rdelaage
/
gitea
mirror of https://github.com/go-gitea/gitea.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge 4c75e2b43a into 68d5c18953

This commit is contained in:
Malte Swart 2024-05-17 13:58:22 +02:00 committed by GitHub
parent 68d5c18953 4c75e2b43a
commit f32bd7cf6c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
7 changed files with 31 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
custom/conf/app.example.ini
View File

@ -150,7 +150,8 @@ RUN_USER = ; git
;; SSH username displayed in clone URLs.
;SSH_USER = %(BUILTIN_SSH_SERVER_USER)s
;;
;; The network interface the builtin SSH server should listen on
;; The network interface(s) the builtin SSH server should listen on.
;; Individual addresses can include a port statement to override SSH_LISTEN_PORT value, like 127.0.0.1:2022,0.0.0.0
;SSH_LISTEN_HOST =
;;
;; Port number to be exposed in clone URL

2
docs/content/administration/config-cheat-sheet.en-us.md
View File

@ -333,7 +333,7 @@ The following configuration set `Content-Type: application/vnd.android.package-a
- `SSH_USER`: **%(BUILTIN_SSH_SERVER_USER)s**: SSH username displayed in clone URLs. This is only for people who configure the SSH server themselves; in most cases, you want to leave this blank and modify the `BUILTIN_SSH_SERVER_USER`.
- `SSH_DOMAIN`: **%(DOMAIN)s**: Domain name of this server, used for displayed clone URL.
- `SSH_PORT`: **22**: SSH port displayed in clone URL.
- `SSH_LISTEN_HOST`: **0.0.0.0**: Listen address for the built-in SSH server.
- `SSH_LISTEN_HOST`: **0.0.0.0**: Listen address(es) for the built-in SSH server; multiple addresses can be separated by comma, addresses can include a port statement to override SSH_LISTEN_PORT.
- `SSH_LISTEN_PORT`: **%(SSH\_PORT)s**: Port for the built-in SSH server.
- `SSH_ROOT_PATH`: **~/.ssh**: Root path of SSH directory.
- `SSH_CREATE_AUTHORIZED_KEYS_FILE`: **true**: Gitea will create a authorized_keys file by default when it is not using the internal ssh server. If you intend to use the AuthorizedKeysCommand functionality then you should turn this off.

6
modules/graceful/manager.go
View File

@ -239,6 +239,12 @@ func (g *Manager) InformCleanup() {
g.createServerCond.Signal()
}
// Should we need to create multile listener for one type (e.g. SSH built-in server),
// the number of expected routines needs to be increased accordingly.
func (g *Manager) IncreaseListenerCountBy(extraNumberOfServersToCreate int) {
g.createServerWaitGroup.Add(extraNumberOfServersToCreate)
}
// Done allows the manager to be viewed as a context.Context, it returns a channel that is closed when the server is finished terminating
func (g *Manager) Done() <-chan struct{} {
return g.managerCtx.Done()

3
modules/setting/ssh.go
View File

@ -25,7 +25,7 @@ var SSH = struct {
Domain string `ini:"SSH_DOMAIN"`
Port int `ini:"SSH_PORT"`
User string `ini:"SSH_USER"`
ListenHost string `ini:"SSH_LISTEN_HOST"`
ListenHost []string `ini:"SSH_LISTEN_HOST"`
ListenPort int `ini:"SSH_LISTEN_PORT"`
RootPath string `ini:"SSH_ROOT_PATH"`
ServerCiphers []string `ini:"SSH_SERVER_CIPHERS"`
@ -54,6 +54,7 @@ var SSH = struct {
Disabled: false,
StartBuiltinServer: false,
Domain: "",
ListenHost: []string{"0.0.0.0"},
Port: 22,
ServerCiphers: []string{"chacha20-poly1305@openssh.com", "aes128-ctr", "aes192-ctr", "aes256-ctr", "aes128-gcm@openssh.com", "aes256-gcm@openssh.com"},
ServerKeyExchanges: []string{"curve25519-sha256", "ecdh-sha2-nistp256", "ecdh-sha2-nistp384", "ecdh-sha2-nistp521", "diffie-hellman-group14-sha256", "diffie-hellman-group14-sha1"},

21
modules/ssh/init.go
View File

@ -11,6 +11,7 @@ import (
"strconv"
"strings"
"code.gitea.io/gitea/modules/graceful"
"code.gitea.io/gitea/modules/log"
"code.gitea.io/gitea/modules/setting"
)
@ -22,11 +23,21 @@ func Init() error {
}
if setting.SSH.StartBuiltinServer {
Listen(setting.SSH.ListenHost, setting.SSH.ListenPort, setting.SSH.ServerCiphers, setting.SSH.ServerKeyExchanges, setting.SSH.ServerMACs)
log.Info("SSH server started on %s. Cipher list (%v), key exchange algorithms (%v), MACs (%v)",
net.JoinHostPort(setting.SSH.ListenHost, strconv.Itoa(setting.SSH.ListenPort)),
setting.SSH.ServerCiphers, setting.SSH.ServerKeyExchanges, setting.SSH.ServerMACs,
)
if len(setting.SSH.ListenHost) > 1 {
graceful.GetManager().IncreaseListenerCountBy(len(setting.SSH.ListenHost) - 1)
}
for _, listenHost := range setting.SSH.ListenHost {
var addr string
if _, _, err := net.SplitHostPort(listenHost); err == nil {
addr = listenHost
} else {
addr = net.JoinHostPort(listenHost, strconv.Itoa(setting.SSH.ListenPort))
}
Listen(addr, setting.SSH.ServerCiphers, setting.SSH.ServerKeyExchanges, setting.SSH.ServerMACs)
log.Info("SSH server started on %s. Cipher list (%v), key exchange algorithms (%v), MACs (%v)",
addr, setting.SSH.ServerCiphers, setting.SSH.ServerKeyExchanges, setting.SSH.ServerMACs,
)
}
return nil
}

7
modules/ssh/ssh.go
View File

@ -17,7 +17,6 @@ import (
"os"
"os/exec"
"path/filepath"
"strconv"
"strings"
"sync"
"syscall"
@ -280,10 +279,10 @@ func sshConnectionFailed(conn net.Conn, err error) {
log.Warn("Failed authentication attempt from %s", conn.RemoteAddr())
}
// Listen starts a SSH server listens on given port.
func Listen(host string, port int, ciphers, keyExchanges, macs []string) {
// Listen starts a SSH server listens on given addr (host, port combination).
func Listen(addr string, ciphers, keyExchanges, macs []string) {
srv := ssh.Server{
Addr: net.JoinHostPort(host, strconv.Itoa(port)),
Addr: addr,
PublicKeyHandler: publicKeyHandler,
Handler: sessionHandler,
ServerConfigCallback: func(ctx ssh.Context) *gossh.ServerConfig {

2
tests/integration/git_helper_for_declarative_test.go
View File

@ -52,7 +52,7 @@ func createSSHUrl(gitPath string, u *url.URL) *url.URL {
u2 := *u
u2.Scheme = "ssh"
u2.User = url.User("git")
u2.Host = net.JoinHostPort(setting.SSH.ListenHost, strconv.Itoa(setting.SSH.ListenPort))
u2.Host = net.JoinHostPort(setting.SSH.ListenHost[0], strconv.Itoa(setting.SSH.ListenPort))
u2.Path = gitPath
return &u2
}