nhyatt/bitwarden
1
0
Fork 0
mirror of https://github.com/bitwarden/server.git synced 2025-07-07 10:55:43 -05:00
Code Activity

[PM-6141] Remove rate limiting ip blocker (#3754)

Browse Source 
* remove rate limiting ip blocker

* remove using

* fix tests
This commit is contained in:
Kyle Spearrin
2024-02-07 12:23:26 -05:00
committed by GitHub
parent 6e6b50fd86
commit a019355ab4
15 changed files with 2 additions and 643 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/Core/Services/IBlockIpService.cs
View File

@ -1,6 +0,0 @@
namespace Bit.Core.Services;
public interface IBlockIpService
{
Task BlockIpAsync(string ipAddress, bool permanentBlock);
}

81
src/Core/Services/Implementations/AmazonSqsBlockIpService.cs
View File

@ -1,81 +0,0 @@
using Amazon;
using Amazon.SQS;
using Bit.Core.Settings;
namespace Bit.Core.Services;
public class AmazonSqsBlockIpService : IBlockIpService, IDisposable
{
private readonly IAmazonSQS _client;
private string _blockIpQueueUrl;
private string _unblockIpQueueUrl;
private bool _didInit = false;
private Tuple<string, bool, DateTime> _lastBlock;
public AmazonSqsBlockIpService(
GlobalSettings globalSettings)
: this(globalSettings, new AmazonSQSClient(
globalSettings.Amazon.AccessKeyId,
globalSettings.Amazon.AccessKeySecret,
RegionEndpoint.GetBySystemName(globalSettings.Amazon.Region))
)
{
}
public AmazonSqsBlockIpService(
GlobalSettings globalSettings,
IAmazonSQS amazonSqs)
{
if (string.IsNullOrWhiteSpace(globalSettings.Amazon?.AccessKeyId))
{
throw new ArgumentNullException(nameof(globalSettings.Amazon.AccessKeyId));
}
if (string.IsNullOrWhiteSpace(globalSettings.Amazon?.AccessKeySecret))
{
throw new ArgumentNullException(nameof(globalSettings.Amazon.AccessKeySecret));
}
if (string.IsNullOrWhiteSpace(globalSettings.Amazon?.Region))
{
throw new ArgumentNullException(nameof(globalSettings.Amazon.Region));
}
_client = amazonSqs;
}
public void Dispose()
{
_client?.Dispose();
}
public async Task BlockIpAsync(string ipAddress, bool permanentBlock)
{
var now = DateTime.UtcNow;
if (_lastBlock != null && _lastBlock.Item1 == ipAddress && _lastBlock.Item2 == permanentBlock &&
(now - _lastBlock.Item3) < TimeSpan.FromMinutes(1))
{
// Already blocked this IP recently.
return;
}
_lastBlock = new Tuple<string, bool, DateTime>(ipAddress, permanentBlock, now);
await _client.SendMessageAsync(_blockIpQueueUrl, ipAddress);
if (!permanentBlock)
{
await _client.SendMessageAsync(_unblockIpQueueUrl, ipAddress);
}
}
private async Task InitAsync()
{
if (_didInit)
{
return;
}
var blockIpQueue = await _client.GetQueueUrlAsync("block-ip");
_blockIpQueueUrl = blockIpQueue.QueueUrl;
var unblockIpQueue = await _client.GetQueueUrlAsync("unblock-ip");
_unblockIpQueueUrl = unblockIpQueue.QueueUrl;
_didInit = true;
}
}

36
src/Core/Services/Implementations/AzureQueueBlockIpService.cs
View File

@ -1,36 +0,0 @@
using Azure.Storage.Queues;
using Bit.Core.Settings;
namespace Bit.Core.Services;
public class AzureQueueBlockIpService : IBlockIpService
{
private readonly QueueClient _blockIpQueueClient;
private readonly QueueClient _unblockIpQueueClient;
private Tuple<string, bool, DateTime> _lastBlock;
public AzureQueueBlockIpService(
GlobalSettings globalSettings)
{
_blockIpQueueClient = new QueueClient(globalSettings.Storage.ConnectionString, "blockip");
_unblockIpQueueClient = new QueueClient(globalSettings.Storage.ConnectionString, "unblockip");
}
public async Task BlockIpAsync(string ipAddress, bool permanentBlock)
{
var now = DateTime.UtcNow;
if (_lastBlock != null && _lastBlock.Item1 == ipAddress && _lastBlock.Item2 == permanentBlock &&
(now - _lastBlock.Item3) < TimeSpan.FromMinutes(1))
{
// Already blocked this IP recently.
return;
}
_lastBlock = new Tuple<string, bool, DateTime>(ipAddress, permanentBlock, now);
await _blockIpQueueClient.SendMessageAsync(ipAddress);
if (!permanentBlock)
{
await _unblockIpQueueClient.SendMessageAsync(ipAddress, new TimeSpan(0, 15, 0));
}
}
}

10
src/Core/Services/NoopImplementations/NoopBlockIpService.cs
View File

@ -1,10 +0,0 @@
namespace Bit.Core.Services;
public class NoopBlockIpService : IBlockIpService
{
public Task BlockIpAsync(string ipAddress, bool permanentBlock)
{
// Do nothing
return Task.FromResult(0);
}
}

55
src/Core/Utilities/CustomIpRateLimitMiddleware.cs
View File

@ -1,8 +1,6 @@
using AspNetCoreRateLimit;
using Bit.Core.Models.Api;
using Bit.Core.Services;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Caching.Distributed;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;
@ -10,14 +8,9 @@ namespace Bit.Core.Utilities;
public class CustomIpRateLimitMiddleware : IpRateLimitMiddleware
{
private readonly IBlockIpService _blockIpService;
private readonly ILogger<CustomIpRateLimitMiddleware> _logger;
private readonly IDistributedCache _distributedCache;
private readonly IpRateLimitOptions _options;
public CustomIpRateLimitMiddleware(
IDistributedCache distributedCache,
IBlockIpService blockIpService,
RequestDelegate next,
IProcessingStrategy processingStrategy,
IRateLimitConfiguration rateLimitConfiguration,
@ -26,10 +19,7 @@ public class CustomIpRateLimitMiddleware : IpRateLimitMiddleware
ILogger<CustomIpRateLimitMiddleware> logger)
: base(next, processingStrategy, options, policyStore, rateLimitConfiguration, logger)
{
_distributedCache = distributedCache;
_blockIpService = blockIpService;
_options = options.Value;
_logger = logger;
}
public override Task ReturnQuotaExceededResponse(HttpContext httpContext, RateLimitRule rule, string retryAfter)
@ -42,49 +32,4 @@ public class CustomIpRateLimitMiddleware : IpRateLimitMiddleware
var errorModel = new ErrorResponseModel { Message = message };
return httpContext.Response.WriteAsJsonAsync(errorModel, httpContext.RequestAborted);
}
protected override void LogBlockedRequest(HttpContext httpContext, ClientRequestIdentity identity,
RateLimitCounter counter, RateLimitRule rule)
{
base.LogBlockedRequest(httpContext, identity, counter, rule);
var key = $"blockedIp_{identity.ClientIp}";
_distributedCache.TryGetValue(key, out int blockedCount);
blockedCount++;
if (blockedCount > 10)
{
_blockIpService.BlockIpAsync(identity.ClientIp, false);
_logger.LogInformation(Constants.BypassFiltersEventId, null,
"Banned {0}. \nInfo: \n{1}", identity.ClientIp, GetRequestInfo(httpContext));
}
else
{
_logger.LogInformation(Constants.BypassFiltersEventId, null,
"Request blocked {0}. \nInfo: \n{1}", identity.ClientIp, GetRequestInfo(httpContext));
_distributedCache.Set(key, blockedCount,
new DistributedCacheEntryOptions().SetSlidingExpiration(new TimeSpan(0, 5, 0)));
}
}
private string GetRequestInfo(HttpContext httpContext)
{
if (httpContext == null || httpContext.Request == null)
{
return null;
}
var s = string.Empty;
foreach (var header in httpContext.Request.Headers)
{
s += $"Header \"{header.Key}\": {header.Value} \n";
}
foreach (var query in httpContext.Request.Query)
{
s += $"Query \"{query.Key}\": {query.Value} \n";
}
return s;
}
}