RPJosh
/
authelia
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
authelia/internal/middlewares/timing_attack_delay_test.go

75 lines
2.2 KiB
Go
Raw Normal View History

fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
package middlewares
import (
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
"fmt"
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
"testing"
"time"
"github.com/stretchr/testify/assert"
)
func TestTimingAttackDelayAverages(t *testing.T) {
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
delayer := NewTimingAttackDelayer("test", time.Second, time.Millisecond*250, time.Millisecond*85, 10)
// func movingAverageIteration(value time.Duration, history int, successful bool, cursor *int, movingAvg *[]time.Duration, mutex sync.Locker) f
expected := float64(1000)
elapsedDurations := []time.Duration{
time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500,
time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500,
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500,
time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500,
time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500, time.Millisecond * 500,
}
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
// Execute at 500ms.
for i, have := range elapsedDurations {
t.Run(fmt.Sprintf("%d", i), func(t *testing.T) {
if i == 0 {
assert.Equal(t, expected, delayer.avg(have, false))
} else {
assert.Equal(t, expected, delayer.avg(have, true))
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
// Should not dip below 500, and should decrease in value by 50 each iteration where it was successful.
if expected > 500 {
expected -= 50
}
}
})
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
}
}
func TestTimingAttackDelayCalculations(t *testing.T) {
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
min := time.Millisecond * 250
max := time.Millisecond * 85
avg := time.Second
delayer := NewTimingAttackDelayer("test", avg, min, max, 10)
elapsed := 500 * time.Millisecond
expectedMin := avg - elapsed
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
for i := 0; i < 100; i++ {
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
delay := delayer.actual(elapsed, delayer.avg(elapsed, false), false)
assert.GreaterOrEqual(t, delay, expectedMin)
assert.LessOrEqual(t, delay, expectedMin+max)
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
}
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
elapsed = time.Millisecond * 5
avg = time.Millisecond * 5
expectedMin = min - elapsed
delayer = NewTimingAttackDelayer("test", avg, min, max, 10)
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
for i := 0; i < 100; i++ {
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
delay := delayer.actual(elapsed, delayer.avg(elapsed, false), false)
assert.GreaterOrEqual(t, delay, expectedMin)
assert.LessOrEqual(t, delay, expectedMin+max)
fix(middlewares): smart delay on reset password (#2767) This adds a smart delay on reset password attempts to prevent username enumeration. Additionally utilizes crypto rand instead of math rand. It also moves the timing delay functionality into its own handler func.
2022-01-20 23:46:13 +00:00
}
}
refactor: timing attack delayer
2023-03-01 23:38:56 +00:00
/*
*/