From c8b2def2be44771ffb479ad989acc7eccf4012f8 Mon Sep 17 00:00:00 2001 From: Jacob Vosmaer Date: Thu, 18 Dec 2014 11:08:11 +0100 Subject: [PATCH] Add more comments explaining how we block IPs --- config/initializers/rack_attack_git_basic_auth.rb | 2 ++ lib/gitlab/backend/grack_auth.rb | 5 ++++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/config/initializers/rack_attack_git_basic_auth.rb b/config/initializers/rack_attack_git_basic_auth.rb index 2348768ff1..bbbfed6832 100644 --- a/config/initializers/rack_attack_git_basic_auth.rb +++ b/config/initializers/rack_attack_git_basic_auth.rb @@ -1,4 +1,6 @@ unless Rails.env.test? + # Tell the Rack::Attack Rack middleware to maintain an IP blacklist. We will + # update the blacklist from Grack::Auth#authenticate_user. Rack::Attack.blacklist('Git HTTP Basic Auth') do |req| Rack::Attack::Allow2Ban.filter(req.ip, Gitlab.config.rack_attack.git_basic_auth) do # This block only gets run if the IP was not already banned. diff --git a/lib/gitlab/backend/grack_auth.rb b/lib/gitlab/backend/grack_auth.rb index ab5d2ef3da..7bc745bf97 100644 --- a/lib/gitlab/backend/grack_auth.rb +++ b/lib/gitlab/backend/grack_auth.rb @@ -76,7 +76,10 @@ module Grack return user if user.present? # At this point, we know the credentials were wrong. We let Rack::Attack - # know there was a failed authentication attempt from this IP + # know there was a failed authentication attempt from this IP. This + # information is stored in the Rails cache (Redis) and will be used by + # the Rack::Attack middleware to decide whether to block requests from + # this IP. Rack::Attack::Allow2Ban.filter(@request.ip, Gitlab.config.rack_attack.git_basic_auth) do # Return true, so that Allow2Ban increments the counter (stored in # Rails.cache) for the IP