2019-12-05 21:07:40 +00:00
# frozen_string_literal: true
module Gitlab
2022-01-21 15:13:54 +00:00
# This module implements a simple rate limiter that can be used to throttle
2019-12-05 21:07:40 +00:00
# certain actions. Unlike Rack Attack and Rack::Throttle, which operate at
# the middleware level, this can be used at the controller or API level.
2021-12-10 15:10:24 +00:00
# See CheckRateLimit concern for usage.
2022-01-21 15:13:54 +00:00
module ApplicationRateLimiter
2021-11-02 15:12:22 +00:00
InvalidKeyError = Class . new ( StandardError )
2019-12-05 21:07:40 +00:00
class << self
# Application rate limits
#
# Threshold value can be either an Integer or a Proc
# in order to not evaluate it's value every time this method is called
# and only do that when it's needed.
2022-02-08 18:16:03 +00:00
def rate_limits # rubocop:disable Metrics/AbcSize
2019-12-05 21:07:40 +00:00
{
2022-08-18 15:12:17 +00:00
issues_create : { threshold : - > { application_settings . issues_create_limit } , interval : 1 . minute } ,
notes_create : { threshold : - > { application_settings . notes_create_limit } , interval : 1 . minute } ,
project_export : { threshold : - > { application_settings . project_export_limit } , interval : 1 . minute } ,
project_download_export : { threshold : - > { application_settings . project_download_export_limit } , interval : 1 . minute } ,
2020-02-22 12:08:58 +00:00
project_repositories_archive : { threshold : 5 , interval : 1 . minute } ,
2022-08-18 15:12:17 +00:00
project_generate_new_export : { threshold : - > { application_settings . project_export_limit } , interval : 1 . minute } ,
project_import : { threshold : - > { application_settings . project_import_limit } , interval : 1 . minute } ,
project_testing_hook : { threshold : 5 , interval : 1 . minute } ,
play_pipeline_schedule : { threshold : 1 , interval : 1 . minute } ,
raw_blob : { threshold : - > { application_settings . raw_blob_request_limit } , interval : 1 . minute } ,
group_export : { threshold : - > { application_settings . group_export_limit } , interval : 1 . minute } ,
group_download_export : { threshold : - > { application_settings . group_download_export_limit } , interval : 1 . minute } ,
group_import : { threshold : - > { application_settings . group_import_limit } , interval : 1 . minute } ,
group_testing_hook : { threshold : 5 , interval : 1 . minute } ,
profile_add_new_email : { threshold : 5 , interval : 1 . minute } ,
web_hook_calls : { interval : 1 . minute } ,
web_hook_calls_mid : { interval : 1 . minute } ,
web_hook_calls_low : { interval : 1 . minute } ,
users_get_by_id : { threshold : - > { application_settings . users_get_by_id_limit } , interval : 10 . minutes } ,
username_exists : { threshold : 20 , interval : 1 . minute } ,
user_sign_up : { threshold : 20 , interval : 1 . minute } ,
user_sign_in : { threshold : 5 , interval : 10 . minutes } ,
profile_resend_email_confirmation : { threshold : 5 , interval : 1 . minute } ,
profile_update_username : { threshold : 10 , interval : 1 . minute } ,
update_environment_canary_ingress : { threshold : 1 , interval : 1 . minute } ,
auto_rollback_deployment : { threshold : 1 , interval : 3 . minutes } ,
search_rate_limit : { threshold : - > { application_settings . search_rate_limit } , interval : 1 . minute } ,
search_rate_limit_unauthenticated : { threshold : - > { application_settings . search_rate_limit_unauthenticated } , interval : 1 . minute } ,
gitlab_shell_operation : { threshold : 600 , interval : 1 . minute } ,
pipelines_create : { threshold : - > { application_settings . pipeline_limit_per_project_user_sha } , interval : 1 . minute } ,
2022-09-09 18:12:57 +00:00
temporary_email_failure : { threshold : 300 , interval : 1 . day } ,
permanent_email_failure : { threshold : 5 , interval : 1 . day } ,
2022-08-18 15:12:17 +00:00
project_testing_integration : { threshold : 5 , interval : 1 . minute } ,
email_verification : { threshold : 10 , interval : 10 . minutes } ,
2022-08-30 21:09:41 +00:00
email_verification_code_send : { threshold : 10 , interval : 1 . hour } ,
2022-09-14 18:12:48 +00:00
namespace_exists : { threshold : 20 , interval : 1 . minute } ,
fetch_google_ip_list : { threshold : 10 , interval : 1 . minute }
2019-12-05 21:07:40 +00:00
} . freeze
end
# Increments the given key and returns true if the action should
# be throttled.
#
# @param key [Symbol] Key attribute registered in `.rate_limits`
2022-06-27 15:09:33 +00:00
# @param scope [Array<ActiveRecord>] Array of ActiveRecord models, Strings
# or Symbols to scope throttling to a specific request (e.g. per user
# per project)
# @param resource [ActiveRecord] An ActiveRecord model to count an action
# for (e.g. limit unique project (resource) downloads (action) to five
# per user (scope))
# @param threshold [Integer] Optional threshold value to override default
# one registered in `.rate_limits`
2022-07-27 03:11:43 +00:00
# @param interval [Integer] Optional interval value to override default
# one registered in `.rate_limits`
2022-06-27 15:09:33 +00:00
# @param users_allowlist [Array<String>] Optional list of usernames to
# exclude from the limit. This param will only be functional if Scope
# includes a current user.
# @param peek [Boolean] Optional. When true the key will not be
# incremented but the current throttled state will be returned.
2019-12-05 21:07:40 +00:00
#
# @return [Boolean] Whether or not a request should be throttled
2022-07-27 03:11:43 +00:00
def throttled? ( key , scope : , resource : nil , threshold : nil , interval : nil , users_allowlist : nil , peek : false )
2021-11-02 15:12:22 +00:00
raise InvalidKeyError unless rate_limits [ key ]
2019-12-05 21:07:40 +00:00
2022-06-27 15:09:33 +00:00
strategy = resource . present? ? IncrementPerActionedResource . new ( resource . id ) : IncrementPerAction . new
2022-05-13 12:08:49 +00:00
:: Gitlab :: Instrumentation :: RateLimitingGates . track ( key )
2021-12-06 21:10:14 +00:00
return false if scoped_user_in_allowlist? ( scope , users_allowlist )
2019-12-05 21:07:40 +00:00
2021-12-06 21:10:14 +00:00
threshold_value = threshold || threshold ( key )
2019-12-05 21:07:40 +00:00
2021-12-06 21:10:14 +00:00
return false if threshold_value == 0
2021-11-03 18:13:40 +00:00
2022-07-27 03:11:43 +00:00
interval_value = interval || interval ( key )
2022-06-27 15:09:33 +00:00
return false if interval_value == 0
2021-12-06 21:10:14 +00:00
# `period_key` is based on the current time and interval so when time passes to the next interval
# the key changes and the rate limit count starts again from 0.
# Based on https://github.com/rack/rack-attack/blob/886ba3a18d13c6484cd511a4dc9b76c0d14e5e96/lib/rack/attack/cache.rb#L63-L68
2021-11-03 18:13:40 +00:00
period_key , time_elapsed_in_period = Time . now . to_i . divmod ( interval_value )
2021-12-06 21:10:14 +00:00
cache_key = cache_key ( key , scope , period_key )
2021-11-03 18:13:40 +00:00
2021-12-06 21:10:14 +00:00
value = if peek
2022-06-27 15:09:33 +00:00
strategy . read ( cache_key )
2021-12-06 21:10:14 +00:00
else
2022-06-27 15:09:33 +00:00
# We add a 1 second buffer to avoid timing issues when we're at the end of a period
expiry = interval_value - time_elapsed_in_period + 1
strategy . increment ( cache_key , expiry )
2021-12-06 21:10:14 +00:00
end
2021-11-03 18:13:40 +00:00
2021-12-06 21:10:14 +00:00
value > threshold_value
end
# Returns the current rate limited state without incrementing the count.
#
# @param key [Symbol] Key attribute registered in `.rate_limits`
# @param scope [Array<ActiveRecord>] Array of ActiveRecord models to scope throttling to a specific request (e.g. per user per project)
# @param threshold [Integer] Optional threshold value to override default one registered in `.rate_limits`
2022-07-27 03:11:43 +00:00
# @param interval [Integer] Optional interval value to override default one registered in `.rate_limits`
2021-12-06 21:10:14 +00:00
# @param users_allowlist [Array<String>] Optional list of usernames to exclude from the limit. This param will only be functional if Scope includes a current user.
#
# @return [Boolean] Whether or not a request is currently throttled
2022-07-27 03:11:43 +00:00
def peek ( key , scope : , threshold : nil , interval : nil , users_allowlist : nil )
throttled? ( key , peek : true , scope : scope , threshold : threshold , interval : interval , users_allowlist : users_allowlist )
2021-11-03 18:13:40 +00:00
end
2019-12-05 21:07:40 +00:00
# Logs request using provided logger
#
# @param request [Http::Request] - Web request to be logged
# @param type [Symbol] A symbol key that represents the request
# @param current_user [User] Current user of the request, it can be nil
# @param logger [Logger] Logger to log request to a specific log file. Defaults to Gitlab::AuthLogger
def log_request ( request , type , current_user , logger = Gitlab :: AuthLogger )
request_information = {
2022-08-18 15:12:17 +00:00
message : 'Application_Rate_Limiter_Request' ,
env : type ,
remote_ip : request . ip ,
2019-12-05 21:07:40 +00:00
request_method : request . request_method ,
2022-08-18 15:12:17 +00:00
path : request . fullpath
2019-12-05 21:07:40 +00:00
}
if current_user
request_information . merge! ( {
2022-08-18 15:12:17 +00:00
user_id : current_user . id ,
2019-12-05 21:07:40 +00:00
username : current_user . username
} )
end
logger . error ( request_information )
end
private
def threshold ( key )
value = rate_limit_value_by_key ( key , :threshold )
2022-06-27 15:09:33 +00:00
rate_limit_value ( value )
2019-12-05 21:07:40 +00:00
end
def interval ( key )
2022-06-27 15:09:33 +00:00
value = rate_limit_value_by_key ( key , :interval )
2019-12-05 21:07:40 +00:00
2022-06-27 15:09:33 +00:00
rate_limit_value ( value )
2019-12-05 21:07:40 +00:00
end
2022-06-27 15:09:33 +00:00
def rate_limit_value ( value )
value = value . call if value . is_a? ( Proc )
2021-12-06 21:10:14 +00:00
2022-06-27 15:09:33 +00:00
value . to_i
2021-12-06 21:10:14 +00:00
end
2022-06-27 15:09:33 +00:00
def rate_limit_value_by_key ( key , setting )
action = rate_limits [ key ]
action [ setting ] if action
2021-12-06 21:10:14 +00:00
end
def cache_key ( key , scope , period_key )
2019-12-05 21:07:40 +00:00
composed_key = [ key , scope ] . flatten . compact
serialized = composed_key . map do | obj |
if obj . is_a? ( String ) || obj . is_a? ( Symbol )
" #{ obj } "
else
" #{ obj . class . model_name . to_s . underscore } : #{ obj . id } "
end
end . join ( " : " )
2021-12-06 21:10:14 +00:00
" application_rate_limiter: #{ serialized } : #{ period_key } "
2019-12-05 21:07:40 +00:00
end
2020-07-07 15:08:49 +00:00
def application_settings
Gitlab :: CurrentSettings . current_application_settings
end
2021-02-11 12:08:52 +00:00
2021-12-06 21:10:14 +00:00
def scoped_user_in_allowlist? ( scope , users_allowlist )
return unless users_allowlist . present?
2021-02-11 12:08:52 +00:00
2021-12-06 21:10:14 +00:00
scoped_user = [ scope ] . flatten . find { | s | s . is_a? ( User ) }
2021-02-11 12:08:52 +00:00
return unless scoped_user
2021-12-06 21:10:14 +00:00
scoped_user . username . downcase . in? ( users_allowlist )
2021-02-11 12:08:52 +00:00
end
2019-12-05 21:07:40 +00:00
end
end
end
2022-06-01 18:09:44 +00:00
Gitlab :: ApplicationRateLimiter . prepend_mod