2019-12-04 19:07:50 -05:00
|
|
|
# Specs for this file can be found on:
|
|
|
|
# * spec/lib/gitlab/throttle_spec.rb
|
|
|
|
# * spec/requests/rack_attack_global_spec.rb
|
2017-10-17 12:40:09 -04:00
|
|
|
module Gitlab::Throttle
|
2017-09-15 13:31:32 -04:00
|
|
|
def self.settings
|
|
|
|
Gitlab::CurrentSettings.current_application_settings
|
|
|
|
end
|
|
|
|
|
2019-12-04 19:07:50 -05:00
|
|
|
# Returns true if we should use the Admin Area protected paths throttle
|
2019-09-26 17:06:29 -04:00
|
|
|
def self.protected_paths_enabled?
|
2019-12-04 19:07:50 -05:00
|
|
|
self.settings.throttle_protected_paths_enabled?
|
|
|
|
end
|
|
|
|
|
2019-09-26 17:06:29 -04:00
|
|
|
def self.omnibus_protected_paths_present?
|
|
|
|
Rack::Attack.throttles.key?('protected paths')
|
|
|
|
end
|
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
def self.unauthenticated_options
|
2017-09-15 13:31:32 -04:00
|
|
|
limit_proc = proc { |req| settings.throttle_unauthenticated_requests_per_period }
|
|
|
|
period_proc = proc { |req| settings.throttle_unauthenticated_period_in_seconds.seconds }
|
|
|
|
{ limit: limit_proc, period: period_proc }
|
|
|
|
end
|
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
def self.authenticated_api_options
|
2017-09-15 13:31:32 -04:00
|
|
|
limit_proc = proc { |req| settings.throttle_authenticated_api_requests_per_period }
|
|
|
|
period_proc = proc { |req| settings.throttle_authenticated_api_period_in_seconds.seconds }
|
|
|
|
{ limit: limit_proc, period: period_proc }
|
|
|
|
end
|
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
def self.authenticated_web_options
|
2017-09-15 13:31:32 -04:00
|
|
|
limit_proc = proc { |req| settings.throttle_authenticated_web_requests_per_period }
|
|
|
|
period_proc = proc { |req| settings.throttle_authenticated_web_period_in_seconds.seconds }
|
|
|
|
{ limit: limit_proc, period: period_proc }
|
|
|
|
end
|
2019-09-26 17:06:29 -04:00
|
|
|
|
|
|
|
def self.protected_paths_options
|
|
|
|
limit_proc = proc { |req| settings.throttle_protected_paths_requests_per_period }
|
|
|
|
period_proc = proc { |req| settings.throttle_protected_paths_period_in_seconds.seconds }
|
|
|
|
|
|
|
|
{ limit: limit_proc, period: period_proc }
|
|
|
|
end
|
2017-10-17 12:40:09 -04:00
|
|
|
end
|
2017-09-15 13:31:32 -04:00
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
class Rack::Attack
|
2019-11-07 10:06:33 -05:00
|
|
|
# Order conditions by how expensive they are:
|
|
|
|
# 1. The most expensive is the `req.unauthenticated?` and
|
|
|
|
# `req.authenticated_user_id` as it performs an expensive
|
|
|
|
# DB/Redis query to validate the request
|
|
|
|
# 2. Slightly less expensive is the need to query DB/Redis
|
|
|
|
# to unmarshal settings (`Gitlab::Throttle.settings`)
|
|
|
|
#
|
|
|
|
# We deliberately skip `/-/health|liveness|readiness`
|
|
|
|
# from Rack Attack as they need to always be accessible
|
|
|
|
# by Load Balancer and additional measure is implemented
|
|
|
|
# (token and whitelisting) to prevent abuse.
|
2017-10-17 12:40:09 -04:00
|
|
|
throttle('throttle_unauthenticated', Gitlab::Throttle.unauthenticated_options) do |req|
|
2019-11-07 10:06:33 -05:00
|
|
|
if !req.should_be_skipped? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_enabled &&
|
|
|
|
req.unauthenticated?
|
2017-10-12 20:49:22 -04:00
|
|
|
req.ip
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2017-10-12 20:49:22 -04:00
|
|
|
end
|
2017-09-15 13:31:32 -04:00
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
throttle('throttle_authenticated_api', Gitlab::Throttle.authenticated_api_options) do |req|
|
2019-11-07 10:06:33 -05:00
|
|
|
if req.api_request? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_api_enabled
|
2018-11-28 14:06:02 -05:00
|
|
|
req.authenticated_user_id([:api])
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2017-09-15 13:31:32 -04:00
|
|
|
end
|
|
|
|
|
2017-10-17 12:40:09 -04:00
|
|
|
throttle('throttle_authenticated_web', Gitlab::Throttle.authenticated_web_options) do |req|
|
2019-11-07 10:06:33 -05:00
|
|
|
if req.web_request? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_web_enabled
|
2018-11-28 14:06:02 -05:00
|
|
|
req.authenticated_user_id([:api, :rss, :ics])
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2017-10-12 20:49:22 -04:00
|
|
|
end
|
2017-09-15 13:31:32 -04:00
|
|
|
|
2019-09-26 17:06:29 -04:00
|
|
|
throttle('throttle_unauthenticated_protected_paths', Gitlab::Throttle.protected_paths_options) do |req|
|
2019-11-08 22:06:40 -05:00
|
|
|
if req.post? &&
|
|
|
|
!req.should_be_skipped? &&
|
2019-11-07 10:06:33 -05:00
|
|
|
req.protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled? &&
|
|
|
|
req.unauthenticated?
|
2019-09-26 17:06:29 -04:00
|
|
|
req.ip
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2019-09-26 17:06:29 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
throttle('throttle_authenticated_protected_paths_api', Gitlab::Throttle.protected_paths_options) do |req|
|
2019-11-08 22:06:40 -05:00
|
|
|
if req.post? &&
|
|
|
|
req.api_request? &&
|
|
|
|
req.protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled?
|
2019-09-26 17:06:29 -04:00
|
|
|
req.authenticated_user_id([:api])
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2019-09-26 17:06:29 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
throttle('throttle_authenticated_protected_paths_web', Gitlab::Throttle.protected_paths_options) do |req|
|
2019-11-08 22:06:40 -05:00
|
|
|
if req.post? &&
|
|
|
|
req.web_request? &&
|
|
|
|
req.protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled?
|
2019-09-26 17:06:29 -04:00
|
|
|
req.authenticated_user_id([:api, :rss, :ics])
|
2019-11-07 10:06:33 -05:00
|
|
|
end
|
2019-09-26 17:06:29 -04:00
|
|
|
end
|
|
|
|
|
2017-09-15 13:31:32 -04:00
|
|
|
class Request
|
|
|
|
def unauthenticated?
|
2019-12-11 07:08:10 -05:00
|
|
|
!(authenticated_user_id([:api, :rss, :ics]) || authenticated_runner_id)
|
2017-09-15 13:31:32 -04:00
|
|
|
end
|
|
|
|
|
2018-11-28 14:06:02 -05:00
|
|
|
def authenticated_user_id(request_formats)
|
2019-12-11 07:08:10 -05:00
|
|
|
request_authenticator.user(request_formats)&.id
|
|
|
|
end
|
|
|
|
|
|
|
|
def authenticated_runner_id
|
|
|
|
request_authenticator.runner&.id
|
2017-09-15 13:31:32 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def api_request?
|
|
|
|
path.start_with?('/api')
|
|
|
|
end
|
|
|
|
|
2018-02-15 11:54:36 -05:00
|
|
|
def api_internal_request?
|
|
|
|
path =~ %r{^/api/v\d+/internal/}
|
|
|
|
end
|
|
|
|
|
2019-11-07 10:06:33 -05:00
|
|
|
def health_check_request?
|
|
|
|
path =~ %r{^/-/(health|liveness|readiness)}
|
|
|
|
end
|
|
|
|
|
2018-05-29 08:25:43 -04:00
|
|
|
def should_be_skipped?
|
2019-11-07 10:06:33 -05:00
|
|
|
api_internal_request? || health_check_request?
|
2018-05-29 08:25:43 -04:00
|
|
|
end
|
|
|
|
|
2017-09-15 13:31:32 -04:00
|
|
|
def web_request?
|
2019-11-07 10:06:33 -05:00
|
|
|
!api_request? && !health_check_request?
|
2017-09-15 13:31:32 -04:00
|
|
|
end
|
2019-09-26 17:06:29 -04:00
|
|
|
|
|
|
|
def protected_path?
|
|
|
|
!protected_path_regex.nil?
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_path_regex
|
|
|
|
path =~ protected_paths_regex
|
|
|
|
end
|
|
|
|
|
|
|
|
private
|
|
|
|
|
2019-12-11 07:08:10 -05:00
|
|
|
def request_authenticator
|
|
|
|
@request_authenticator ||= Gitlab::Auth::RequestAuthenticator.new(self)
|
|
|
|
end
|
|
|
|
|
2019-09-26 17:06:29 -04:00
|
|
|
def protected_paths
|
|
|
|
Gitlab::CurrentSettings.current_application_settings.protected_paths
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_paths_regex
|
|
|
|
Regexp.union(protected_paths.map { |path| /\A#{Regexp.escape(path)}/ })
|
|
|
|
end
|
2017-09-15 13:31:32 -04:00
|
|
|
end
|
|
|
|
end
|
2019-09-13 09:26:31 -04:00
|
|
|
|
2020-05-12 11:10:33 -04:00
|
|
|
::Rack::Attack.extend_if_ee('::EE::Gitlab::Rack::Attack')
|
2019-09-13 09:26:31 -04:00
|
|
|
::Rack::Attack::Request.prepend_if_ee('::EE::Gitlab::Rack::Attack::Request')
|