mirror of
https://github.com/Cockatrice/Cockatrice.git
synced 2026-11-05 01:23:24 -08:00
Some checks are pending
CodeQL / Analyze (cpp) (push) Waiting to run
CodeQL / Analyze (actions) (push) Waiting to run
Build Desktop / Configure (push) Waiting to run
Build Desktop / Debian 13 (push) Blocked by required conditions
Build Desktop / Debian 12 (push) Blocked by required conditions
Build Desktop / Fedora 44 (push) Blocked by required conditions
Build Desktop / Fedora 43 (push) Blocked by required conditions
Build Desktop / Servatrice_Debian 12 (push) Blocked by required conditions
Build Desktop / Ubuntu 24.04 (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 (push) Blocked by required conditions
Build Desktop / Arch (push) Blocked by required conditions
Build Desktop / Ubuntu 26.04 cover (push) Blocked by required conditions
Build Desktop / macOS 13 Intel (push) Blocked by required conditions
Build Desktop / macOS 14 (push) Blocked by required conditions
Build Desktop / macOS 15 (push) Blocked by required conditions
Build Desktop / macOS 26 Debug (push) Blocked by required conditions
Build Desktop / Windows 10 (push) Blocked by required conditions
Build Desktop / Prune caches (push) Waiting to run
Build Docker / Servatrice (arm) (push) Waiting to run
Build Docker / Servatrice (x86) (push) Waiting to run
Build Docker / Publish multi-platform Servatrice image (push) Blocked by required conditions
* [Security] Add per-address rate limiting for auth endpoints Introduce a thread-safe RateLimiter that tracks attempts per key (IP address) within a sliding time window, and wire it into the authentication endpoints: - Login: failed login attempts from an address are counted; once the configured maximum is exceeded within the window, further logins from that address are rejected with RespTooManyRequests. A successful login clears the failed attempts for that address. - Registration: implement the previously stubbed tooManyRegistrationAttempts, limiting how many accounts can be created per address per window. - Forgot-password: throttle both the email-request and the email-challenge paths per address. New [security] settings with defaults: max_login_attempts_per_ip=5 / login_attempt_window_seconds=900 max_registrations_per_ip=2 / registration_window_seconds=3600 max_forgot_password_requests_per_ip=3 / forgot_password_window_seconds=3600 Adds unit tests for the RateLimiter (window limit, over-limit blocking, clearing, per-key independence). Took 3 minutes * [Server] Fix rate limiter: disable semantics, draining window, bounded keys, pre-work login gate - recordAttempt()/isBlocked() return false when maxAttempts <= 0 or windowSeconds <= 0, so the documented 'set to 0 to disable' actually disables instead of blocking every address permanently - Keys at their limit are rejected without recording, so repeated attempts at the attacker's pace cannot keep sliding the window and holding the lockout open; a block now clears once the recorded attempts age out of windowSeconds - Attempts map is bounded: an opportunistic prune (every 60s) erases keys whose attempts have fully aged out - Login is throttled before the work: isLoginRateLimited() (a new virtual on Server, backed by isBlocked()) gates loginUser(), so a locked-out address no longer burns a database round trip and password verification per attempt - recordAttemptAt()/isBlockedAt() time seams make the sliding-window behaviour deterministically testable; tests rewritten for the real semantics (no reliance on the maxAttempts=0 bug, no sleeps) * [Server] Inform client of login/registration rate limit timeout - Add retryAfterSeconds/retryAfterSecondsAt to RateLimiter to compute seconds until oldest attempt exits the sliding window - Expose loginRateLimitRemainingSeconds via Server/Servatrice - Include denied_end_time (absolute epoch) in RespTooManyRequests for login pre-auth and when transitioning to lockout after failed attempt - Include denied_end_time in registration rate limit response - Client: show retry time for login RespTooManyRequests - Client: simplify registration RespTooManyRequests message to show retry time when provided - Add test for retryAfterSecondsAt * [Client] Restore registration guidance and drop duplicated rate limit reason The registration RespTooManyRequests case now only shows the retry-after copy when the server actually sent a denied_end_time; the per-email account cap path (no end time) falls back to the previous guidance about already having an account and contacting the server operator. Drop the canned denied_reason_str from the new login rate limit branches so the client no longer prints the same sentence twice. * [Server] Exempt trusted_sources from auth rate limits Addresses in security/trusted_sources bypass per-address limits, matching the existing max_users_per_address bypass in initSession. Without this, Webatrice behind local nginx (all clients as 127.0.0.1) would lock out every web user after 5 mistyped passwords, and cap the whole server at 2 registrations / 3 forgot-password requests per window. Adds Servatrice::isRateLimitExempt helper; recordFailedLogin, isLoginRateLimited, recordRegistrationAttempt and recordForgotPasswordAttempt all check it. # Conflicts: # servatrice/src/servatrice.cpp * [Server] Key login rate limit by (address, username) A successful login cleared the whole per-IP failure history, so 4 bad guesses plus 1 self-login (or guest UnknownUser login) from the same address bypassed the limiter. Failures are now bucketed per (address, lowercase username) and a success clears only its own pair. --------- Co-authored-by: Lukas Brübach <Bruebach.Lukas@bdosecurity.de>
248 lines
7.7 KiB
CMake
248 lines
7.7 KiB
CMake
# CMakeLists for servatrice directory
|
|
#
|
|
# provides the servatrice binary
|
|
|
|
project(Servatrice VERSION "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}")
|
|
|
|
set(servatrice_SOURCES
|
|
src/email_parser.cpp
|
|
src/event_loop_watchdog.cpp
|
|
src/main.cpp
|
|
src/metrics_registry.cpp
|
|
src/ratelimiter.cpp
|
|
src/servatrice.cpp
|
|
src/servatrice_connection_pool.cpp
|
|
src/servatrice_database_interface.cpp
|
|
src/server_logger.cpp
|
|
src/serversocketinterface.cpp
|
|
src/settingscache.cpp
|
|
src/isl_interface.cpp
|
|
src/signalhandler.cpp
|
|
${VERSION_STRING_CPP}
|
|
src/smtpclient.cpp
|
|
src/smtp/qxthmac.cpp
|
|
src/smtp/qxtmailattachment.cpp
|
|
src/smtp/qxtmailmessage.cpp
|
|
src/smtp/qxtsmtp.cpp
|
|
)
|
|
|
|
set(servatrice_RESOURCES servatrice.qrc)
|
|
|
|
# Qxt SMTP is vendored.
|
|
cockatrice_disable_sanitizers_for(
|
|
src/smtp/qxthmac.cpp src/smtp/qxtmailattachment.cpp src/smtp/qxtmailmessage.cpp src/smtp/qxtsmtp.cpp
|
|
)
|
|
cockatrice_disable_coverage_for(
|
|
src/smtp/qxthmac.cpp src/smtp/qxtmailattachment.cpp src/smtp/qxtmailmessage.cpp src/smtp/qxtsmtp.cpp
|
|
)
|
|
|
|
if(WIN32)
|
|
set(servatrice_SOURCES ${servatrice_SOURCES} servatrice.rc)
|
|
endif(WIN32)
|
|
|
|
# Under FreeBSD we need libexecinfo to use backtrace_symbols_fd()
|
|
if(CMAKE_HOST_SYSTEM MATCHES "FreeBSD")
|
|
find_package(Libexecinfo REQUIRED)
|
|
set(SYSTEM_LIBRARIES ${EXECINFO_LIBRARY} ${SYSTEM_LIBRARIES})
|
|
endif()
|
|
|
|
if(APPLE)
|
|
set(MACOSX_BUNDLE_ICON_FILE appicon.icns)
|
|
set_source_files_properties(
|
|
${CMAKE_CURRENT_SOURCE_DIR}/resources/appicon.icns PROPERTIES MACOSX_PACKAGE_LOCATION Resources
|
|
)
|
|
set(servatrice_SOURCES ${servatrice_SOURCES} ${CMAKE_CURRENT_SOURCE_DIR}/resources/appicon.icns)
|
|
endif(APPLE)
|
|
|
|
qt6_add_resources(servatrice_RESOURCES_RCC ${servatrice_RESOURCES})
|
|
|
|
set(QT_DONT_USE_QTGUI TRUE)
|
|
|
|
# Mysql connector
|
|
if(UNIX)
|
|
if(APPLE)
|
|
set(MYSQLCLIENT_DEFAULT_PATHS "/usr/local/lib" "/opt/local/lib/mysql55/mysql/" "/opt/local/lib/mysql56/mysql/")
|
|
else()
|
|
set(MYSQLCLIENT_DEFAULT_PATHS "/usr/lib64" "/usr/local/lib64" "/usr/lib" "/usr/local/lib")
|
|
endif()
|
|
elseif(WIN32)
|
|
set(MYSQLCLIENT_DEFAULT_PATHS "C:\\Program Files\\MySQL\\MySQL Server 5.7\\lib"
|
|
"C:\\Program Files (x86)\\MySQL\\MySQL Server 5.7\\lib"
|
|
)
|
|
endif()
|
|
|
|
find_library(
|
|
MYSQL_CLIENT_LIBRARIES
|
|
NAMES mysqlclient
|
|
PATHS ${MYSQLCLIENT_DEFAULT_PATHS}
|
|
PATH_SUFFIXES mysql mariadb
|
|
)
|
|
if(${MYSQL_CLIENT_LIBRARIES} MATCHES "NOTFOUND")
|
|
set(MYSQLCLIENT_FOUND
|
|
FALSE
|
|
CACHE INTERNAL ""
|
|
)
|
|
message(STATUS "MySQL connector NOT FOUND: Servatrice won't be able to connect to a MySQL server")
|
|
unset(MYSQL_CLIENT_LIBRARIES)
|
|
else()
|
|
set(MYSQLCLIENT_FOUND
|
|
TRUE
|
|
CACHE INTERNAL ""
|
|
)
|
|
get_filename_component(MYSQLCLIENT_LIBRARY_DIR ${MYSQL_CLIENT_LIBRARIES} PATH)
|
|
message(STATUS "Found MySQL connector at: ${MYSQL_CLIENT_LIBRARIES}")
|
|
endif()
|
|
|
|
# Declare path variables
|
|
set(ICONDIR
|
|
share/icons
|
|
CACHE STRING "icon dir"
|
|
)
|
|
set(DESKTOPDIR
|
|
share/applications
|
|
CACHE STRING "desktop file destination"
|
|
)
|
|
|
|
# Build servatrice binary and link it
|
|
add_executable(servatrice MACOSX_BUNDLE ${servatrice_MOC_SRCS} ${servatrice_RESOURCES_RCC} ${servatrice_SOURCES})
|
|
|
|
target_precompile_headers(servatrice PRIVATE "${CMAKE_SOURCE_DIR}/cmake/pch/qtcore_pch.h")
|
|
|
|
if(CMAKE_HOST_SYSTEM MATCHES "FreeBSD")
|
|
target_link_libraries(
|
|
servatrice libcockatrice_deck_list libcockatrice_network_server_remote Threads::Threads ${SERVATRICE_QT_MODULES}
|
|
${LIBEXECINFO_LIBRARY}
|
|
)
|
|
else()
|
|
target_link_libraries(
|
|
servatrice libcockatrice_deck_list libcockatrice_network_server_remote Threads::Threads ${SERVATRICE_QT_MODULES}
|
|
)
|
|
endif()
|
|
|
|
# install rules
|
|
if(UNIX)
|
|
if(APPLE)
|
|
set(MACOSX_BUNDLE_INFO_STRING "${PROJECT_NAME}")
|
|
set(MACOSX_BUNDLE_GUI_IDENTIFIER "com.cockatrice.${PROJECT_NAME}")
|
|
set(MACOSX_BUNDLE_LONG_VERSION_STRING "${PROJECT_NAME}-${PROJECT_VERSION}")
|
|
set(MACOSX_BUNDLE_BUNDLE_NAME ${PROJECT_NAME})
|
|
set(MACOSX_BUNDLE_SHORT_VERSION_STRING ${PROJECT_VERSION})
|
|
set(MACOSX_BUNDLE_BUNDLE_VERSION ${PROJECT_VERSION})
|
|
|
|
install(TARGETS servatrice BUNDLE DESTINATION ./)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.ini.example DESTINATION ./servatrice.app/Contents/Resources/)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.sql DESTINATION ./servatrice.app/Contents/Resources/)
|
|
else()
|
|
# Assume linux
|
|
install(TARGETS servatrice RUNTIME DESTINATION bin/)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.ini.example DESTINATION share/servatrice/)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.sql DESTINATION share/servatrice/)
|
|
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/resources/servatrice.png DESTINATION ${ICONDIR}/hicolor/48x48/apps)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/resources/servatrice.svg DESTINATION ${ICONDIR}/hicolor/scalable/apps)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.desktop DESTINATION ${DESKTOPDIR})
|
|
endif()
|
|
elseif(WIN32)
|
|
install(TARGETS servatrice RUNTIME DESTINATION ./)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.ini.example DESTINATION ./)
|
|
install(FILES ${CMAKE_CURRENT_SOURCE_DIR}/servatrice.sql DESTINATION ./)
|
|
endif()
|
|
|
|
if(APPLE)
|
|
# these needs to be relative to CMAKE_INSTALL_PREFIX
|
|
set(plugin_dest_dir servatrice.app/Contents/Plugins)
|
|
set(qtconf_dest_dir servatrice.app/Contents/Resources)
|
|
|
|
# Qt plugins: platforms, sqldrivers/mysql, tls (Qt6)
|
|
install(
|
|
DIRECTORY "${QT_PLUGINS_DIR}/"
|
|
DESTINATION ${plugin_dest_dir}
|
|
COMPONENT Runtime
|
|
FILES_MATCHING
|
|
PATTERN "*.dSYM" EXCLUDE
|
|
PATTERN "*_debug.dylib" EXCLUDE
|
|
PATTERN "platforms/*.dylib"
|
|
PATTERN "sqldrivers/libqsqlmysql*.dylib"
|
|
PATTERN "tls/*.dylib"
|
|
)
|
|
|
|
install(
|
|
CODE "
|
|
file(WRITE \"\${CMAKE_INSTALL_PREFIX}/${qtconf_dest_dir}/qt.conf\" \"[Paths]
|
|
Plugins = Plugins
|
|
Translations = Resources/translations\")
|
|
"
|
|
COMPONENT Runtime
|
|
)
|
|
|
|
install(
|
|
CODE "
|
|
file(GLOB_RECURSE QTPLUGINS
|
|
\"\${CMAKE_INSTALL_PREFIX}/${plugin_dest_dir}/*.dylib\")
|
|
set(BU_CHMOD_BUNDLE_ITEMS ON)
|
|
include(BundleUtilities)
|
|
fixup_bundle(\"\${CMAKE_INSTALL_PREFIX}/servatrice.app\" \"\${QTPLUGINS}\" \"${QT_LIBRARY_DIR};${MYSQLCLIENT_LIBRARY_DIR}\")
|
|
"
|
|
COMPONENT Runtime
|
|
)
|
|
endif()
|
|
|
|
if(WIN32)
|
|
# these needs to be relative to CMAKE_INSTALL_PREFIX
|
|
set(plugin_dest_dir Plugins)
|
|
set(qtconf_dest_dir .)
|
|
|
|
install(
|
|
DIRECTORY "$<TARGET_FILE_DIR:servatrice>/"
|
|
DESTINATION ./
|
|
FILES_MATCHING
|
|
PATTERN "*.dll"
|
|
PATTERN "*.pdb" EXCLUDE
|
|
PATTERN "*.dir*" EXCLUDE
|
|
PATTERN "*_autogen*" EXCLUDE
|
|
PATTERN "*.tlog*" EXCLUDE
|
|
PATTERN "CMakeFiles*" EXCLUDE
|
|
PATTERN "x64*" EXCLUDE
|
|
PATTERN ".qt*" EXCLUDE
|
|
PATTERN ".qsb*" EXCLUDE
|
|
PATTERN ".lupdate*" EXCLUDE
|
|
)
|
|
|
|
# Qt plugins: platforms, sqldrivers, tls (Qt6)
|
|
install(
|
|
DIRECTORY "${QT_PLUGINS_DIR}/"
|
|
DESTINATION ${plugin_dest_dir}
|
|
COMPONENT Runtime
|
|
FILES_MATCHING
|
|
PATTERN "platforms/qdirect2d.dll"
|
|
PATTERN "platforms/qminimal.dll"
|
|
PATTERN "platforms/qoffscreen.dll"
|
|
PATTERN "platforms/qwindows.dll"
|
|
PATTERN "tls/qcertonlybackend.dll"
|
|
PATTERN "tls/qopensslbackend.dll"
|
|
PATTERN "tls/qschannelbackend.dll"
|
|
PATTERN "sqldrivers/qsqlite.dll"
|
|
PATTERN "sqldrivers/qsqlodbc.dll"
|
|
PATTERN "sqldrivers/qsqlpsql.dll"
|
|
)
|
|
|
|
install(
|
|
CODE "
|
|
file(WRITE \"\${CMAKE_INSTALL_PREFIX}/${qtconf_dest_dir}/qt.conf\" \"[Paths]
|
|
Plugins = Plugins
|
|
Translations = Resources/translations\")
|
|
"
|
|
COMPONENT Runtime
|
|
)
|
|
|
|
install(
|
|
CODE "
|
|
file(GLOB_RECURSE QTPLUGINS
|
|
\"\${CMAKE_INSTALL_PREFIX}/${plugin_dest_dir}/*.dll\")
|
|
set(BU_CHMOD_BUNDLE_ITEMS ON)
|
|
include(BundleUtilities)
|
|
fixup_bundle(\"\${CMAKE_INSTALL_PREFIX}/Servatrice.exe\" \"\${QTPLUGINS}\" \"${QT_LIBRARY_DIR};${MYSQLCLIENT_LIBRARY_DIR}\")
|
|
"
|
|
COMPONENT Runtime
|
|
)
|
|
endif()
|