2013-02-14 13:25:55 +00:00
|
|
|
require_relative 'shell_env'
|
|
|
|
|
2012-06-29 03:30:31 +00:00
|
|
|
module Grack
|
2015-09-02 16:47:56 +00:00
|
|
|
class AuthSpawner
|
|
|
|
def self.call(env)
|
|
|
|
# Avoid issues with instance variables in Grack::Auth persisting across
|
|
|
|
# requests by creating a new instance for each request.
|
|
|
|
Auth.new({}).call(env)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2012-06-29 03:30:31 +00:00
|
|
|
class Auth < Rack::Auth::Basic
|
2013-06-14 11:42:55 +00:00
|
|
|
|
2014-03-19 19:02:39 +00:00
|
|
|
attr_accessor :user, :project, :env
|
2012-06-29 03:30:31 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
def call(env)
|
|
|
|
@env = env
|
|
|
|
@request = Rack::Request.new(env)
|
|
|
|
@auth = Request.new(env)
|
2013-01-10 18:17:57 +00:00
|
|
|
|
2015-08-26 23:58:49 +00:00
|
|
|
@ci = false
|
2013-08-26 09:54:57 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
# Need this patch due to the rails mount
|
2013-07-30 14:48:00 +00:00
|
|
|
# Need this if under RELATIVE_URL_ROOT
|
|
|
|
unless Gitlab.config.gitlab.relative_url_root.empty?
|
|
|
|
# If website is mounted using relative_url_root need to remove it first
|
|
|
|
@env['PATH_INFO'] = @request.path.sub(Gitlab.config.gitlab.relative_url_root,'')
|
|
|
|
else
|
|
|
|
@env['PATH_INFO'] = @request.path
|
|
|
|
end
|
2013-08-26 09:54:57 +00:00
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
@env['SCRIPT_NAME'] = ""
|
2012-11-26 09:23:08 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
auth!
|
|
|
|
|
2015-10-12 14:42:14 +00:00
|
|
|
lfs_response = Gitlab::Lfs::Router.new(project, @user, @request).try_call
|
|
|
|
return lfs_response unless lfs_response.nil?
|
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
if project && authorized_request?
|
2015-10-29 13:21:24 +00:00
|
|
|
# Tell gitlab-workhorse the request is OK, and what the GL_ID is
|
2015-08-31 13:30:15 +00:00
|
|
|
render_grack_auth_ok
|
2015-08-26 23:58:49 +00:00
|
|
|
elsif @user.nil? && !@ci
|
2015-02-23 22:14:57 +00:00
|
|
|
unauthorized
|
2014-03-21 12:52:30 +00:00
|
|
|
else
|
|
|
|
render_not_found
|
|
|
|
end
|
2013-01-14 14:46:55 +00:00
|
|
|
end
|
2012-06-29 13:40:23 +00:00
|
|
|
|
2013-06-14 11:42:55 +00:00
|
|
|
private
|
|
|
|
|
|
|
|
def auth!
|
2015-02-23 22:14:57 +00:00
|
|
|
return unless @auth.provided?
|
2013-05-24 17:36:28 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
return bad_request unless @auth.basic?
|
2013-10-24 14:17:22 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
# Authentication with username and password
|
|
|
|
login, password = @auth.credentials
|
2013-05-24 17:36:28 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
# Allow authentication for GitLab CI service
|
|
|
|
# if valid token passed
|
2015-08-26 23:58:49 +00:00
|
|
|
if ci_request?(login, password)
|
|
|
|
@ci = true
|
2015-02-23 22:14:57 +00:00
|
|
|
return
|
2013-01-14 14:46:55 +00:00
|
|
|
end
|
2012-07-02 08:44:45 +00:00
|
|
|
|
2015-02-23 22:14:57 +00:00
|
|
|
@user = authenticate_user(login, password)
|
|
|
|
|
|
|
|
if @user
|
|
|
|
Gitlab::ShellEnv.set_env(@user)
|
|
|
|
@env['REMOTE_USER'] = @auth.username
|
2013-06-14 11:42:55 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-08-26 23:58:49 +00:00
|
|
|
def ci_request?(login, password)
|
|
|
|
matched_login = /(?<s>^[a-zA-Z]*-ci)-token$/.match(login)
|
2014-03-21 12:52:30 +00:00
|
|
|
|
2015-08-26 23:58:49 +00:00
|
|
|
if project && matched_login.present? && git_cmd == 'git-upload-pack'
|
2015-10-12 14:42:14 +00:00
|
|
|
underscored_service = matched_login['s'].underscore
|
2015-08-26 23:58:49 +00:00
|
|
|
|
2015-12-04 11:55:23 +00:00
|
|
|
if underscored_service == 'gitlab_ci'
|
2015-12-11 13:37:16 +00:00
|
|
|
return project && project.valid_build_token?(password)
|
2015-12-04 11:55:23 +00:00
|
|
|
elsif Service.available_services_names.include?(underscored_service)
|
2015-08-26 23:58:49 +00:00
|
|
|
service_method = "#{underscored_service}_service"
|
|
|
|
service = project.send(service_method)
|
|
|
|
|
|
|
|
return service && service.activated? && service.valid_token?(password)
|
2014-03-21 12:52:30 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
false
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
|
2015-01-27 23:37:19 +00:00
|
|
|
def oauth_access_token_check(login, password)
|
|
|
|
if login == "oauth2" && git_cmd == 'git-upload-pack' && password.present?
|
|
|
|
token = Doorkeeper::AccessToken.by_token(password)
|
|
|
|
token && token.accessible? && User.find_by(id: token.resource_owner_id)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2013-06-14 11:42:55 +00:00
|
|
|
def authenticate_user(login, password)
|
2014-12-15 17:47:26 +00:00
|
|
|
user = Gitlab::Auth.new.find(login, password)
|
2015-02-03 04:36:54 +00:00
|
|
|
|
2015-01-27 23:37:19 +00:00
|
|
|
unless user
|
|
|
|
user = oauth_access_token_check(login, password)
|
|
|
|
end
|
2015-02-03 04:36:54 +00:00
|
|
|
|
2015-03-16 02:07:23 +00:00
|
|
|
# If the user authenticated successfully, we reset the auth failure count
|
|
|
|
# from Rack::Attack for that IP. A client may attempt to authenticate
|
|
|
|
# with a username and blank password first, and only after it receives
|
|
|
|
# a 401 error does it present a password. Resetting the count prevents
|
|
|
|
# false positives from occurring.
|
|
|
|
#
|
|
|
|
# Otherwise, we let Rack::Attack know there was a failed authentication
|
|
|
|
# attempt from this IP. This information is stored in the Rails cache
|
|
|
|
# (Redis) and will be used by the Rack::Attack middleware to decide
|
|
|
|
# whether to block requests from this IP.
|
2015-01-06 15:56:56 +00:00
|
|
|
config = Gitlab.config.rack_attack.git_basic_auth
|
2015-03-16 02:07:23 +00:00
|
|
|
|
|
|
|
if config.enabled
|
|
|
|
if user
|
|
|
|
# A successful login will reset the auth failure count from this IP
|
|
|
|
Rack::Attack::Allow2Ban.reset(@request.ip, config)
|
2015-01-06 15:56:56 +00:00
|
|
|
else
|
2015-03-16 02:07:23 +00:00
|
|
|
banned = Rack::Attack::Allow2Ban.filter(@request.ip, config) do
|
|
|
|
# Unless the IP is whitelisted, return true so that Allow2Ban
|
|
|
|
# increments the counter (stored in Rails.cache) for the IP
|
|
|
|
if config.ip_whitelist.include?(@request.ip)
|
|
|
|
false
|
|
|
|
else
|
|
|
|
true
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
if banned
|
|
|
|
Rails.logger.info "IP #{@request.ip} failed to login " \
|
|
|
|
"as #{login} but has been temporarily banned from Git auth"
|
|
|
|
end
|
2015-01-06 15:56:56 +00:00
|
|
|
end
|
2014-12-15 17:47:26 +00:00
|
|
|
end
|
|
|
|
|
2015-03-16 02:07:23 +00:00
|
|
|
user
|
2013-05-24 17:36:28 +00:00
|
|
|
end
|
|
|
|
|
2014-03-21 12:52:30 +00:00
|
|
|
def authorized_request?
|
2015-08-26 23:58:49 +00:00
|
|
|
return true if @ci
|
2015-02-23 22:14:57 +00:00
|
|
|
|
2014-03-21 12:52:30 +00:00
|
|
|
case git_cmd
|
2014-03-20 08:53:03 +00:00
|
|
|
when *Gitlab::GitAccess::DOWNLOAD_COMMANDS
|
2015-08-31 13:30:15 +00:00
|
|
|
if !Gitlab.config.gitlab_shell.upload_pack
|
|
|
|
false
|
|
|
|
elsif user
|
2015-03-24 13:10:55 +00:00
|
|
|
Gitlab::GitAccess.new(user, project).download_access_check.allowed?
|
2014-03-21 12:52:30 +00:00
|
|
|
elsif project.public?
|
|
|
|
# Allow clone/fetch for public projects
|
|
|
|
true
|
|
|
|
else
|
|
|
|
false
|
|
|
|
end
|
2014-03-20 08:53:03 +00:00
|
|
|
when *Gitlab::GitAccess::PUSH_COMMANDS
|
2015-08-31 13:30:15 +00:00
|
|
|
if !Gitlab.config.gitlab_shell.receive_pack
|
|
|
|
false
|
|
|
|
elsif user
|
2014-03-21 12:52:30 +00:00
|
|
|
# Skip user authorization on upload request.
|
2014-10-21 10:36:09 +00:00
|
|
|
# It will be done by the pre-receive hook in the repository.
|
2014-03-21 12:52:30 +00:00
|
|
|
true
|
|
|
|
else
|
|
|
|
false
|
|
|
|
end
|
2014-03-20 08:53:03 +00:00
|
|
|
else
|
|
|
|
false
|
2012-10-21 09:12:14 +00:00
|
|
|
end
|
|
|
|
end
|
2012-06-29 10:11:37 +00:00
|
|
|
|
2014-03-21 12:52:30 +00:00
|
|
|
def git_cmd
|
2013-10-24 14:17:22 +00:00
|
|
|
if @request.get?
|
|
|
|
@request.params['service']
|
|
|
|
elsif @request.post?
|
|
|
|
File.basename(@request.path)
|
|
|
|
else
|
|
|
|
nil
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2013-01-14 14:46:55 +00:00
|
|
|
def project
|
2015-02-23 22:14:57 +00:00
|
|
|
return @project if defined?(@project)
|
|
|
|
|
|
|
|
@project = project_by_path(@request.path_info)
|
2013-01-14 14:46:55 +00:00
|
|
|
end
|
2014-03-20 08:53:03 +00:00
|
|
|
|
|
|
|
def project_by_path(path)
|
|
|
|
if m = /^([\w\.\/-]+)\.git/.match(path).to_a
|
|
|
|
path_with_namespace = m.last
|
|
|
|
path_with_namespace.gsub!(/\.wiki$/, '')
|
|
|
|
|
2015-02-23 18:05:18 +00:00
|
|
|
path_with_namespace[0] = '' if path_with_namespace.start_with?('/')
|
2014-03-20 08:53:03 +00:00
|
|
|
Project.find_with_namespace(path_with_namespace)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2015-07-28 13:17:06 +00:00
|
|
|
def render_grack_auth_ok
|
2015-10-22 20:53:12 +00:00
|
|
|
repo_path =
|
|
|
|
if @request.path_info =~ /^([\w\.\/-]+)\.wiki\.git/
|
|
|
|
ProjectWiki.new(project).repository.path_to_repo
|
|
|
|
else
|
|
|
|
project.repository.path_to_repo
|
|
|
|
end
|
|
|
|
|
2015-10-08 15:12:00 +00:00
|
|
|
[
|
|
|
|
200,
|
|
|
|
{ "Content-Type" => "application/json" },
|
|
|
|
[JSON.dump({
|
|
|
|
'GL_ID' => Gitlab::ShellEnv.gl_id(@user),
|
2015-10-22 20:53:12 +00:00
|
|
|
'RepoPath' => repo_path,
|
2015-10-08 15:12:00 +00:00
|
|
|
})]
|
|
|
|
]
|
2015-07-28 13:17:06 +00:00
|
|
|
end
|
|
|
|
|
2014-03-20 08:53:03 +00:00
|
|
|
def render_not_found
|
2015-02-03 04:36:54 +00:00
|
|
|
[404, { "Content-Type" => "text/plain" }, ["Not Found"]]
|
2014-03-20 08:53:03 +00:00
|
|
|
end
|
2013-06-14 11:42:55 +00:00
|
|
|
end
|
|
|
|
end
|