Commit f8f9fec4 authored by Georges Racinet's avatar Georges Racinet 🦑
Browse files

heptapod#711: making 0.34 the new stable

Pipeline #58749 passed with stage
in 3 minutes and 17 seconds
......@@ -19,3 +19,4 @@
tags
tmp/*
vendor
.DS_Store
......@@ -8,7 +8,8 @@
- '/ci/danger-review.yml'
variables:
DOCKER_VERSION: "20.10.3"
DOCKER_VERSION: "20.10.15"
BUNDLE_FROZEN: "true"
workflow:
rules: &workflow_rules
......
......@@ -44,3 +44,10 @@
98d781e90b1bb472b9c37ad5fbdbed541e1457c5 heptapod-14.2.0
7e62e4be19def9c1f1773e326480a9429210bb8d heptapod-14.3.0
fca0cc645e5bbe898f18befe0f31f51f091db81b heptapod-14.3.1
61f29699614da28ec795cec912a75f398df84af3 heptapod-14.3.2
8696661a67a6e7816fca8066dcbdc66b261feb5b heptapod-14.4.0
aaebb02398004cb60c56d98824084bf9a2c17073 heptapod-14.5.0
69c79e2a7c7cd53de504e610f85e0cc61bf184bd heptapod-14.6.0
54e1067b740ecd4e2af0b52e4b2472366aeeb466 heptapod-14.7.0
cfb031a1e9de24b88498850cff796c224ba48edd heptapod-14.7.1
cf818cb4e4fe5440a953da19e2e8650bddbf45d5 heptapod-14.9.0
v14.9.0
- Update LabKit library to v1.16.0 !668
v14.8.0
- go: Bump major version to v14 !666
- Pass original IP from PROXY requests to internal API calls !665
- Fix make install copying the wrong binaries !664
- gitlab-sshd: Add support for configuring host certificates !661
v14.7.4
- gitlab-sshd: Update crypto module to fix RSA keys with old gpg-agent !662
v14.7.3
- Ignore "not our ref" errors from gitlab-sshd error metrics !656
v14.7.2
- Exclude disallowed command from error rate !654
v14.7.1
- Log gitlab-sshd session level indicator errors !650
- Improve establish session duration metrics !651
v14.7.0
- Abort long-running unauthenticated SSH connections !647
- Close the connection when context is canceled !646
v14.6.1
- Return support for diffie-hellman-group14-sha1 !644
v14.6.0
- Exclude Gitaly unavailable error from error rate !641
- Downgrade auth EOF messages from warning to debug !641
- Display constistently in gitlab-sshd and gitlab-shell !641
- Downgrade host key mismatch messages from warning to debug !639
- Introduce a GitLab-SSHD server version during handshake !640
- Narrow supported kex algorithms !638
v14.5.0
- Make ProxyHeaderTimeout configurable !635
v14.4.0
- Allow configuring SSH server algorithms !633
- Update gitlab-org/golang-crypto module version !632
v14.3.1
- Exclude API errors from error rate !630
v14.3.0
- Remove deprecated bundler-audit !626
......
......@@ -113,4 +113,4 @@
rspec (~> 3.8.0)
BUNDLED WITH
2.3.6
2.3.15
......@@ -10,6 +10,34 @@
The corresponding tag is heptapod-x.y.z
## 14.9.0
- Bump to upstream GitLab Shell v14.9.0 (GitLab 15.2 series)
## 14.7.1
- Bump to upstream GitLab Shell v14.7.4 (GitLab 15.1 series)
## 14.7.0
- Bump to upstream GitLab Shell v14.7.0
## 14.6.0
- Bump to upstream GitLab Shell v14.6.0
## 14.5.0
- Bump to upstream GitLab Shell v14.5.0
## 14.4.0
- Bump to upstream GitLab Shell v14.4.0
## 14.3.2
- Bump to upstream GitLab Shell v14.3.1
## 14.3.1
- Filled in `HEPTAPOD_VERSION` (had been forgotten in 14.0 through
......
......@@ -66,7 +66,6 @@
mkdir -p $(DESTDIR)$(PREFIX)/bin/
install -m755 bin/check $(DESTDIR)$(PREFIX)/bin/check
install -m755 bin/gitlab-shell $(DESTDIR)$(PREFIX)/bin/gitlab-shell
install -m755 bin/gitlab-shell $(DESTDIR)$(PREFIX)/bin/gitlab-shell-authorized-keys-check
install -m755 bin/gitlab-shell $(DESTDIR)$(PREFIX)/bin/gitlab-shell-authorized-principals-check
install -m755 bin/gitlab-shell $(DESTDIR)$(PREFIX)/bin/gitlab-sshd
install -m755 bin/gitlab-shell-authorized-keys-check $(DESTDIR)$(PREFIX)/bin/gitlab-shell-authorized-keys-check
install -m755 bin/gitlab-shell-authorized-principals-check $(DESTDIR)$(PREFIX)/bin/gitlab-shell-authorized-principals-check
install -m755 bin/gitlab-sshd $(DESTDIR)$(PREFIX)/bin/gitlab-sshd
......@@ -58,6 +58,44 @@
There is also a rate-limiter in place in Gitaly, but the calls will never be made to Gitaly if the rate limit is exceeded in Gitlab Shell (Rails).
## GitLab SaaS
A diagram of the flow of `gitlab-shell` on GitLab.com:
```mermaid
graph LR
a2 --> b2
a2 --> b3
a2 --> b4
b2 --> c1
b3 --> c1
b4 --> c1
c2 --> d1
c2 --> d2
c2 --> d3
d1 --> e1
d2 --> e1
d3 --> e1
a1[Cloudflare] --> a2[TCP<br/> load balancer]
e1[Git]
subgraph HAProxy Fleet
b2[HAProxy]
b3[HAProxy]
b4[HAProxy]
end
subgraph GKE
c1[Internal TCP<br/> load balancer<br/>port 2222] --> c2[GitLab-shell<br/> pods]
end
subgraph Gitaly
d1[Gitaly]
d2[Gitaly]
d3[Gitaly]
end
```
## Releasing
See [PROCESS.md](./PROCESS.md)
......
......@@ -15,8 +15,8 @@
"github.com/golang-jwt/jwt/v4"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/internal/testhelper"
"gitlab.com/gitlab-org/gitlab-shell/v14/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/testhelper"
)
var (
......@@ -76,6 +76,7 @@
testErrorMessage(t, client)
testAuthenticationHeader(t, client)
testJWTAuthenticationHeader(t, client)
testXForwardedForHeader(t, client)
})
}
}
......@@ -221,6 +222,21 @@
})
}
func testXForwardedForHeader(t *testing.T, client *GitlabNetClient) {
t.Run("X-Forwarded-For Header inserted if original address in context", func(t *testing.T) {
ctx := context.WithValue(context.Background(), OriginalRemoteIPContextKey{}, "196.7.0.238")
response, err := client.Get(ctx, "/x_forwarded_for")
require.NoError(t, err)
require.NotNil(t, response)
defer response.Body.Close()
responseBody, err := io.ReadAll(response.Body)
require.NoError(t, err)
require.Equal(t, "196.7.0.238", string(responseBody))
})
}
func buildRequests(t *testing.T, relativeURLRoot string) []testserver.TestRequestHandler {
requests := []testserver.TestRequestHandler{
{
......@@ -257,6 +273,12 @@
},
},
{
Path: "/api/v4/internal/x_forwarded_for",
Handler: func(w http.ResponseWriter, r *http.Request) {
fmt.Fprint(w, r.Header.Get("X-Forwarded-For"))
},
},
{
Path: "/api/v4/internal/error",
Handler: func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
......
......@@ -37,6 +37,17 @@
userAgent string
}
type ApiError struct {
Msg string
}
// To use as the key in a Context to set an X-Forwarded-For header in a request
type OriginalRemoteIPContextKey struct{}
func (e *ApiError) Error() string {
return e.Msg
}
func NewGitlabNetClient(
user,
password,
......@@ -101,5 +112,5 @@
parsedResponse := &ErrorResponse{}
if err := json.NewDecoder(resp.Body).Decode(parsedResponse); err != nil {
return fmt.Errorf("Internal API error (%v)", resp.StatusCode)
return &ApiError{fmt.Sprintf("Internal API error (%v)", resp.StatusCode)}
} else {
......@@ -105,5 +116,5 @@
} else {
return fmt.Errorf(parsedResponse.Message)
return &ApiError{parsedResponse.Message}
}
}
......@@ -142,6 +153,11 @@
}
request.Header.Set(apiSecretHeaderName, tokenString)
originalRemoteIP, ok := ctx.Value(OriginalRemoteIPContextKey{}).(string)
if ok {
request.Header.Add("X-Forwarded-For", originalRemoteIP)
}
request.Header.Add("Content-Type", "application/json")
request.Header.Add("User-Agent", c.userAgent)
request.Close = true
......@@ -157,7 +173,7 @@
if err != nil {
logger.WithError(err).Error("Internal API unreachable")
return nil, fmt.Errorf("Internal API unreachable")
return nil, &ApiError{"Internal API unreachable"}
}
if response != nil {
......
......@@ -11,7 +11,7 @@
"time"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/v14/client/testserver"
)
func TestReadTimeout(t *testing.T) {
......
......@@ -9,8 +9,8 @@
"testing"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/internal/testhelper"
"gitlab.com/gitlab-org/gitlab-shell/v14/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/testhelper"
)
//go:generate openssl req -newkey rsa:4096 -new -nodes -x509 -days 3650 -out ../internal/testhelper/testdata/testroot/certs/client/server.crt -keyout ../internal/testhelper/testdata/testroot/certs/client/key.pem -subj "/C=US/ST=California/L=San Francisco/O=GitLab/OU=GitLab-Shell/CN=localhost"
......
......@@ -14,7 +14,7 @@
"testing"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/internal/testhelper"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/testhelper"
)
var (
......
package command
import (
"gitlab.com/gitlab-org/gitlab-shell/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/healthcheck"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/shared/disallowedcommand"
"gitlab.com/gitlab-org/gitlab-shell/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/healthcheck"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/shared/disallowedcommand"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
)
func New(config *config.Config, readWriter *readwriter.ReadWriter) (command.Command, error) {
......
......@@ -4,11 +4,11 @@
"testing"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/cmd/check/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/healthcheck"
"gitlab.com/gitlab-org/gitlab-shell/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/internal/sshenv"
"gitlab.com/gitlab-org/gitlab-shell/v14/cmd/check/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/healthcheck"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/sshenv"
)
var (
......
......@@ -4,12 +4,12 @@
"fmt"
"os"
checkCmd "gitlab.com/gitlab-org/gitlab-shell/cmd/check/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/internal/logger"
checkCmd "gitlab.com/gitlab-org/gitlab-shell/v14/cmd/check/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/logger"
)
func main() {
......
package command
import (
"gitlab.com/gitlab-org/gitlab-shell/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/authorizedkeys"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/commandargs"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/shared/disallowedcommand"
"gitlab.com/gitlab-org/gitlab-shell/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/authorizedkeys"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/commandargs"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/readwriter"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/shared/disallowedcommand"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
)
func New(arguments []string, config *config.Config, readWriter *readwriter.ReadWriter) (command.Command, error) {
......
......@@ -4,12 +4,12 @@
"testing"
"github.com/stretchr/testify/require"
"gitlab.com/gitlab-org/gitlab-shell/cmd/gitlab-shell-authorized-keys-check/command"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/authorizedkeys"
"gitlab.com/gitlab-org/gitlab-shell/internal/command/commandargs"
"gitlab.com/gitlab-org/gitlab-shell/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/internal/sshenv"
"gitlab.com/gitlab-org/gitlab-shell/v14/cmd/gitlab-shell-authorized-keys-check/command"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/authorizedkeys"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/command/commandargs"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/config"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/executable"
"gitlab.com/gitlab-org/gitlab-shell/v14/internal/sshenv"
)
var (
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment