Skip to content
Snippets Groups Projects
Commit 5b94726b authored by Igor Drozdov's avatar Igor Drozdov
Browse files

Make ProxyHeaderTimeout configurable

Issue: https://gitlab.com/gitlab-org/gitlab-shell/-/issues/576

ProxyHeaderTimeout must be small to avoid DoS risk

Let's make the value configurable and 500ms by default
parent cbce19da
Branches id-fix-proxy-header-timeout
Tags
No related merge requests found
......@@ -80,6 +80,8 @@ sshd:
client_alive_interval: 15
# The server waits for this time (in seconds) for the ongoing connections to complete before shutting down. Defaults to 10.
grace_period: 10
# A short timeout to decide to abort the connection if the protocol header is not seen within it. Defaults to 500ms
proxy_header_timeout: 500ms
# The endpoint that returns 200 OK if the server is ready to receive incoming connections; otherwise, it returns 503 Service Unavailable. Defaults to "/start".
readiness_probe: "/start"
# The endpoint that returns 200 OK if the server is alive. Defaults to "/health".
......
......@@ -31,6 +31,7 @@ type ServerConfig struct {
ConcurrentSessionsLimit int64 `yaml:"concurrent_sessions_limit,omitempty"`
ClientAliveInterval yamlDuration `yaml:"client_alive_interval,omitempty"`
GracePeriod yamlDuration `yaml:"grace_period"`
ProxyHeaderTimeout yamlDuration `yaml:"proxy_header_timeout"`
ReadinessProbe string `yaml:"readiness_probe"`
LivenessProbe string `yaml:"liveness_probe"`
HostKeyFiles []string `yaml:"host_key_files,omitempty"`
......@@ -86,6 +87,7 @@ var (
ConcurrentSessionsLimit: 10,
GracePeriod: yamlDuration(10 * time.Second),
ClientAliveInterval: yamlDuration(15 * time.Second),
ProxyHeaderTimeout: yamlDuration(500 * time.Millisecond),
ReadinessProbe: "/start",
LivenessProbe: "/health",
HostKeyFiles: []string{
......
......@@ -5,9 +5,9 @@ import (
"testing"
"time"
yaml "gopkg.in/yaml.v2"
"github.com/prometheus/client_golang/prometheus"
"github.com/stretchr/testify/require"
yaml "gopkg.in/yaml.v2"
"gitlab.com/gitlab-org/gitlab-shell/client/testserver"
"gitlab.com/gitlab-org/gitlab-shell/internal/testhelper"
......@@ -67,14 +67,15 @@ func TestNewFromDir(t *testing.T) {
cfg, err := NewFromDir(testhelper.TestRoot)
require.NoError(t, err)
require.Equal(t, 10 * time.Second, time.Duration(cfg.Server.GracePeriod))
require.Equal(t, 1 * time.Minute, time.Duration(cfg.Server.ClientAliveInterval))
require.Equal(t, 10*time.Second, time.Duration(cfg.Server.GracePeriod))
require.Equal(t, 1*time.Minute, time.Duration(cfg.Server.ClientAliveInterval))
require.Equal(t, 500*time.Millisecond, time.Duration(cfg.Server.ProxyHeaderTimeout))
}
func TestYAMLDuration(t *testing.T) {
testCases := []struct{
desc string
data string
testCases := []struct {
desc string
data string
duration time.Duration
}{
{"seconds assumed by default", "duration: 10", 10 * time.Second},
......
......@@ -26,7 +26,6 @@ const (
StatusReady
StatusOnShutdown
StatusClosed
ProxyHeaderTimeout = 90 * time.Second
)
type Server struct {
......@@ -97,7 +96,7 @@ func (s *Server) listen(ctx context.Context) error {
sshListener = &proxyproto.Listener{
Listener: sshListener,
Policy: s.requirePolicy,
ReadHeaderTimeout: ProxyHeaderTimeout,
ReadHeaderTimeout: time.Duration(s.Config.Server.ProxyHeaderTimeout),
}
log.ContextLogger(ctx).Info("Proxy protocol is enabled")
......
sshd:
grace_period: 10
client_alive_interval: 1m
proxy_header_timeout: 500ms
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment