2018-07-25 05:30:33 -04:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
2021-02-03 13:09:25 -05:00
|
|
|
# Backing store for GitLab session data.
|
|
|
|
#
|
|
|
|
# The raw session information is stored by the Rails session store
|
|
|
|
# (config/initializers/session_store.rb). These entries are accessible by the
|
2021-12-10 16:11:20 -05:00
|
|
|
# rack_key_name class method and constitute the base of the session data
|
2021-02-03 13:09:25 -05:00
|
|
|
# entries. All other entries in the session store can be traced back to these
|
|
|
|
# entries.
|
|
|
|
#
|
|
|
|
# After a user logs in (config/initializers/warden.rb) a further entry is made
|
|
|
|
# in Redis. This entry holds a record of the user's logged in session. These
|
|
|
|
# are accessible with the key_name(user_id, session_id) class method. These
|
|
|
|
# entries will expire. Lookups to these entries are lazilly cleaned on future
|
|
|
|
# user access.
|
|
|
|
#
|
|
|
|
# There is a reference to all sessions that belong to a specific user. A
|
|
|
|
# user may login through multiple browsers/devices and thus record multiple
|
|
|
|
# login sessions. These are accessible through the lookup_key_name(user_id)
|
|
|
|
# class method.
|
|
|
|
#
|
2018-05-02 04:08:16 -04:00
|
|
|
class ActiveSession
|
|
|
|
include ActiveModel::Model
|
|
|
|
|
2019-07-17 07:07:26 -04:00
|
|
|
SESSION_BATCH_SIZE = 200
|
2019-11-27 13:06:30 -05:00
|
|
|
ALLOWED_NUMBER_OF_ACTIVE_SESSIONS = 100
|
2019-07-17 07:07:26 -04:00
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
attr_accessor :ip_address, :browser, :os,
|
|
|
|
:device_name, :device_type,
|
|
|
|
:is_impersonated, :session_id, :session_private_id
|
|
|
|
|
|
|
|
attr_reader :created_at, :updated_at
|
|
|
|
|
|
|
|
def created_at=(time)
|
|
|
|
@created_at = time.is_a?(String) ? Time.zone.parse(time) : time
|
|
|
|
end
|
|
|
|
|
|
|
|
def updated_at=(time)
|
|
|
|
@updated_at = time.is_a?(String) ? Time.zone.parse(time) : time
|
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2020-10-01 14:10:20 -04:00
|
|
|
def current?(rack_session)
|
|
|
|
return false if session_private_id.nil? || rack_session.id.nil?
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2020-04-14 23:09:11 -04:00
|
|
|
# Rack v2.0.8+ added private_id, which uses the hash of the
|
|
|
|
# public_id to avoid timing attacks.
|
2020-10-01 14:10:20 -04:00
|
|
|
session_private_id == rack_session.id.private_id
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
def eql?(other)
|
|
|
|
other.is_a?(self.class) && id == other.id
|
|
|
|
end
|
|
|
|
alias_method :==, :eql?
|
|
|
|
|
|
|
|
def id
|
|
|
|
session_private_id.presence || session_id
|
|
|
|
end
|
|
|
|
|
|
|
|
def ids
|
|
|
|
[session_private_id, session_id].compact
|
|
|
|
end
|
|
|
|
|
2018-05-02 04:08:16 -04:00
|
|
|
def human_device_type
|
|
|
|
device_type&.titleize
|
|
|
|
end
|
|
|
|
|
|
|
|
def self.set(user, request)
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2020-10-01 14:10:20 -04:00
|
|
|
session_private_id = request.session.id.private_id
|
2018-05-02 04:08:16 -04:00
|
|
|
client = DeviceDetector.new(request.user_agent)
|
|
|
|
timestamp = Time.current
|
2021-12-10 16:11:20 -05:00
|
|
|
expiry = Settings.gitlab['session_expire_delay'] * 60
|
2018-05-02 04:08:16 -04:00
|
|
|
|
|
|
|
active_user_session = new(
|
2020-06-01 14:08:07 -04:00
|
|
|
ip_address: request.remote_ip,
|
2018-05-02 04:08:16 -04:00
|
|
|
browser: client.name,
|
|
|
|
os: client.os_name,
|
|
|
|
device_name: client.device_name,
|
|
|
|
device_type: client.device_type,
|
|
|
|
created_at: user.current_sign_in_at || timestamp,
|
|
|
|
updated_at: timestamp,
|
2020-10-01 14:10:20 -04:00
|
|
|
session_private_id: session_private_id,
|
2019-02-23 13:18:44 -05:00
|
|
|
is_impersonated: request.session[:impersonator_id].present?
|
2018-05-02 04:08:16 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
redis.pipelined do
|
|
|
|
redis.setex(
|
2020-10-01 14:10:20 -04:00
|
|
|
key_name(user.id, session_private_id),
|
2021-12-10 16:11:20 -05:00
|
|
|
expiry,
|
|
|
|
active_user_session.dump
|
|
|
|
)
|
|
|
|
|
|
|
|
# Deprecated legacy format - temporary to support mixed deployments
|
|
|
|
redis.setex(
|
|
|
|
key_name_v1(user.id, session_private_id),
|
|
|
|
expiry,
|
2018-05-02 04:08:16 -04:00
|
|
|
Marshal.dump(active_user_session)
|
|
|
|
)
|
|
|
|
|
|
|
|
redis.sadd(
|
|
|
|
lookup_key_name(user.id),
|
2020-10-01 14:10:20 -04:00
|
|
|
session_private_id
|
2018-05-02 04:08:16 -04:00
|
|
|
)
|
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
|
|
|
def self.list(user)
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2020-04-14 23:09:11 -04:00
|
|
|
cleaned_up_lookup_entries(redis, user).map do |raw_session|
|
|
|
|
load_raw_session(raw_session)
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-10-01 14:10:20 -04:00
|
|
|
def self.cleanup(user)
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2020-10-01 14:10:20 -04:00
|
|
|
clean_up_old_sessions(redis, user)
|
|
|
|
cleaned_up_lookup_entries(redis, user)
|
2019-11-27 13:06:30 -05:00
|
|
|
end
|
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2019-11-27 13:06:30 -05:00
|
|
|
def self.destroy_sessions(redis, user, session_ids)
|
2021-12-10 16:11:20 -05:00
|
|
|
return if session_ids.empty?
|
|
|
|
|
2020-10-01 14:10:20 -04:00
|
|
|
key_names = session_ids.map { |session_id| key_name(user.id, session_id) }
|
2021-12-10 16:11:20 -05:00
|
|
|
key_names += session_ids.map { |session_id| key_name_v1(user.id, session_id) }
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2020-10-01 14:10:20 -04:00
|
|
|
redis.srem(lookup_key_name(user.id), session_ids)
|
2020-06-24 17:08:46 -04:00
|
|
|
|
|
|
|
Gitlab::Instrumentation::RedisClusterValidator.allow_cross_slot_commands do
|
|
|
|
redis.del(key_names)
|
|
|
|
redis.del(rack_session_keys(session_ids))
|
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
|
2021-03-04 19:09:24 -05:00
|
|
|
def self.destroy_session(user, session_id)
|
2020-10-01 14:10:20 -04:00
|
|
|
return unless session_id
|
|
|
|
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2021-03-04 19:09:24 -05:00
|
|
|
destroy_sessions(redis, user, [session_id].compact)
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2020-10-01 14:10:20 -04:00
|
|
|
def self.destroy_all_but_current(user, current_rack_session)
|
|
|
|
sessions = not_impersonated(user)
|
|
|
|
sessions.reject! { |session| session.current?(current_rack_session) } if current_rack_session
|
2020-09-02 11:10:54 -04:00
|
|
|
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2021-12-10 16:11:20 -05:00
|
|
|
session_ids = sessions.flat_map(&:ids)
|
2020-10-01 14:10:20 -04:00
|
|
|
destroy_sessions(redis, user, session_ids) if session_ids.any?
|
2020-09-02 11:10:54 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.not_impersonated(user)
|
2020-09-02 11:10:54 -04:00
|
|
|
list(user).reject(&:is_impersonated)
|
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.rack_key_name(session_id)
|
2021-11-24 13:14:31 -05:00
|
|
|
"#{Gitlab::Redis::Sessions::SESSION_NAMESPACE}:#{session_id}"
|
2021-02-03 13:09:25 -05:00
|
|
|
end
|
|
|
|
|
2018-05-02 04:08:16 -04:00
|
|
|
def self.key_name(user_id, session_id = '*')
|
2021-12-10 16:11:20 -05:00
|
|
|
"#{Gitlab::Redis::Sessions::USER_SESSIONS_NAMESPACE}::v2:#{user_id}:#{session_id}"
|
|
|
|
end
|
|
|
|
|
|
|
|
# Deprecated
|
|
|
|
def self.key_name_v1(user_id, session_id = '*')
|
2021-11-24 13:14:31 -05:00
|
|
|
"#{Gitlab::Redis::Sessions::USER_SESSIONS_NAMESPACE}:#{user_id}:#{session_id}"
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
|
|
|
|
def self.lookup_key_name(user_id)
|
2021-11-24 13:14:31 -05:00
|
|
|
"#{Gitlab::Redis::Sessions::USER_SESSIONS_LOOKUP_NAMESPACE}:#{user_id}"
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
|
2019-05-14 04:01:49 -04:00
|
|
|
def self.list_sessions(user)
|
2019-07-12 08:25:12 -04:00
|
|
|
sessions_from_ids(session_ids_for_user(user.id))
|
2019-05-14 04:01:49 -04:00
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2020-04-14 23:09:11 -04:00
|
|
|
# Lists the relevant session IDs for the user.
|
|
|
|
#
|
2020-10-01 14:10:20 -04:00
|
|
|
# Returns an array of strings
|
2019-07-12 08:25:12 -04:00
|
|
|
def self.session_ids_for_user(user_id)
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2020-10-01 14:10:20 -04:00
|
|
|
redis.smembers(lookup_key_name(user_id))
|
2019-05-14 04:01:49 -04:00
|
|
|
end
|
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2020-04-30 08:09:45 -04:00
|
|
|
# Lists the session Hash objects for the given session IDs.
|
2020-04-14 23:09:11 -04:00
|
|
|
#
|
2020-10-01 14:10:20 -04:00
|
|
|
# session_ids - An array of strings
|
2020-04-14 23:09:11 -04:00
|
|
|
#
|
|
|
|
# Returns an array of ActiveSession objects
|
2019-05-14 04:01:49 -04:00
|
|
|
def self.sessions_from_ids(session_ids)
|
|
|
|
return [] if session_ids.empty?
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2022-01-13 01:14:35 -05:00
|
|
|
Gitlab::Redis::Sessions.with do |redis|
|
2020-04-14 23:09:11 -04:00
|
|
|
session_keys = rack_session_keys(session_ids)
|
2018-05-02 04:08:16 -04:00
|
|
|
|
2019-07-17 07:07:26 -04:00
|
|
|
session_keys.each_slice(SESSION_BATCH_SIZE).flat_map do |session_keys_batch|
|
2020-06-24 17:08:46 -04:00
|
|
|
Gitlab::Instrumentation::RedisClusterValidator.allow_cross_slot_commands do
|
|
|
|
redis.mget(session_keys_batch).compact.map do |raw_session|
|
|
|
|
load_raw_session(raw_session)
|
|
|
|
end
|
2019-07-17 07:07:26 -04:00
|
|
|
end
|
2019-05-14 04:01:49 -04:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
def dump
|
|
|
|
"v2:#{Gitlab::Json.dump(self)}"
|
|
|
|
end
|
|
|
|
|
|
|
|
# Private:
|
|
|
|
|
2020-04-14 23:09:11 -04:00
|
|
|
# raw_session - Raw bytes from Redis
|
|
|
|
#
|
2021-12-10 16:11:20 -05:00
|
|
|
# Returns an instance of this class
|
|
|
|
private_class_method def self.load_raw_session(raw_session)
|
|
|
|
return unless raw_session
|
|
|
|
|
|
|
|
if raw_session.start_with?('v2:')
|
|
|
|
session_data = Gitlab::Json.parse(raw_session[3..]).symbolize_keys
|
|
|
|
new(**session_data)
|
|
|
|
else
|
|
|
|
# Deprecated legacy format. To be removed in 15.0
|
|
|
|
# See: https://gitlab.com/gitlab-org/gitlab/-/issues/30516
|
|
|
|
# Explanation of why this Marshal.load call is OK:
|
|
|
|
# https://gitlab.com/gitlab-com/gl-security/appsec/appsec-reviews/-/issues/124#note_744576714
|
|
|
|
# rubocop:disable Security/MarshalLoad
|
|
|
|
Marshal.load(raw_session)
|
|
|
|
# rubocop:enable Security/MarshalLoad
|
|
|
|
end
|
2020-10-01 14:10:20 -04:00
|
|
|
end
|
2020-04-14 23:09:11 -04:00
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.rack_session_keys(rack_session_ids)
|
|
|
|
rack_session_ids.map { |session_id| rack_key_name(session_id) }
|
2020-04-14 23:09:11 -04:00
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.raw_active_session_entries(redis, session_ids, user_id)
|
|
|
|
return {} if session_ids.empty?
|
|
|
|
|
|
|
|
found = Gitlab::Instrumentation::RedisClusterValidator.allow_cross_slot_commands do
|
|
|
|
entry_keys = session_ids.map { |session_id| key_name(user_id, session_id) }
|
|
|
|
session_ids.zip(redis.mget(entry_keys)).to_h
|
|
|
|
end
|
2019-05-14 04:01:49 -04:00
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
found.compact!
|
|
|
|
missing = session_ids - found.keys
|
|
|
|
return found if missing.empty?
|
2019-11-27 13:06:30 -05:00
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
fallbacks = Gitlab::Instrumentation::RedisClusterValidator.allow_cross_slot_commands do
|
|
|
|
entry_keys = missing.map { |session_id| key_name_v1(user_id, session_id) }
|
|
|
|
missing.zip(redis.mget(entry_keys)).to_h
|
2020-06-24 17:08:46 -04:00
|
|
|
end
|
2021-12-10 16:11:20 -05:00
|
|
|
|
|
|
|
fallbacks.merge(found.compact)
|
2019-11-27 13:06:30 -05:00
|
|
|
end
|
2019-05-14 04:01:49 -04:00
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.active_session_entries(session_ids, user_id, redis)
|
2019-11-27 13:06:30 -05:00
|
|
|
return [] if session_ids.empty?
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
raw_active_session_entries(redis, session_ids, user_id)
|
|
|
|
.values
|
|
|
|
.compact
|
|
|
|
.map { load_raw_session(_1) }
|
2019-05-14 04:01:49 -04:00
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
private_class_method def self.clean_up_old_sessions(redis, user)
|
2019-11-27 13:06:30 -05:00
|
|
|
session_ids = session_ids_for_user(user.id)
|
|
|
|
|
|
|
|
return if session_ids.count <= ALLOWED_NUMBER_OF_ACTIVE_SESSIONS
|
|
|
|
|
|
|
|
sessions = active_session_entries(session_ids, user.id, redis)
|
2021-12-10 16:11:20 -05:00
|
|
|
sessions.sort_by!(&:updated_at).reverse!
|
|
|
|
|
|
|
|
# remove sessions if there are more than ALLOWED_NUMBER_OF_ACTIVE_SESSIONS.
|
|
|
|
destroyable_session_ids = sessions
|
|
|
|
.drop(ALLOWED_NUMBER_OF_ACTIVE_SESSIONS)
|
|
|
|
.flat_map(&:ids)
|
|
|
|
|
|
|
|
destroy_sessions(redis, user, destroyable_session_ids)
|
2019-11-27 13:06:30 -05:00
|
|
|
end
|
|
|
|
|
2020-04-14 23:09:11 -04:00
|
|
|
# Cleans up the lookup set by removing any session IDs that are no longer present.
|
|
|
|
#
|
|
|
|
# Returns an array of marshalled ActiveModel objects that are still active.
|
2021-12-10 16:11:20 -05:00
|
|
|
# Records removed keys in the optional `removed` argument array.
|
|
|
|
def self.cleaned_up_lookup_entries(redis, user, removed = [])
|
|
|
|
lookup_key = lookup_key_name(user.id)
|
2019-07-12 08:25:12 -04:00
|
|
|
session_ids = session_ids_for_user(user.id)
|
2021-12-10 16:11:20 -05:00
|
|
|
session_ids_and_entries = raw_active_session_entries(redis, session_ids, user.id)
|
2018-05-02 04:08:16 -04:00
|
|
|
|
|
|
|
# remove expired keys.
|
|
|
|
# only the single key entries are automatically expired by redis, the
|
|
|
|
# lookup entries in the set need to be removed manually.
|
2021-11-24 13:14:31 -05:00
|
|
|
redis.pipelined do |pipeline|
|
2021-12-10 16:11:20 -05:00
|
|
|
session_ids_and_entries.each do |session_id, entry|
|
|
|
|
next if entry
|
|
|
|
|
|
|
|
pipeline.srem(lookup_key, session_id)
|
|
|
|
removed << session_id
|
2019-08-07 05:32:05 -04:00
|
|
|
end
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
|
2021-12-10 16:11:20 -05:00
|
|
|
session_ids_and_entries.values.compact
|
2018-05-02 04:08:16 -04:00
|
|
|
end
|
|
|
|
end
|