get_client_ip() fell back to the leftmost X-Forwarded-For element
whenever REMOTE_ADDR was loopback, and the value it returned decides two
security outcomes in check(): whether the IP is whitelisted, which skips
2FA entirely, and which bucket the login rate limiter charges.
The fallback only fires behind a reverse proxy, which is what it was
written for - but that is exactly where the leftmost element is the one
the client sent, since a proxy appends rather than prepends. A request
carrying `X-Forwarded-For: <whitelisted address>` therefore returns
`{ required: false, whitelisted: true }` and never asks for an OTP, and
a fresh header value per request gives every attempt its own rate-limit
bucket, so the max_attempts lockout never fires and the six digits can
be brute forced. The same header pointed at someone else's address locks
that address out instead.
Nothing else in LuCI reads X-Forwarded-For, and the plugin has no
trusted-proxy configuration that could tell the header apart from a
forged one, so drop the fallback and use REMOTE_ADDR alone.
Its loopback gate means only an on-box proxy is affected by the removal,
and there every client collapses onto 127.0.0.1. The whitelist then
simply stops matching, and strict_mode stops taking the
local_subnet_bypass on an uncalibrated clock - both fail closed, which
is the point. The rate limiter does not: its gate runs ahead of
is_2fa_enabled() and returns blocked rather than an OTP prompt, so five
bad codes from any one client behind the proxy would lock every account
on the box out of LuCI for the lockout period, including accounts with
no OTP configured.
So key the bucket on user and address together, the way luci-base
already keys its own verify limiter. Brute forcing one account still
trips the lockout after max_attempts, which is what the limiter is for,
while a shared address no longer makes one client's failures anyone
else's. The address-only key was also the reason the three call sites
skipped the limiter entirely when REMOTE_ADDR was absent; the key is
well formed either way now, so they no longer need to.
A proxy on a separate host is a different deployment and this commit
does not change it: REMOTE_ADDR is the proxy's own LAN address there,
the fallback never fired, and both gates read that address rather than
the client's - so a whitelist entry or LAN subnet covering the proxy
exempts everyone behind it, before and after. Distinguishing those
clients needs a trusted-proxy setting the plugin does not have.
Assisted-by: Claude:claude-opus-5
Signed-off-by: Julius Bairaktaris <julius@bairaktaris.de>
This commit introduces a generic authentication plugin mechanism
to the LuCI dispatcher, enabling multi-factor authentication
(MFA/2FA) and other custom verification methods without
modifying core files.
This implementation integrates with the new plugin UI architecture
introduced in commit 617f364 (luci-mod-system: implement plugin UI
architecture), allowing authentication plugins to be managed
through the unified System > Plugins interface.
Signed-off-by: Han Yiming <moebest@outlook.jp>
Co-authored-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Han Yiming <moebest@outlook.jp>
luci-app-2fa: add priority option and QR code display
This update adds a priority option and enables QR code display for 2FA.
luci-app-2fa: native ubus IPvalid fsLOCK and log
use native ubus IP validation instead of custom regex
and parsing, use native fs lock instead of popen-call
and add log for logging auth events.
now, will clean stale rate limit entries on each check
and log when entries are removed due to staleness.
This prevents the rate limit file from growing
indefinitely with old entries.
luci-app-2fa: move dir and sync sysfixtime
move to the new location. update the default time
calibration threshold to sync sysfixtime.
luci-app-2fa: native hex and more readable
use native hex and base32 decoding functions
Signed-off-by: Han Yiming <moebest@outlook.jp>
include some example plugins also.
JS files provide UI to configure behaviour of plugins
which typically live in
/usr/share/ucode/luci/plugins/<class>/<type>
Signed-off-by: Paul Donald <newtwen+github@gmail.com>
Julius Bairaktaris
Jostein Kjønigsen
Paul Donald
Han Yiming