summaryrefslogtreecommitdiff
path: root/internal/gitlabnet
Commit message (Collapse)AuthorAgeFilesLines
* Perform HTTP request to primary on Geo pushIgor Drozdov2023-03-034-7/+155
| | | | | | | | | Currently, we perform a request to Gitlab Rails that proxies the request to primary However, it causes timeouts on big pushes and consumes large amount of memory. We can perform an HTTP request directly from Gitlab Shell instead and stream the response to the user
* feat: make retryable http default clientSteve Azzopardi2023-01-301-1/+1
| | | | | | | | | | | | | | | | | | | | | | What --- Make the retryableHTTP client introduced in https://gitlab.com/gitlab-org/gitlab-shell/-/merge_requests/703 the default HTTP client. Why --- In https://gitlab.com/gitlab-com/gl-infra/production/-/issues/7979#note_1254964426 we've seen a 99% error reduction on `git` commands from `gitlab-shell` when the retryableHTTP client is used. This has been running in production for over 2 weeks in `us-east1-b` and 5 days fleet-wide so we should be confident that this client works as expected. Reference: https://gitlab.com/gitlab-com/gl-infra/production/-/issues/7979 Signed-off-by: Steve Azzopardi <sazzopardi@gitlab.com>
* Add support for the gssapi-with-mic auth methodMarin Hannache2023-01-234-8/+38
|
* Update Gitaly to v15Igor Drozdov2022-08-052-2/+2
| | | | | | | | | | | This commit also excludes gitlab-shell from dependencies: Gitaly specifies Gitlab Shell as a dependency as well in order to use gitlabnet client to perform API endpoints to Gitlab Rails. As a result, Gitlab Shell requires Gitaly -> Gitaly requires an older version of Gitlab Shell -> that version requires an older version of Gitlab Shell, etc. Let's use exclude to break the chain earlier
* Simplify 2FA Push auth processingIgor Drozdov2022-07-204-302/+220
| | | | Use a single channel to handle both Push Auth and OTP results
* Implement Push Auth support for 2FA verificationkmcknight2022-07-183-23/+177
| | | | | | | | | | | | | | | | | When `2fa_verify` command is executed: - A user is asked to enter OTP - A blocking call for push auth is performed Then: - If the push auth request fails, the user is still able to enter OTP - If OTP is invalid, the `2fa_verify` command ends the execution - If OTP is valid or push auth request succeeded, then the user is successfully authenticated - If 30 seconds passed while no OTP or Push have been provided, then the `2fa_verify` command ends the execution
* go: Bump major version to v14Patrick Steinhardt2022-07-0517-66/+66
| | | | | | | | | | | | | While gitlab-shell currently has a major version of v14, the module path it exposes is not using that major version like it is required by the Go standard. This makes it impossible for dependents to import gitlab-shell as a dependency without using a commit as version. Fix this by changing the module path of gitlab-shell to instead be `gitlab.com/gitlab-org/gitlab-shell/v14` and adjust all imports accordingly. Changelog: fixed
* Pass original IP from PROXY requests to internal API callsAlejandro Rodríguez2022-06-302-17/+17
|
* Merge branch 'sh-fix-remote-addr-handling' into 'main'Igor Drozdov2022-05-092-1/+89
|\ | | | | | | | | Fix check_ip argument when gitlab-sshd used with PROXY protocol See merge request gitlab-org/gitlab-shell!616
| * Fix check_ip argument when gitlab-sshd used with PROXY protocolStan Hu2022-05-092-1/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | When gitlab-sshd were used with the PROXY protocol, the `check_ip` argument passed to `/api/v4/internal/allowed` was the Go remote address, which is a host and port combination (e.g. 127.0.0.1:12345). As a result, This prevents IP restrictions from working properly on Rails. We fix this by stripping out the port if it is present. When OpenSSH is used, this is not an issue because the IP address is extracted from `SSH_CONNECTION`. Changelog: fixed
* | Always use Gitaly sidechannel connectionsJacob Vosmaer2022-05-022-40/+4
|/ | | | | | | Before this change, the GitLab internal API could use a boolean response field to indicate whether gitlab-shell should make sidechannel connections go Gitaly. We now ignore that response field and always use sidechannel connections.
* Support parsing `use_sidechannel` API response fieldJacob Vosmaer2022-01-252-4/+40
| | | | | | This field will act as a feature flag that controls whether gitlab-shell uses the old SSHUploadPack RPC or the new SSHUploadPackWithSidechannel.
* Refactor client response testsJacob Vosmaer2022-01-201-44/+40
| | | | | | | | | | This reduces coupling between tests in internal/gitlabnet/accessverifier/client_test.go, and will make it easier to add new test cases in the future. Note that the test server had a special behavior for the username "second", but this was never used. So we removed that behavior in this commit.
* refactor: move away from ioutil (deprecated)feistel2021-08-195-13/+15
|
* refactor: change httpclient to return an errorfeistel2021-08-131-1/+4
|
* Refactor testhelper.PrepareTestRootDir using t.CleanupIgor Drozdov2021-07-141-3/+1
|
* fix: upgrade of the gitaly dependencyPavlo Strokov2021-06-022-2/+2
| | | | | | | | | | | Gitaly project now properly respects module release flow and includes a module suffix in the package name. It requires to re-write all non-suffixed imports with suffixed of a specific version of tha module. With proper module versioning we don't need to use a 'replace' directive to point to specific commit and can use semantic versioning for the gitaly dependency. Part of: https://gitlab.com/gitlab-org/gitaly/-/issues/3177
* Respect parent context for Gitaly callsNick Thomas2021-05-051-3/+0
| | | | | | | | | Without these changes, Gitaly calls would not be linked to a parent context. This means that they would have an unassociated correlationID, and Gitaly RPC calls would not be cancel()ed by parent context cancellation. Changelog: fixed
* Fix thread-safety issues in gitlab-shell518-fix-thread-safetyNick Thomas2021-04-091-1/+1
|
* Replace cleanup functions with t.CleanupIgor Drozdov2021-03-178-71/+46
| | | | | In this case we don't need to propagate cleanup function. It simplifies the code.
* chore: Refactor env introspection to rely on command initialization496-move-env-introspection-to-sshenvLucas Charles2021-03-151-6/+1
| | | | | | | Refactors introspection of execution environment to rely on per-connection state (`gitlab-shell`) or per request (`gitlab-sshd`) Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/496
* RFC: Simple built-in SSH serverLorenz Brun2021-01-181-1/+5
|
* Add 2fa_verify commandImre Farkas2020-12-102-0/+244
|
* tests: Replace assert with requirezj-remove-testify-assertZeger-Jan van de Weg2020-10-153-25/+22
| | | | | | | | | Testify features sub packages `assert` and `require`. The difference is subtle, and lost on novice Golang developers that don't read the docs. To create a more consistent code base `assert` will no longer be used. This change was generated by a running a sed command on all `_test.go` files, followed by `goimports -w`.
* Make it possible to propagate correlation ID across processesStan Hu2020-09-2014-43/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, gitlab-shell did not pass a context through the application. Correlation IDs were generated down the call stack instead of passed around from the start execution. This has several potential downsides: 1. It's easier for programming mistakes to be made in future that lead to multiple correlation IDs being generated for a single request. 2. Correlation IDs cannot be passed in from upstream requests 3. Other advantages of context passing, such as distributed tracing is not possible. This commit changes the behavior: 1. Extract the correlation ID from the environment at the start of the application. 2. If no correlation ID exists, generate a random one. 3. Pass the correlation ID to the GitLabNet API requests. This change also enables other clients of GitLabNet (e.g. Gitaly) to pass along the correlation ID in the internal API requests (https://gitlab.com/gitlab-org/gitaly/-/issues/2725). Fixes https://gitlab.com/gitlab-org/gitlab-shell/-/issues/474
* Add support obtaining personal access tokens via SSHTaylan Develioglu2020-08-172-0/+270
| | | | | | | | | | | | | | | | | | | | | | | | Implements the feature requested in gitlab-org/gitlab#19672 This requires the internal api counterpart in gitlab-org/gitlab!36302 to be merged first. It can be used as follows: ``` censored@censored-VirtualBox:~/git/gitlab$ ssh git@gitlab-2004 personal_access_token remote: remote: ======================================================================== remote: remote: Usage: personal_access_token <name> <scope1[,scope2,...]> [ttl_days] remote: remote: ======================================================================== remote: censored@censored-VirtualBox:~/git/gitlab$ ssh git@gitlab-2004 personal_access_token newtoken read_api,read_repository 30 Token: aAY1G3YPeemECgUvxuXY Scopes: read_api,read_repository Expires: 2020-08-07 ```
* Generate and log correlation IDsStan Hu2020-07-311-0/+3
| | | | | This will make it easier to tie an SSH access request to Rails API and Gitaly requests.
* Log SSH key detailsStan Hu2020-07-231-0/+2
| | | | | | | | | | | | | | | | | | | | | Right now when a client such as gitlab-shell calls the `/api/v4/internal/allowed` API, the response only tells the client what user has been granted access, and it's impossible to tell which deploy key/token was used in the authentication request. This commit adds logs for the following when available: 1. `gl_key_type` (e.g. `deploy_key` or `key`) 2. `gl_key_id` These fields make it possible for admins to identify the exact record that was used to authenticate the user. API changes in the `/internal/allowed` endpoint in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/37289 are needed to support this. Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/203
* Ensure we are passing the parsed secretDJ Mountney2020-05-061-1/+1
| | | | | | | | Rather than the secret file. The parsing of the file was already done in the gitlab-shell config. This fixes an issue where a recent refactor of the gitlabnet client passed the wrong value.
* Move gitlabnet client to client packagejc-refactor-gitlabnet-clientJohn Cai2020-05-0418-778/+33
|
* Geo Pull custom action supportAsh McKenzie2020-04-171-1/+25
|
* Allow allowedPayloadPath to be providedAsh McKenzie2020-04-171-7/+11
|
* Rename Geo Push custom action testAsh McKenzie2020-04-171-1/+1
|
* Rename action to be more accurateAsh McKenzie2020-04-171-5/+5
|
* Rename allowed payload JSON for accuracyAsh McKenzie2020-04-171-1/+1
|
* Log internal HTTP requestsStan Hu2020-03-102-0/+41
| | | | | | | This restores the previous behavior of logging the success and failures of internal HTTP requests. Part of https://gitlab.com/gitlab-org/gitlab/issues/207916
* Remove support for Custom data.info_message210-remove-action-custom-inform_client-once-12-3-has-been-releasedAsh McKenzie2019-12-242-2/+0
|
* Use correct LFS download or upload operation namesAsh McKenzie2019-12-032-26/+44
|
* Merge branch 'pass-ff-to-gitaly' into 'master'Ash McKenzie2019-10-292-10/+19
| | | | | Add support for Gitaly feature flags See merge request gitlab-org/gitlab-shell!351
* Rename import pathsNick Thomas2019-10-1817-49/+49
|
* Move go code up one levelNick Thomas2019-10-1818-0/+1966
View Lorry Controller Status