Count v2 auth error return paths

2 files changed, 35 insertions, 3 deletions

diff --git a/auth/token.go b/auth/token.go
index 6eb62e6d9..9355750aa 100644
--- a/auth/token.go
+++ b/auth/token.go
@@ -12,6 +12,7 @@ import (
 	"time"
 
 	grpc_auth "github.com/grpc-ecosystem/go-grpc-middleware/auth"
+	"github.com/prometheus/client_golang/prometheus"
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/status"
 )
@@ -23,8 +24,20 @@ const (
 var (
 	errUnauthenticated = status.Errorf(codes.Unauthenticated, "authentication required")
 	errDenied          = status.Errorf(codes.PermissionDenied, "permission denied")
+
+	authErrors = prometheus.NewCounterVec(
+		prometheus.CounterOpts{
+			Name: "gitaly_authentication_errors_total",
+			Help: "Counts of of Gitaly request authentication errors",
+		},
+		[]string{"version", "error"},
+	)
 )
 
+func init() {
+	prometheus.MustRegister(authErrors)
+}
+
 // AuthInfo contains the authentication information coming from a request
 type AuthInfo struct {
 	Version       string
@@ -56,7 +69,7 @@ func CheckToken(ctx context.Context, secret string, targetTime time.Time) error
 			return nil
 		}
 	case "v2":
-		if hmacInfoValid(authInfo.Message, authInfo.SignedMessage, []byte(secret), targetTime, timestampThreshold) {
+		if v2HmacInfoValid(authInfo.Message, authInfo.SignedMessage, []byte(secret), targetTime, timestampThreshold) {
 			return nil
 		}
 	}
@@ -93,14 +106,18 @@ func ExtractAuthInfo(ctx context.Context) (*AuthInfo, error) {
 	return &AuthInfo{Version: version, SignedMessage: decodedSig, Message: msg}, nil
 }
 
-func hmacInfoValid(message string, signedMessage, secret []byte, targetTime time.Time, timestampThreshold time.Duration) bool {
+func countV2Error(message string) { authErrors.WithLabelValues("v2", message).Inc() }
+
+func v2HmacInfoValid(message string, signedMessage, secret []byte, targetTime time.Time, timestampThreshold time.Duration) bool {
 	expectedHMAC := hmacSign(secret, message)
 	if !hmac.Equal(signedMessage, expectedHMAC) {
+		countV2Error("wrong hmac signature")
 		return false
 	}
 
 	timestamp, err := strconv.ParseInt(message, 10, 64)
 	if err != nil {
+		countV2Error("cannot parse timestamp")
 		return false
 	}
 
@@ -108,7 +125,17 @@ func hmacInfoValid(message string, signedMessage, secret []byte, targetTime time
 	lowerBound := targetTime.Add(-timestampThreshold)
 	upperBound := targetTime.Add(timestampThreshold)
 
-	return issuedAt.After(lowerBound) && issuedAt.Before(upperBound)
+	if issuedAt.Before(lowerBound) {
+		countV2Error("timestamp too old")
+		return false
+	}
+
+	if issuedAt.After(upperBound) {
+		countV2Error("timestamp too new")
+		return false
+	}
+
+	return true
 }
 
 func hmacSign(secret []byte, message string) []byte {
diff --git a/changelogs/unreleased/jv-count-hmac-errors.yml b/changelogs/unreleased/jv-count-hmac-errors.yml
new file mode 100644
index 000000000..59968b324
--- /dev/null
+++ b/changelogs/unreleased/jv-count-hmac-errors.yml
@@ -0,0 +1,5 @@
+---
+title: Count v2 auth error return paths
+merge_request: 1568
+author:
+type: other