mirror of
https://github.com/rstrouse/ESPSomfy-RTS.git
synced 2026-10-31 13:52:15 +01:00
bab83313ee
PR C of SECURITY_PLAN.md: after 5 failed /login attempts an IP is refused for 30 s, and each failure after that refuses it for twice as long, up to 15 min. A success resets it, as does an hour without a failure. - LoginThrottle.h holds the schedule and 8 IPs, with the time passed in so native tests cover it. While all 8 hold recent failures, every other IP shares one more slot, so many addresses don't each get five free tries. - A refused IP gets 429 with Retry-After before its credentials are checked, so a right guess during a lockout reveals nothing. Home Assistant retries a 429 instead of asking for new credentials. - The web UI's login panel shows a 401's or 429's message, where it popped a service error. - test/e2e --lockout checks it on a Secured device and waits it out. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
83 lines
2.9 KiB
Python
83 lines
2.9 KiB
Python
"""The socket under the device's security mode (docs/adr/0006-two-security-modes-eleven-http-routes.md).
|
|
|
|
The suite never changes the device's security itself, so it tests the mode it
|
|
finds: pass --password or --pin for a Secured device.
|
|
"""
|
|
import json
|
|
import time
|
|
import urllib.error
|
|
import urllib.request
|
|
|
|
import pytest
|
|
|
|
from proto_client import ProtoClient
|
|
|
|
|
|
def test_none_lets_anyone_connect(host, secured):
|
|
if secured:
|
|
pytest.skip("the device is Secured")
|
|
c = ProtoClient(host)
|
|
assert c.status == 101
|
|
c.close()
|
|
|
|
|
|
def test_secured_refuses_a_socket_without_a_token(host, secured):
|
|
if not secured:
|
|
pytest.skip("the device's security is None")
|
|
c = ProtoClient(host)
|
|
assert c.status == 401
|
|
|
|
|
|
def test_secured_refuses_a_wrong_token(host, secured):
|
|
if not secured:
|
|
pytest.skip("the device's security is None")
|
|
c = ProtoClient(host, params={"apikey": "0" * 64})
|
|
assert c.status == 401
|
|
|
|
|
|
def test_secured_accepts_the_token(host, secured, token):
|
|
if not secured:
|
|
pytest.skip("the device's security is None")
|
|
c = ProtoClient(host, params={"apikey": token})
|
|
assert c.status == 101
|
|
c.close()
|
|
|
|
|
|
def login_status(host, body):
|
|
"""/login's status and reply, refusals included."""
|
|
req = urllib.request.Request(
|
|
f"http://{host}/login",
|
|
data=json.dumps(body).encode(),
|
|
method="PUT",
|
|
headers={"Content-Type": "application/json"},
|
|
)
|
|
try:
|
|
with urllib.request.urlopen(req, timeout=20) as r:
|
|
return r.status, json.loads(r.read()), r.headers
|
|
except urllib.error.HTTPError as e:
|
|
return e.code, json.loads(e.read() or b"{}"), e.headers
|
|
|
|
|
|
def test_failed_logins_lock_this_pc_out(request, host, secured, token):
|
|
"""Five wrong logins refuse this IP for 30 s, even with the right ones (SECURITY_PLAN.md, PR C)."""
|
|
if not request.config.getoption("--lockout"):
|
|
pytest.skip("locks this PC out of /login for 30 s: pass --lockout")
|
|
if not secured:
|
|
pytest.skip("the device's security is None")
|
|
password = request.config.getoption("--password")
|
|
pin = request.config.getoption("--pin")
|
|
right = {"username": request.config.getoption("--username"), "password": password or "", "pin": pin or ""}
|
|
wrong = {**right, "password": (password or "") + "x", "pin": "0000" if pin != "0000" else "1111"}
|
|
# The token fixture's login started this PC with a clean count.
|
|
for _ in range(5):
|
|
status, reply, _ = login_status(host, wrong)
|
|
assert status == 401 and reply["success"] is False
|
|
status, reply, headers = login_status(host, right)
|
|
assert status == 429, "the right credentials got through a lockout"
|
|
wait = int(headers["Retry-After"])
|
|
assert 25 <= wait <= 30
|
|
assert reply["retryAfter"] == wait
|
|
time.sleep(wait + 1)
|
|
# Over: the right credentials work, and reset the count.
|
|
status, reply, _ = login_status(host, right)
|
|
assert status == 200 and reply["apiKey"] == token
|