "per_account")); |
| 100 | + } |
| 101 | + |
| 102 | + Ok(()) |
| 103 | + } |
| 104 | +} |
| 105 | + |
| 106 | +impl RateLimitingConfig { |
| 107 | + pub(crate) fn is_default(config: &RateLimitingConfig) -> bool { |
| 108 | + config == &RateLimitingConfig::default() |
| 109 | + } |
| 110 | +} |
| 111 | + |
| 112 | +impl RateLimiterConfiguration { |
| 113 | + pub fn to_quota(self) -> Option<Quota> { |
| 114 | + let reciprocal = self.per_second.recip(); |
| 115 | + if !reciprocal.is_finite() { |
| 116 | + return None; |
| 117 | + } |
| 118 | + Some(Quota::with_period(Duration::from_secs_f64(reciprocal))?.allow_burst(self.burst)) |
| 119 | + } |
| 120 | +} |
| 121 | + |
| 122 | +fn default_login_per_address() -> RateLimiterConfiguration { |
| 123 | + RateLimiterConfiguration { |
| 124 | + burst: NonZeroU32::new(3).unwrap(), |
| 125 | + per_second: 3.0 / 60.0, |
| 126 | + } |
| 127 | +} |
| 128 | + |
| 129 | +fn default_login_per_account() -> RateLimiterConfiguration { |
| 130 | + RateLimiterConfiguration { |
| 131 | + burst: NonZeroU32::new(1800).unwrap(), |
| 132 | + per_second: 1800.0 / 3600.0, |
| 133 | + } |
| 134 | +} |
| 135 | + |
| 136 | +#[allow(clippy::derivable_impls)] // when we add some top-level ratelimiters this will not be derivable anymore |
| 137 | +impl Default for RateLimitingConfig { |
| 138 | + fn default() -> Self { |
| 139 | + RateLimitingConfig { |
| 140 | + login: LoginRateLimitingConfig::default(), |
| 141 | + } |
| 142 | + } |
| 143 | +} |
| 144 | + |
| 145 | +impl Default for LoginRateLimitingConfig { |
| 146 | + fn default() -> Self { |
| 147 | + LoginRateLimitingConfig { |
| 148 | + per_address: default_login_per_address(), |
| 149 | + per_account: default_login_per_account(), |
| 150 | + } |
| 151 | + } |
| 152 | +} |
0 commit comments