summaryrefslogtreecommitdiff
path: root/internal
Commit message (Collapse)AuthorAgeFilesLines
* reference kex and mac algo constantsmarshall_algo-constsMarshall Cottrell2022-05-232-14/+14
| | | | Depends on gitlab-org/golang-crypto!5
* Close the connection when context is canceledIgor Drozdov2022-05-232-6/+43
| | | | | | | | | | | When graceful shutdown timeout expires, the global context is canceled. All the operations dependent on it are canceled as well. Unfortunately, some of the operations doesn't respect the context. For example, SSH connection initialization. In this case, we need to manually close the connection. One of the options is to wait for ctx.Done() and close the connection
* Move connection init into connection.goIgor Drozdov2022-05-233-69/+78
|
* Return support for diffie-hellman-group14-sha1Igor Drozdov2022-05-231-0/+1
| | | | | It seems that a lot of users rely on this, let's return it and deprecated later to make the migration less disruptive
* Downgrade auth EOF messages from warning to debugIgor Drozdov2022-05-211-1/+1
| | | | | The errors happen when a client closes a connection on handshake They can be ignored to avoid noise
* Exclude Gitaly unavailable error from error rateIgor Drozdov2022-05-214-24/+26
| | | | | | | When a user hits repository rate limit, Gitaly returns an error that the request can't be handled (Gitaly unavailable) We should avoid this error to avoid exceeding the error rate
* Display constistently in gitlab-sshd and gitlab-shellIgor Drozdov2022-05-214-18/+31
| | | | | - Use console package to format the errors in gitlab-sshd - Suppress internal Gitaly errors in client output
* Merge branch 'sh-downgrade-host-key-errors' into 'main'Igor Drozdov2022-05-211-2/+15
|\ | | | | | | | | Downgrade host key mismatch messages from warning to debug See merge request gitlab-org/gitlab-shell!639
| * Downgrade handleConn start message to debugStan Hu2022-05-201-1/+1
| | | | | | | | This message doesn't provide that much value, so let's just drop it.
| * Downgrade host key mismatch messages from warning to debugStan Hu2022-05-201-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In production, we often see SSH key scans requesting host key algorithms that we don't support, such as `sk-ssh-ed25519@openssh.com` or `sk-ecdsa-sha2-nistp256@openssh.com`. These messages might be useful if someone forgets to configure a host key that should be supported, but most of the time they are noise. This commit downgrades these messages to DEBUG. Relates to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/581 Changelog: changed
* | Introduce a GitLab-SSHD server version during handshakeHendrik Meyer2022-05-211-0/+1
|/
* Narrow supported kex algorithmsIgor Drozdov2022-05-202-19/+22
| | | | | | We don't support diffie-hellman-group14-sha1 via OpenSSH currently Let's avoid introducing it in gitlab-sshd because it's using weak hashing algorithm
* Make ProxyHeaderTimeout configurableIgor Drozdov2022-05-194-8/+11
| | | | | | | | Issue: https://gitlab.com/gitlab-org/gitlab-shell/-/issues/576 ProxyHeaderTimeout must be small to avoid DoS risk Let's make the value configurable and 500ms by default
* Allow specifying formatted durations in configIgor Drozdov2022-05-196-29/+74
| | | | | - If an integer is specified, we assume that these are seconds - A duration of format "500ms", "10s", "1m", etc... accepted
* Allow configuring SSH server algorithmsIgor Drozdov2022-05-193-0/+86
| | | | | MACs, Ciphers and KEX algorithms now can be configured If the values are empty, reasonable defaults are used
* Exclude API errors from error rateIgor Drozdov2022-05-182-1/+17
| | | | | | When API isn't responsible or the resource is not accessible (returns 404 or 403), then we shouldn't consider it as an error on gitlab-sshd side
* Log canceled requests into separate metricsIgor Drozdov2022-05-174-2/+53
| | | | When a request get canceled we don't want to consider it an error
* Wait until all Gitaly sessions are executedIgor Drozdov2022-05-172-6/+15
| | | | | | | | | | | | | | | | | If they haven't been executed within a timeout, we unblock the execution. Issue: https://gitlab.com/gitlab-org/gitlab-shell/-/issues/563 We have an issue when a lot of git clones operations get canceled. It was assumed that some clients close the connection just after all the data has been received from Git server. If there was a network delay and gitlab-sshd hadn't managed to gracefully close the connection, context get canceled and Gitaly cancels the execution and returns the error. Let's wait for a perion to allow Gitaly to gracefully complete the operation
* Return error from session handlerIgor Drozdov2022-05-165-63/+96
|
* Implement ClientKeepAlive optionIgor Drozdov2022-05-125-19/+95
| | | | | | | | | | Git clients sometimes open a connection and leave it idling, like when compressing objects. Settings like timeout client in HAProxy might cause these idle connections to be terminated. Let's send the keepalive message in order to prevent a client from closing
* Merge branch 'id-sync-sshd-sessions' into 'main'Patrick Bajao2022-05-111-0/+2
|\ | | | | | | | | Log the error that happens on sconn.Wait() See merge request gitlab-org/gitlab-shell!613
| * Log the error that happens on sconn.Wait()Igor Drozdov2022-05-061-0/+2
| | | | | | | | | | | | | | Warning level is used because a non-nil error is logged even for successful scenarios We plan to use it for debug reasons
* | Merge branch 'id-make-proxy-policy-configurable' into 'main'Stan Hu2022-05-103-15/+110
|\ \ | | | | | | | | | | | | Make PROXY policy configurable See merge request gitlab-org/gitlab-shell!619
| * | Make PROXY policy configurableIgor Drozdov2022-05-103-15/+110
| | | | | | | | | | | | | | | It would give us more flexibility when we decide to enable PROXY protocol
* | | Merge branch 'id-improve-errors-metrics' into 'main'Stan Hu2022-05-102-15/+14
|\ \ \ | |/ / |/| | | | | | | | Exclude authentication errors from error rate See merge request gitlab-org/gitlab-shell!611
| * | Exclude authentication errors from apdexIgor Drozdov2022-05-102-15/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | Most of the time a connection fails due to the client's misconfiguration or when a client cancels a request, so we shouldn't treat them as an error Warnings will help us to track the errors whether they happened on the server-side
* | | Merge branch 'sh-fix-remote-addr-handling' into 'main'Igor Drozdov2022-05-092-1/+89
|\ \ \ | |_|/ |/| | | | | | | | Fix check_ip argument when gitlab-sshd used with PROXY protocol See merge request gitlab-org/gitlab-shell!616
| * | Fix check_ip argument when gitlab-sshd used with PROXY protocolStan Hu2022-05-092-1/+89
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When gitlab-sshd were used with the PROXY protocol, the `check_ip` argument passed to `/api/v4/internal/allowed` was the Go remote address, which is a host and port combination (e.g. 127.0.0.1:12345). As a result, This prevents IP restrictions from working properly on Rails. We fix this by stripping out the port if it is present. When OpenSSH is used, this is not an issue because the IP address is extracted from `SSH_CONNECTION`. Changelog: fixed
* | | Use labkit for FIPS checkIgor Drozdov2022-05-052-32/+0
| |/ |/| | | | | | | New version of LabKit provides FIPS checks that we can use instead of the custom code
* | Always use Gitaly sidechannel connectionsJacob Vosmaer2022-05-0212-175/+41
| | | | | | | | | | | | | | Before this change, the GitLab internal API could use a boolean response field to indicate whether gitlab-shell should make sidechannel connections go Gitaly. We now ignore that response field and always use sidechannel connections.
* | Merge branch '541_remove_self_signed_cert_option' into 'main'Igor Drozdov2022-04-261-2/+0
|\ \ | | | | | | | | | | | | Remove `self_signed_cert` option See merge request gitlab-org/gitlab-shell!602
| * | Remove `self_signed_cert` optionVasilii Iakliushin2022-04-221-2/+0
| | | | | | | | | | | | | | | | | | Contributes to https://gitlab.com/gitlab-org/gitlab-shell/-/issues/541 Changelog: removed
* | | Merge branch 'feat/status-rwmutex' into 'main'Igor Drozdov2022-04-261-3/+3
|\ \ \ | | | | | | | | | | | | | | | | feat: replace status mutex with RWMutex See merge request gitlab-org/gitlab-shell!604
| * | | feat: replace status mutex with RWMutexfeistel2022-04-221-3/+3
| |/ /
* | | Revert "Abort long-running unauthenticated SSH connections"Igor Drozdov2022-04-253-51/+1
|/ / | | | | | | This reverts commit 3a2c8f2c47774a35d840ec8baf54341beede5d43.
* | Fix typo in FIPS mode messageStan Hu2022-04-191-1/+1
|/ | | | Rename Gitaly -> gitlab-shell
* Add support for FIPS encryptionStan Hu2022-04-182-0/+32
| | | | | | | | | | | | | | This commit adds support of using a FIPS-validated SSL library with compiled Go executables when `FIPS_MODE=1 make` is run. A Go compiler that supports BoringSSL either directly (e.g. the `dev.boringcrypto` branch) or with a dynamically linked OpenSSL (e.g. https://github.com/golang-fips/go) is required. This is similar to the changes to support FIPS in GitLab Runner and in GitLab Pages: https://gitlab.com/gitlab-org/gitlab-pages/-/merge_requests/716 Changelog: added
* Add additional metrics to gitlab-sshdIgor Drozdov2022-04-136-26/+78
| | | | | | | | | - Observe time to establish a session - Log the duration of the successfully established connection - Observe total time to handle the connection - Log the duration of the successfully executed connection - Observe the count of ssh connections - Observe the count of failed ssh connections
* Fix connections duration metricsIgor Drozdov2022-04-051-4/+4
| | | | We need to pass time.Now as a param, otherwise it's calculated on call
* Improve login grace timeout messageIgor Drozdov2022-03-311-1/+1
|
* Abort long-running unauthenticated SSH connectionsIgor Drozdov2022-03-303-1/+50
|
* Merge branch 'id-reuse-grpc-connections-and-sidechannel' into 'main'Igor Drozdov2022-03-1810-148/+329
|\ | | | | | | | | Reuse Gitaly connections and sidechannel See merge request gitlab-org/gitlab-shell!575
| * Reuse Gitaly conns and SidechannelIgor Drozdov2022-03-0710-148/+329
| | | | | | | | | | | | | | | | When gitlab-sshd has been introduced we've started running our own SSH server. In this case we're able to cache and reuse Gitaly connections and Registry. It helps to reduce memory usage.
* | Default to info level for an empty log-levelNick Thomas2022-03-152-3/+13
|/ | | | | | | | | | | | | | | | | I'd assumed that the `omitempty` directive for LogLevel in internal/config/config.go would get us this behaviour. If it did, we wouldn't have had to specify the default twice. Unfortunately, it doesn't, which is to say that given a config file like: ``` log_level: ``` The default *is* overridden by the empty string. It's an easy enough fix. Changelog: fixed
* Add more metrics for gitlab-sshdIgor Drozdov2022-02-214-26/+84
| | | | | | - Counter of HTTP merge requests - Gauge of HTTP requests currently being performed - Gauge of connections currently handled by gitlab sshd
* Handle and log unhandled errorsIgor Drozdov2022-02-023-11/+23
| | | | | | | | | Currently, we don't process the results of this execution, because it's not really imprortant Let's at least log the err if the execution went wrong That will also make Vulnerability report happy
* Optionally use SSHUploadPackWithSidechannelJacob Vosmaer2022-01-257-15/+106
| | | | | | | If the GitLab API returns an allowed response with use_sidechannel set to true, gitlab-shell will establish a sidechannel connection and use SSHUploadPackWithSidechannel instead of SSHUploadPack. This is an efficiency improvement.
* Support parsing `use_sidechannel` API response fieldJacob Vosmaer2022-01-253-4/+63
| | | | | | This field will act as a feature flag that controls whether gitlab-shell uses the old SSHUploadPack RPC or the new SSHUploadPackWithSidechannel.
* Refactor client response testsJacob Vosmaer2022-01-201-44/+40
| | | | | | | | | | This reduces coupling between tests in internal/gitlabnet/accessverifier/client_test.go, and will make it easier to add new test cases in the future. Note that the test server had a special behavior for the username "second", but this was never used. So we removed that behavior in this commit.
* Remove SSL_CERT_DIR loggingid-remove-ssl-cert-dir-loggingIgor Drozdov2021-11-231-4/+0
| | | | | This log entry doesn't respect log level, because the log level is configured after this logging happens
View Lorry Controller Status