summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
...
| * | Introduce a GitLab-SSHD server version during handshakeHendrik Meyer2022-05-211-0/+1
|/ /
* | Merge branch 'id-set-supported-kex-algos' into 'main'Stan Hu2022-05-203-20/+23
|\ \ | | | | | | | | | | | | Narrow supported kex algorithms See merge request gitlab-org/gitlab-shell!638
| * | Narrow supported kex algorithmsIgor Drozdov2022-05-203-20/+23
|/ / | | | | | | | | | | We don't support diffie-hellman-group14-sha1 via OpenSSH currently Let's avoid introducing it in gitlab-sshd because it's using weak hashing algorithm
* | Merge branch 'sh-release-14.5.0' into 'main'v14.5.0Stan Hu2022-05-192-1/+5
|\ \ | | | | | | | | | | | | Release 14.5.0 See merge request gitlab-org/gitlab-shell!636
| * | Release 14.5.0Stan Hu2022-05-192-1/+5
|/ / | | | | | | - Make ProxyHeaderTimeout configurable !635
* | Merge branch 'id-fix-proxy-header-timeout' into 'main'Stan Hu2022-05-199-33/+84
|\ \ | | | | | | | | | | | | Make ProxyHeaderTimeout configurable See merge request gitlab-org/gitlab-shell!635
| * | Make ProxyHeaderTimeout configurableIgor Drozdov2022-05-195-8/+13
| | | | | | | | | | | | | | | | | | | | | | | | Issue: https://gitlab.com/gitlab-org/gitlab-shell/-/issues/576 ProxyHeaderTimeout must be small to avoid DoS risk Let's make the value configurable and 500ms by default
| * | Allow specifying formatted durations in configIgor Drozdov2022-05-197-31/+77
|/ / | | | | | | | | - If an integer is specified, we assume that these are seconds - A duration of format "500ms", "10s", "1m", etc... accepted
* | Merge branch 'id-release-14-4-0' into 'main'v14.4.0Igor Drozdov2022-05-182-1/+6
|\ \ | | | | | | | | | | | | Release 14.4.0 See merge request gitlab-org/gitlab-shell!634
| * | Release 14.4.0Igor Drozdov2022-05-192-1/+6
|/ / | | | | | | | | - Allow configuring SSH server algorithms !633 - Update gitlab-org/golang-crypto module version !632
* | Merge branch 'id-configure-algorithms' into 'main'Stan Hu2022-05-184-0/+92
|\ \ | | | | | | | | | | | | Allow configuring SSH server algorithms See merge request gitlab-org/gitlab-shell!633
| * | Allow configuring SSH server algorithmsIgor Drozdov2022-05-194-0/+92
|/ / | | | | | | | | MACs, Ciphers and KEX algorithms now can be configured If the values are empty, reasonable defaults are used
* | Merge branch 'sh-update-crypto-ver' into 'main'Igor Drozdov2022-05-182-3/+3
|\ \ | | | | | | | | | | | | Update gitlab-org/golang-crypto module version See merge request gitlab-org/gitlab-shell!632
| * | Update gitlab-org/golang-crypto module versionStan Hu2022-05-182-3/+3
|/ / | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This update pulls in: 1. https://gitlab.com/gitlab-org/golang-crypto/-/merge_requests/3, which syncs the module with upstream master and supports the new `curve25519-sha256@libssh.org` kex name. 2. https://gitlab.com/gitlab-org/golang-crypto/-/merge_requests/4, which adds: * MACs: hmac-sha2-512-etm@openssh.com, hmac-sha2-512 * Cipher: aes256-gcm@openssh.com Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/575
* | Merge branch 'id-release-14-3-1' into 'main'v14.3.1Igor Drozdov2022-05-182-1/+5
|\ \ | | | | | | | | | | | | Release v14.3.1 See merge request gitlab-org/gitlab-shell!631
| * | Release v14.3.1Igor Drozdov2022-05-182-1/+5
|/ / | | | | | | - Exclude API errors from error rate !630
* | Merge branch 'id-ignore-api-errors' into 'main'Stan Hu2022-05-183-4/+28
|\ \ | | | | | | | | | | | | Exclude API errors from error rate See merge request gitlab-org/gitlab-shell!630
| * | Exclude API errors from error rateIgor Drozdov2022-05-183-4/+28
| | | | | | | | | | | | | | | | | | When API isn't responsible or the resource is not accessible (returns 404 or 403), then we shouldn't consider it as an error on gitlab-sshd side
* | | Merge branch 'ds-store' into 'main'Igor Drozdov2022-05-181-0/+1
|\ \ \ | | | | | | | | | | | | | | | | Git ignore .DS_Store See merge request gitlab-org/gitlab-shell!629
| * | | Git ignore .DS_StoreSean Carroll2022-05-181-0/+1
|/ / /
* | | Merge branch '571-dependency-update-docker_version-20-10-15' into 'main'Igor Drozdov2022-05-171-1/+1
|\ \ \ | |/ / |/| | | | | | | | | | | | | | Resolve "Dependency update DOCKER_VERSION: 20.10.15" Closes #571 See merge request gitlab-org/gitlab-shell!628
| * | Resolve "Dependency update DOCKER_VERSION: 20.10.15"Costel Maxim2022-05-171-1/+1
|/ /
* | Merge branch 'id-release-14-3-0' into 'main'v14.3.0Igor Drozdov2022-05-172-1/+6
|\ \ | | | | | | | | | | | | Release v14.3.0 See merge request gitlab-org/gitlab-shell!627
| * | Release v14.3.0Igor Drozdov2022-05-172-1/+6
|/ / | | | | | | | | - Remove deprecated bundler-audit !626 - Wait until all Gitaly sessions are executed !624
* | Merge branch 'id-wait-until-gitaly-execution' into 'main'Patrick Bajao2022-05-177-65/+158
|\ \ | | | | | | | | | | | | Wait until all Gitaly sessions are executed See merge request gitlab-org/gitlab-shell!624
| * | Log canceled requests into separate metricsIgor Drozdov2022-05-174-2/+53
| | | | | | | | | | | | When a request get canceled we don't want to consider it an error
| * | Wait until all Gitaly sessions are executedIgor Drozdov2022-05-172-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If they haven't been executed within a timeout, we unblock the execution. Issue: https://gitlab.com/gitlab-org/gitlab-shell/-/issues/563 We have an issue when a lot of git clones operations get canceled. It was assumed that some clients close the connection just after all the data has been received from Git server. If there was a network delay and gitlab-sshd hadn't managed to gracefully close the connection, context get canceled and Gitaly cancels the execution and returns the error. Let's wait for a perion to allow Gitaly to gracefully complete the operation
| * | Return error from session handlerIgor Drozdov2022-05-165-63/+96
|/ /
* | Merge branch 'id-fix-ci-pipeline' into 'main'Igor Drozdov2022-05-161-3/+0
|\ \ | |/ |/| | | | | Remove deprecated bundler-audit See merge request gitlab-org/gitlab-shell!626
| * Remove deprecated bundler-auditIgor Drozdov2022-05-161-3/+0
|/ | | | | It's been removed in: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/86704
* Merge branch 'id-release-14-2-0' into 'main'v14.2.0Igor Drozdov2022-05-122-1/+6
|\ | | | | | | | | Release 14.2.0 See merge request gitlab-org/gitlab-shell!623
| * Release 14.2.0Igor Drozdov2022-05-122-1/+6
|/ | | | | - Implement ClientKeepAlive option - build: bump go-proxyproto to 0.6.2
* Merge branch 'id-implement-client-keep-alive' into 'main'Patrick Bajao2022-05-126-19/+97
|\ | | | | | | | | Implement ClientKeepAlive option See merge request gitlab-org/gitlab-shell!622
| * Implement ClientKeepAlive optionIgor Drozdov2022-05-126-19/+97
| | | | | | | | | | | | | | | | | | | | Git clients sometimes open a connection and leave it idling, like when compressing objects. Settings like timeout client in HAProxy might cause these idle connections to be terminated. Let's send the keepalive message in order to prevent a client from closing
* | Merge branch 'bump/goproxyproto-062' into 'main'Igor Drozdov2022-05-112-3/+3
|\ \ | |/ |/| | | | | build: bump go-proxyproto to 0.6.2 See merge request gitlab-org/gitlab-shell!610
| * build: bump go-proxyproto to 0.6.2feistel2022-05-062-3/+3
| |
* | Merge branch 'id-release-14-1-0' into 'main'v14.1.1Igor Drozdov2022-05-112-1/+5
|\ \ | | | | | | | | | | | | Release 14.1.1 See merge request gitlab-org/gitlab-shell!621
| * | Release 14.1.1Igor Drozdov2022-05-112-1/+5
|/ / | | | | | | - Log the error that happens on sconn.Wait() !613
* | Merge branch 'id-fix-flacky-test' into 'main'Patrick Bajao2022-05-111-2/+2
|\ \ | | | | | | | | | | | | Use require.WithinDuration to fix flaky test See merge request gitlab-org/gitlab-shell!617
| * | Use require.WithinDuration to fix flacky testIgor Drozdov2022-05-091-2/+2
| |/
* | Merge branch 'id-sync-sshd-sessions' into 'main'Patrick Bajao2022-05-111-0/+2
|\ \ | | | | | | | | | | | | Log the error that happens on sconn.Wait() See merge request gitlab-org/gitlab-shell!613
| * | Log the error that happens on sconn.Wait()Igor Drozdov2022-05-061-0/+2
| |/ | | | | | | | | | | | | Warning level is used because a non-nil error is logged even for successful scenarios We plan to use it for debug reasons
* | Merge branch 'sh-release-14.1.0' into 'main'v14.1.0Igor Drozdov2022-05-112-1/+9
|\ \ | | | | | | | | | | | | Release 14.1.0 See merge request gitlab-org/gitlab-shell!620
| * | Release 14.1.0Stan Hu2022-05-102-1/+9
|/ /
* | Merge branch 'id-make-proxy-policy-configurable' into 'main'Stan Hu2022-05-104-15/+113
|\ \ | | | | | | | | | | | | Make PROXY policy configurable See merge request gitlab-org/gitlab-shell!619
| * | Make PROXY policy configurableIgor Drozdov2022-05-104-15/+113
| | | | | | | | | | | | | | | It would give us more flexibility when we decide to enable PROXY protocol
* | | Merge branch 'id-improve-errors-metrics' into 'main'Stan Hu2022-05-102-15/+14
|\ \ \ | |/ / |/| | | | | | | | Exclude authentication errors from error rate See merge request gitlab-org/gitlab-shell!611
| * | Exclude authentication errors from apdexIgor Drozdov2022-05-102-15/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the time a connection fails due to the client's misconfiguration or when a client cancels a request, so we shouldn't treat them as an error Warnings will help us to track the errors whether they happened on the server-side
* | | Merge branch 'sh-fix-remote-addr-handling' into 'main'Igor Drozdov2022-05-092-1/+89
|\ \ \ | | | | | | | | | | | | | | | | Fix check_ip argument when gitlab-sshd used with PROXY protocol See merge request gitlab-org/gitlab-shell!616
| * | | Fix check_ip argument when gitlab-sshd used with PROXY protocolStan Hu2022-05-092-1/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When gitlab-sshd were used with the PROXY protocol, the `check_ip` argument passed to `/api/v4/internal/allowed` was the Go remote address, which is a host and port combination (e.g. 127.0.0.1:12345). As a result, This prevents IP restrictions from working properly on Rails. We fix this by stripping out the port if it is present. When OpenSSH is used, this is not an issue because the IP address is extracted from `SSH_CONNECTION`. Changelog: fixed
View Lorry Controller Status