search

Solutions-Nitriques / anti_brute_force

Secure your Symphony CMS login page against brute force attacks
http://symphonyextensions.com/extensions/anti_brute_force/
Other
10 stars 12 forks source link

Database error with IPv6 addresses #36

Closed michael-e closed 7 years ago

michael-e commented 7 years ago

When IPv6 addresses pass through to the ABF extension, you will see a database error on the second login attempt, onviously caused by the fact that the IP address gets cut off in the IP column (defined as VARCHAR 16).

Symphony Fatal Database Error: Duplicate entry '2003:63:2a15:376' for key 'PRIMARY'

An error occurred while attempting to execute the following query

INSERT INTO sym_anti_brute_force ( IP, RawIP, LastAttempt, Username, FailedCount, UA, Source, Hash ) VALUES ( '2003:63:2a15:3767:358f:480e:202d:6883', '2003:63:2a15:3767:358f:480e:202d:1234', NOW(), 'michael-e', 1, 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/602.2.14 (KHTML, like Gecko) Version/10.0.1 Safari/602.2.14', 'Anti Brute Force', UUID() )

The issue will not occur if you increase the length of the IP columns (in all four tables) to VARCHAR 45 (whis is the maximum lenght of an IPv6 address, see http://stackoverflow.com/a/7477384).

michael-e commented 7 years ago

BTW, why is the RawIP column defined with a length of 1024?

nitriques commented 7 years ago

The issue will not occur if you increase the length of the IP columns (in all four tables) to VARCHAR 45

Wanna send a PR ? :)

BTW, why is the RawIP column defined with a length of 1024?

Because it will contain the whole value from the https headers. This can be customized (See https://github.com/Solutions-Nitriques/anti_brute_force/blob/master/lib/class.ABF.php#L657) so we need space to fit things way bigger then a single ip address when usign X-Forwarded-by headers (they can add up). remember this? ;)

michael-e commented 7 years ago

remember this?

:-) Now I do.

Wanna send a PR ? :)

I will take a look and report back.

michael-e commented 7 years ago

I am close. Still 3 questions left:

  1. Should I also add a new release to the meta.xml file?
  2. If yes: Should I tag the release in Git as well?
  3. To which branch should I send the PR?
nitriques commented 7 years ago
  1. Yes please!
  2. No I'll do it, the tag might not be on the same commit.
  3. dev

Thanks!

michael-e commented 7 years ago

Here you are!