debian-mirror-gitlab/config/initializers/rack_attack.rb

165 lines
5 KiB
Ruby
Raw Normal View History

2020-01-01 13:55:28 +05:30
# Specs for this file can be found on:
# * spec/lib/gitlab/throttle_spec.rb
# * spec/requests/rack_attack_global_spec.rb
2018-03-17 18:26:18 +05:30
module Gitlab::Throttle
def self.settings
Gitlab::CurrentSettings.current_application_settings
end
2020-01-01 13:55:28 +05:30
# Returns true if we should use the Admin Area protected paths throttle
2019-12-21 20:55:43 +05:30
def self.protected_paths_enabled?
2020-01-01 13:55:28 +05:30
self.settings.throttle_protected_paths_enabled?
end
2019-12-21 20:55:43 +05:30
def self.omnibus_protected_paths_present?
Rack::Attack.throttles.key?('protected paths')
end
2018-03-17 18:26:18 +05:30
def self.unauthenticated_options
limit_proc = proc { |req| settings.throttle_unauthenticated_requests_per_period }
period_proc = proc { |req| settings.throttle_unauthenticated_period_in_seconds.seconds }
{ limit: limit_proc, period: period_proc }
end
def self.authenticated_api_options
limit_proc = proc { |req| settings.throttle_authenticated_api_requests_per_period }
period_proc = proc { |req| settings.throttle_authenticated_api_period_in_seconds.seconds }
{ limit: limit_proc, period: period_proc }
end
def self.authenticated_web_options
limit_proc = proc { |req| settings.throttle_authenticated_web_requests_per_period }
period_proc = proc { |req| settings.throttle_authenticated_web_period_in_seconds.seconds }
{ limit: limit_proc, period: period_proc }
end
2019-12-21 20:55:43 +05:30
def self.protected_paths_options
limit_proc = proc { |req| settings.throttle_protected_paths_requests_per_period }
period_proc = proc { |req| settings.throttle_protected_paths_period_in_seconds.seconds }
{ limit: limit_proc, period: period_proc }
end
2018-03-17 18:26:18 +05:30
end
class Rack::Attack
2019-12-26 22:10:19 +05:30
# Order conditions by how expensive they are:
# 1. The most expensive is the `req.unauthenticated?` and
# `req.authenticated_user_id` as it performs an expensive
# DB/Redis query to validate the request
# 2. Slightly less expensive is the need to query DB/Redis
# to unmarshal settings (`Gitlab::Throttle.settings`)
#
# We deliberately skip `/-/health|liveness|readiness`
# from Rack Attack as they need to always be accessible
# by Load Balancer and additional measure is implemented
# (token and whitelisting) to prevent abuse.
2018-03-17 18:26:18 +05:30
throttle('throttle_unauthenticated', Gitlab::Throttle.unauthenticated_options) do |req|
2019-12-26 22:10:19 +05:30
if !req.should_be_skipped? &&
Gitlab::Throttle.settings.throttle_unauthenticated_enabled &&
req.unauthenticated?
2018-03-17 18:26:18 +05:30
req.ip
2019-12-26 22:10:19 +05:30
end
2018-03-17 18:26:18 +05:30
end
throttle('throttle_authenticated_api', Gitlab::Throttle.authenticated_api_options) do |req|
2019-12-26 22:10:19 +05:30
if req.api_request? &&
Gitlab::Throttle.settings.throttle_authenticated_api_enabled
2018-11-29 20:51:05 +05:30
req.authenticated_user_id([:api])
2019-12-26 22:10:19 +05:30
end
2018-03-17 18:26:18 +05:30
end
throttle('throttle_authenticated_web', Gitlab::Throttle.authenticated_web_options) do |req|
2019-12-26 22:10:19 +05:30
if req.web_request? &&
Gitlab::Throttle.settings.throttle_authenticated_web_enabled
2018-11-29 20:51:05 +05:30
req.authenticated_user_id([:api, :rss, :ics])
2019-12-26 22:10:19 +05:30
end
2018-03-17 18:26:18 +05:30
end
2019-12-21 20:55:43 +05:30
throttle('throttle_unauthenticated_protected_paths', Gitlab::Throttle.protected_paths_options) do |req|
2019-12-26 22:10:19 +05:30
if req.post? &&
!req.should_be_skipped? &&
req.protected_path? &&
Gitlab::Throttle.protected_paths_enabled? &&
req.unauthenticated?
2019-12-21 20:55:43 +05:30
req.ip
2019-12-26 22:10:19 +05:30
end
2019-12-21 20:55:43 +05:30
end
throttle('throttle_authenticated_protected_paths_api', Gitlab::Throttle.protected_paths_options) do |req|
2019-12-26 22:10:19 +05:30
if req.post? &&
req.api_request? &&
req.protected_path? &&
Gitlab::Throttle.protected_paths_enabled?
2019-12-21 20:55:43 +05:30
req.authenticated_user_id([:api])
2019-12-26 22:10:19 +05:30
end
2019-12-21 20:55:43 +05:30
end
throttle('throttle_authenticated_protected_paths_web', Gitlab::Throttle.protected_paths_options) do |req|
2019-12-26 22:10:19 +05:30
if req.post? &&
req.web_request? &&
req.protected_path? &&
Gitlab::Throttle.protected_paths_enabled?
2019-12-21 20:55:43 +05:30
req.authenticated_user_id([:api, :rss, :ics])
2019-12-26 22:10:19 +05:30
end
2019-12-21 20:55:43 +05:30
end
2018-03-17 18:26:18 +05:30
class Request
def unauthenticated?
2020-01-01 13:55:28 +05:30
!(authenticated_user_id([:api, :rss, :ics]) || authenticated_runner_id)
2018-03-17 18:26:18 +05:30
end
2018-11-29 20:51:05 +05:30
def authenticated_user_id(request_formats)
2020-01-01 13:55:28 +05:30
request_authenticator.user(request_formats)&.id
end
def authenticated_runner_id
request_authenticator.runner&.id
2018-03-17 18:26:18 +05:30
end
def api_request?
path.start_with?('/api')
end
2018-03-27 19:54:05 +05:30
def api_internal_request?
path =~ %r{^/api/v\d+/internal/}
end
2019-12-26 22:10:19 +05:30
def health_check_request?
path =~ %r{^/-/(health|liveness|readiness)}
end
2018-11-08 19:23:39 +05:30
def should_be_skipped?
2019-12-26 22:10:19 +05:30
api_internal_request? || health_check_request?
2018-11-08 19:23:39 +05:30
end
2018-03-17 18:26:18 +05:30
def web_request?
2019-12-26 22:10:19 +05:30
!api_request? && !health_check_request?
2018-03-17 18:26:18 +05:30
end
2019-12-21 20:55:43 +05:30
def protected_path?
!protected_path_regex.nil?
end
def protected_path_regex
path =~ protected_paths_regex
end
private
2020-01-01 13:55:28 +05:30
def request_authenticator
@request_authenticator ||= Gitlab::Auth::RequestAuthenticator.new(self)
end
2019-12-21 20:55:43 +05:30
def protected_paths
Gitlab::CurrentSettings.current_application_settings.protected_paths
end
def protected_paths_regex
Regexp.union(protected_paths.map { |path| /\A#{Regexp.escape(path)}/ })
end
2018-03-17 18:26:18 +05:30
end
end
2019-12-04 20:38:33 +05:30
2020-05-24 23:13:21 +05:30
::Rack::Attack.extend_if_ee('::EE::Gitlab::Rack::Attack')
2019-12-04 20:38:33 +05:30
::Rack::Attack::Request.prepend_if_ee('::EE::Gitlab::Rack::Attack::Request')