2020-11-18 18:09:08 +00:00
|
|
|
# frozen_string_literal: true
|
|
|
|
|
|
|
|
module Gitlab
|
|
|
|
module RackAttack
|
|
|
|
module Request
|
2022-02-03 15:12:41 +00:00
|
|
|
include ::Gitlab::Utils::StrongMemoize
|
|
|
|
|
2021-09-09 12:09:09 +00:00
|
|
|
FILES_PATH_REGEX = %r{^/api/v\d+/projects/[^/]+/repository/files/.+}.freeze
|
2021-09-28 12:11:10 +00:00
|
|
|
GROUP_PATH_REGEX = %r{^/api/v\d+/groups/[^/]+/?$}.freeze
|
2021-09-09 12:09:09 +00:00
|
|
|
|
2020-11-18 18:09:08 +00:00
|
|
|
def unauthenticated?
|
2022-05-03 00:08:25 +00:00
|
|
|
!(authenticated_identifier([:api, :rss, :ics]) || authenticated_runner_id)
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
2022-05-03 00:08:25 +00:00
|
|
|
def throttled_identifer(request_formats)
|
|
|
|
identifier = authenticated_identifier(request_formats)
|
|
|
|
return unless identifier
|
2020-12-07 21:10:08 +00:00
|
|
|
|
2022-05-03 00:08:25 +00:00
|
|
|
identifier_type = identifier[:identifier_type]
|
|
|
|
identifier_id = identifier[:identifier_id]
|
|
|
|
|
|
|
|
if identifier_type == :user && Gitlab::RackAttack.user_allowlist.include?(identifier_id)
|
2020-12-07 21:10:08 +00:00
|
|
|
Gitlab::Instrumentation::Throttle.safelist = 'throttle_user_allowlist'
|
|
|
|
return
|
|
|
|
end
|
|
|
|
|
2022-05-03 00:08:25 +00:00
|
|
|
"#{identifier_type}:#{identifier_id}"
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def authenticated_runner_id
|
|
|
|
request_authenticator.runner&.id
|
|
|
|
end
|
|
|
|
|
|
|
|
def api_request?
|
2022-02-07 09:12:13 +00:00
|
|
|
logical_path.start_with?('/api')
|
|
|
|
end
|
|
|
|
|
|
|
|
def logical_path
|
|
|
|
@logical_path ||= path.delete_prefix(Gitlab.config.gitlab.relative_url_root)
|
|
|
|
end
|
|
|
|
|
|
|
|
def matches?(regex)
|
|
|
|
logical_path.match?(regex)
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def api_internal_request?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(%r{^/api/v\d+/internal/})
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def health_check_request?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(%r{^/-/(health|liveness|readiness|metrics)})
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
2021-04-12 15:09:30 +00:00
|
|
|
def container_registry_event?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(%r{^/api/v\d+/container_registry_event/})
|
2021-04-12 15:09:30 +00:00
|
|
|
end
|
|
|
|
|
2020-11-18 18:09:08 +00:00
|
|
|
def product_analytics_collector_request?
|
2022-02-07 09:12:13 +00:00
|
|
|
logical_path.start_with?('/-/collector/i')
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def should_be_skipped?
|
2021-04-12 15:09:30 +00:00
|
|
|
api_internal_request? || health_check_request? || container_registry_event?
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
|
|
|
def web_request?
|
|
|
|
!api_request? && !health_check_request?
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_path?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(protected_paths_regex)
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
|
2021-09-17 15:11:44 +00:00
|
|
|
def throttle?(throttle, authenticated:)
|
|
|
|
fragment = Gitlab::Throttle.throttle_fragment!(throttle, authenticated: authenticated)
|
|
|
|
|
|
|
|
__send__("#{fragment}?") # rubocop:disable GitlabSecurity/PublicSend
|
|
|
|
end
|
|
|
|
|
2021-09-14 15:12:05 +00:00
|
|
|
def throttle_unauthenticated_api?
|
|
|
|
api_request? &&
|
2021-04-21 15:09:35 +00:00
|
|
|
!should_be_skipped? &&
|
2022-02-03 15:12:41 +00:00
|
|
|
!frontend_request? &&
|
2021-04-21 15:09:35 +00:00
|
|
|
!throttle_unauthenticated_packages_api? &&
|
2021-09-09 12:09:09 +00:00
|
|
|
!throttle_unauthenticated_files_api? &&
|
2021-09-28 12:11:10 +00:00
|
|
|
!throttle_unauthenticated_deprecated_api? &&
|
2021-09-14 15:12:05 +00:00
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_api_enabled &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_unauthenticated_web?
|
2022-02-03 15:12:41 +00:00
|
|
|
(web_request? || frontend_request?) &&
|
2021-09-14 15:12:05 +00:00
|
|
|
!should_be_skipped? &&
|
|
|
|
# TODO: Column will be renamed in https://gitlab.com/gitlab-org/gitlab/-/issues/340031
|
2021-04-21 15:09:35 +00:00
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_enabled &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_api?
|
|
|
|
api_request? &&
|
2022-02-03 15:12:41 +00:00
|
|
|
!frontend_request? &&
|
2021-04-21 15:09:35 +00:00
|
|
|
!throttle_authenticated_packages_api? &&
|
2021-09-09 12:09:09 +00:00
|
|
|
!throttle_authenticated_files_api? &&
|
2021-09-28 12:11:10 +00:00
|
|
|
!throttle_authenticated_deprecated_api? &&
|
2021-04-21 15:09:35 +00:00
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_api_enabled
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_web?
|
2022-02-03 15:12:41 +00:00
|
|
|
(web_request? || frontend_request?) &&
|
2021-09-01 18:08:49 +00:00
|
|
|
!throttle_authenticated_git_lfs? &&
|
2021-04-21 15:09:35 +00:00
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_web_enabled
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_unauthenticated_protected_paths?
|
|
|
|
post? &&
|
|
|
|
!should_be_skipped? &&
|
|
|
|
protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled? &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_protected_paths_api?
|
|
|
|
post? &&
|
|
|
|
api_request? &&
|
|
|
|
protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_protected_paths_web?
|
|
|
|
post? &&
|
|
|
|
web_request? &&
|
|
|
|
protected_path? &&
|
|
|
|
Gitlab::Throttle.protected_paths_enabled?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_unauthenticated_packages_api?
|
|
|
|
packages_api_path? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_packages_api_enabled &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_packages_api?
|
|
|
|
packages_api_path? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_packages_api_enabled
|
|
|
|
end
|
|
|
|
|
2021-09-01 18:08:49 +00:00
|
|
|
def throttle_authenticated_git_lfs?
|
|
|
|
git_lfs_path? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_git_lfs_enabled
|
|
|
|
end
|
|
|
|
|
2021-09-09 12:09:09 +00:00
|
|
|
def throttle_unauthenticated_files_api?
|
|
|
|
files_api_path? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_files_api_enabled &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_files_api?
|
|
|
|
files_api_path? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_files_api_enabled
|
|
|
|
end
|
|
|
|
|
2021-09-28 12:11:10 +00:00
|
|
|
def throttle_unauthenticated_deprecated_api?
|
|
|
|
deprecated_api_request? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_unauthenticated_deprecated_api_enabled &&
|
|
|
|
unauthenticated?
|
|
|
|
end
|
|
|
|
|
|
|
|
def throttle_authenticated_deprecated_api?
|
|
|
|
deprecated_api_request? &&
|
|
|
|
Gitlab::Throttle.settings.throttle_authenticated_deprecated_api_enabled
|
|
|
|
end
|
|
|
|
|
2020-11-18 18:09:08 +00:00
|
|
|
private
|
|
|
|
|
2022-05-03 00:08:25 +00:00
|
|
|
def authenticated_identifier(request_formats)
|
|
|
|
requester = request_authenticator.find_authenticated_requester(request_formats)
|
|
|
|
|
|
|
|
return unless requester
|
|
|
|
|
|
|
|
identifier_type = if requester.is_a?(DeployToken)
|
|
|
|
:deploy_token
|
|
|
|
else
|
|
|
|
:user
|
|
|
|
end
|
|
|
|
|
|
|
|
{ identifier_type: identifier_type, identifier_id: requester.id }
|
2020-12-07 21:10:08 +00:00
|
|
|
end
|
|
|
|
|
2020-11-18 18:09:08 +00:00
|
|
|
def request_authenticator
|
|
|
|
@request_authenticator ||= Gitlab::Auth::RequestAuthenticator.new(self)
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_paths
|
|
|
|
Gitlab::CurrentSettings.current_application_settings.protected_paths
|
|
|
|
end
|
|
|
|
|
|
|
|
def protected_paths_regex
|
|
|
|
Regexp.union(protected_paths.map { |path| /\A#{Regexp.escape(path)}/ })
|
|
|
|
end
|
2021-04-21 15:09:35 +00:00
|
|
|
|
|
|
|
def packages_api_path?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(::Gitlab::Regex::Packages::API_PATH_REGEX)
|
2021-04-21 15:09:35 +00:00
|
|
|
end
|
2021-09-01 18:08:49 +00:00
|
|
|
|
|
|
|
def git_lfs_path?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(::Gitlab::PathRegex.repository_git_lfs_route_regex)
|
2021-09-01 18:08:49 +00:00
|
|
|
end
|
2021-09-09 12:09:09 +00:00
|
|
|
|
|
|
|
def files_api_path?
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(FILES_PATH_REGEX)
|
2021-09-09 12:09:09 +00:00
|
|
|
end
|
2021-09-28 12:11:10 +00:00
|
|
|
|
2022-02-03 15:12:41 +00:00
|
|
|
def frontend_request?
|
|
|
|
strong_memoize(:frontend_request) do
|
|
|
|
next false unless env.include?('HTTP_X_CSRF_TOKEN') && session.include?(:_csrf_token)
|
|
|
|
|
|
|
|
# CSRF tokens are not verified for GET/HEAD requests, so we pretend that we always have a POST request.
|
|
|
|
Gitlab::RequestForgeryProtection.verified?(env.merge('REQUEST_METHOD' => 'POST'))
|
|
|
|
end
|
|
|
|
end
|
|
|
|
|
2021-09-28 12:11:10 +00:00
|
|
|
def deprecated_api_request?
|
|
|
|
# The projects member of the groups endpoint is deprecated. If left
|
|
|
|
# unspecified, with_projects defaults to true
|
|
|
|
with_projects = params['with_projects']
|
|
|
|
with_projects = true if with_projects.blank?
|
|
|
|
|
2022-02-07 09:12:13 +00:00
|
|
|
matches?(GROUP_PATH_REGEX) && Gitlab::Utils.to_boolean(with_projects)
|
2021-09-28 12:11:10 +00:00
|
|
|
end
|
2020-11-18 18:09:08 +00:00
|
|
|
end
|
|
|
|
end
|
|
|
|
end
|
2021-05-11 21:10:21 +00:00
|
|
|
::Gitlab::RackAttack::Request.prepend_mod_with('Gitlab::RackAttack::Request')
|