Block Git HTTP Basic Auth after 10 failed attempts

CHANGELOG

+v 7.7.0
+  - Block Git HTTP access after 10 failed authentication attempts
+
 v 7.6.0
   - Fork repository to groups
   - New rugged version

config/gitlab.yml.example

@@ -298,6 +298,17 @@ production: &base
     #   ![Company Logo](http://www.companydomain.com/logo.png)
     #   [Learn more about CompanyName](http://www.companydomain.com/)
 
+  rack_attack:
+    git_basic_auth:
+      # Limit the number of Git HTTP authentication attempts per IP
+      # maxretry: 10
+      #
+      # Reset the auth attempt counter per IP after 60 seconds
+      # findtime: 60
+      #
+      # Ban an IP for one hour (3600s) after too many auth attempts
+      # bantime: 3600
+
 development:
   <<: *base
 

config/initializers/1_settings.rb

@@ -172,6 +172,15 @@ Settings.satellites['timeout'] ||= 30
 Settings['extra'] ||= Settingslogic.new({})
 
 #
+# Rack::Attack settings
+#
+Settings['rack_attack'] ||= Settingslogic.new({})
+Settings.rack_attack['git_basic_auth'] ||= Settingslogic.new({})
+Settings.rack_attack.git_basic_auth['maxretry'] ||= 10
+Settings.rack_attack.git_basic_auth['findtime'] ||= 1.minute
+Settings.rack_attack.git_basic_auth['bantime'] ||= 1.hour
+
+#
 # Testing settings
 #
 if Rails.env.test?

config/initializers/rack_attack_git_basic_auth.rb

+unless Rails.env.test?
+  Rack::Attack.blacklist('Git HTTP Basic Auth') do |req|
+    Rack::Attack::Allow2Ban.filter(req.ip, Gitlab.config.rack_attack.git_basic_auth) do
+      # This block only gets run if the IP was not already banned.
+      # Return false, meaning that we do not see anything wrong with the
+      # request at this time
+      false
+    end
+  end
+end

config/initializers/redis-store-fix-expiry.rb

+# Monkey-patch Redis::Store to make 'setex' and 'expire' work with namespacing
+
+module Gitlab
+  class Redis
+    class Store
+      module Namespace
+        def setex(key, expires_in, value, options=nil)
+          namespace(key) { |key| super(key, expires_in, value) }
+        end
+
+        def expire(key, expires_in)
+          namespace(key) { |key| super(key, expires_in) }
+        end
+      end
+    end
+  end
+end
+
+Redis::Store.class_eval do
+  include Gitlab::Redis::Store::Namespace
+end

lib/gitlab/backend/grack_auth.rb

@@ -72,8 +72,18 @@ module Grack
     end
 
     def authenticate_user(login, password)
-      auth = Gitlab::Auth.new
-      auth.find(login, password)
+      user = Gitlab::Auth.new.find(login, password)
+      return user if user.present?
+
+      # At this point, we know the credentials were wrong. We let Rack::Attack
+      # know there was a failed authentication attempt from this IP
+      Rack::Attack::Allow2Ban.filter(@request.ip, Gitlab.config.rack_attack.git_basic_auth) do
+        # Return true, so that Allow2Ban increments the counter (stored in
+        # Rails.cache) for the IP
+        true
+      end
+
+      nil # No user was found
     end
 
     def authorized_request?