White-list requests from 127.0.0.1

On some misconfigured GitLab servers, if you look in production.log it looks
like all requests come from 127.0.0.1. To avoid unwanted banning we
white-list 127.0.0.1 with this commit.

config/gitlab.yml.example

@@ -300,6 +300,9 @@ production: &base
 
   rack_attack:
     git_basic_auth:
+      # Whitelist requests from 127.0.0.1 for web proxies (NGINX/Apache) with incorrect headers
+      # ip_whitelist: ["127.0.0.1"]
+      #
       # Limit the number of Git HTTP authentication attempts per IP
       # maxretry: 10
       #

config/initializers/1_settings.rb

@@ -176,6 +176,7 @@ Settings['extra'] ||= Settingslogic.new({})
 #
 Settings['rack_attack'] ||= Settingslogic.new({})
 Settings.rack_attack['git_basic_auth'] ||= Settingslogic.new({})
+Settings.rack_attack.git_basic_auth['ip_whitelist'] ||= %w{127.0.0.1}
 Settings.rack_attack.git_basic_auth['maxretry'] ||= 10
 Settings.rack_attack.git_basic_auth['findtime'] ||= 1.minute
 Settings.rack_attack.git_basic_auth['bantime'] ||= 1.hour

lib/gitlab/backend/grack_auth.rb

@@ -80,10 +80,15 @@ module Grack
       # information is stored in the Rails cache (Redis) and will be used by
       # the Rack::Attack middleware to decide whether to block requests from
       # this IP.
-      Rack::Attack::Allow2Ban.filter(@request.ip, Gitlab.config.rack_attack.git_basic_auth) do
-        # Return true, so that Allow2Ban increments the counter (stored in
-        # Rails.cache) for the IP
-        true
+      config = Gitlab.config.rack_attack.git_basic_auth
+      Rack::Attack::Allow2Ban.filter(@request.ip, config) do
+        # Unless the IP is whitelisted, return true so that Allow2Ban
+        # increments the counter (stored in Rails.cache) for the IP
+        if config.ip_whitelist.include?(@request.ip)
+          false
+        else
+          true
+        end
       end
 
       nil # No user was found