#3126: limit totp attempt

SoObjects/SOGo/SOGoCache.h

@@ -97,6 +97,11 @@
 
 - (NSDictionary *) failedPasswordRecoveryCountForLogin: (NSString *) login;
 
+- (void) setFailedTotpCount: (int) theCount
+                   forLogin: (NSString *) theLogin;
+
+- (NSDictionary *) failedTotpCountForLogin: (NSString *) login;
+
 - (void) setMessageSubmissionsCount: (int) theCount
                     recipientsCount: (int) theRecipientsCount
                            forLogin: (NSString *) theLogin;

SoObjects/SOGo/SOGoCache.m

@@ -568,6 +568,23 @@ static memcached_st *handle = NULL;
                              ofType: @"failedrecovery"];
 }
 
+//
+// SOGo TOTP verification failed counts (web login second factor).
+//
+- (void) setFailedTotpCount: (int) theCount
+                   forLogin: (NSString *) theLogin
+{
+  [self _setFailedCount: theCount
+               forLogin: theLogin
+                 ofType: @"failedtotp"];
+}
+
+- (NSDictionary *) failedTotpCountForLogin: (NSString *) theLogin
+{
+  return [self _failedCountForLogin: theLogin
+                             ofType: @"failedtotp"];
+}
+
 //
 //
 //

SoObjects/SOGo/SOGoDefaults.plist

@@ -209,4 +209,5 @@
     SOGoPasswordRecoveryMode = "Disabled";
     SOGoPasswordRecoveryQuestion = "SecretQuestion1";
     SOGoMaximumFailedPasswordRecoveryCount = 5;
+    SOGoMaximumFailedTotpCount = 5;
 }

SoObjects/SOGo/SOGoSystemDefaults.h

@@ -128,6 +128,7 @@ NSComparisonResult languageSort(id el1, id el2, void *context);
 - (int) maximumFailedLoginInterval;
 - (int) failedLoginBlockInterval;
 - (int) maximumFailedPasswordRecoveryCount;
+- (int) maximumFailedTotpCount;
 
 - (int) maximumMessageSizeLimit;
 

SoObjects/SOGo/SOGoSystemDefaults.m

@@ -927,6 +927,17 @@ NSComparisonResult languageSort(id el1, id el2, void *context)
   return [self integerForKey: @"SOGoMaximumFailedPasswordRecoveryCount"];
 }
 
+//
+// Number of wrong TOTP verification codes allowed during
+// SOGoFailedLoginBlockInterval seconds before TOTP verification
+// is blocked for the account. Defaults to 5 (see SOGoDefaults.plist),
+// 0 disables the protection.
+//
+- (int) maximumFailedTotpCount
+{
+  return [self integerForKey: @"SOGoMaximumFailedTotpCount"];
+}
+
 //
 //
 //

SoObjects/SOGo/SOGoUserManager.h

@@ -112,6 +112,8 @@
                                                           perr: (SOGoPasswordPolicyError *) perr;
 - (NSString *) getPasswordRecoveryTokenFor: (NSString *) username domain:(NSString *) domain;
 - (BOOL) isPasswordRecoveryTokenValidFor: (NSString *) token uid: (NSString *) uid;
+- (BOOL) isTotpVerificationBlockedForLogin: (NSString *) login
+                               failedCount: (int *) failedCount;
 @end
 
 #endif /* SOGOUSERMANAGER_H */

SoObjects/SOGo/SOGoUserManager.m

@@ -1545,6 +1545,45 @@ static const NSString *kObfuscatedSecondaryEmailKey = @"obfuscatedSecondaryEmail
   return jwtToken;
 }
 
+/**
+ * (TOTP) Check whether TOTP verification is temporarily blocked for login
+ * because of too many wrong codes. Resets the counter once the block interval is over.
+ * @param login User login (uid)
+ * @param failedCount Current number of failures (out)
+ * @return True if blocked
+ */
+- (BOOL) isTotpVerificationBlockedForLogin: (NSString *) login
+                               failedCount: (int *) failedCount
+{
+  NSDictionary *failedTotp;
+  SOGoSystemDefaults *sd;
+  unsigned int currentTime, startTime;
+  int maxFailed;
+
+  *failedCount = 0;
+  sd = [SOGoSystemDefaults sharedSystemDefaults];
+  maxFailed = [sd maximumFailedTotpCount];
+  if (maxFailed <= 0 || ![login length])
+    return NO;
+
+  failedTotp = [[SOGoCache sharedCache] failedTotpCountForLogin: login];
+  if (!failedTotp)
+    return NO;
+
+  currentTime = [[NSCalendarDate date] timeIntervalSince1970];
+  startTime = [[failedTotp objectForKey: @"InitialDate"] unsignedIntValue];
+  if (currentTime - startTime > (unsigned int) [sd failedLoginBlockInterval])
+    {
+      [[SOGoCache sharedCache] setFailedTotpCount: 0
+                                         forLogin: login];
+      return NO;
+    }
+
+  *failedCount = [[failedTotp objectForKey: @"FailedCount"] intValue];
+
+  return (*failedCount >= maxFailed);
+}
+
 /**
  * (Secret Question) Check whether password recovery is temporarily blocked for uid
  * because of too many wrong answers. Resets the counter once the block interval is over.