6ee49bebaa · krz/gitbay

.gitbay/wiki/Admin.org +3 −2

   budget: this many at once, this many per account (per client
   address when anonymous: an IPv4 address, or an IPv6 /64), and this
   many waiting for at most the wait. Anonymous clients together hold
-  at most =pack_concurrency= − 1 slots when it is above 1, so a signed-in
+  at most =pack_concurrency= − 1 slots when it is above 1: an account
-  client (SSH key, bearer token or web session) can always get the last.
+  (SSH key, bearer token or web session) can take the last slot when it
+  is free, and anonymous clients cannot hold it.
   Past that an SSH client gets "the server is busy…" and exit 1, HTTP
   gets 503 with =Retry-After: 30=, git:// an =ERR= line; the daemon
   logs a =pack limit= warning naming the transport and whether the

.gitbay/wiki/Performance.org +7 −4

 =pack_queue= 32, =pack_queue_wait= 60s) are set for a four-core host
 from the single-clone figure above; no concurrent-clone measurement
 backs them yet. =deploy/clonebench.sh <clone-url> <n>= starts n full
-clones at once from a machine other than the server. Clones from one
+clones at once from a machine other than the server. Anonymous clones
-address count against one principal, so run it from two addresses, or
+together hold at most =pack_concurrency= − 1 slots, and clones from one
-against an instance with =pack_per_principal = -1=, or it measures the
+address or account count against one principal, so an anonymous run
-per-principal cap instead of the global one.
+measures those caps rather than the global one. Run it as signed-in
+clients (SSH keys, or HTTP with bearer tokens) from more than one
+account, or against an instance with =pack_per_principal = -1= and
+read the result as the anonymous class cap.

CHANGELOG.org +3 −2

   download= are unaffected. Under =ssh.mode = "system"= SSH clones are not counted,
   since each session is its own process (#262).
 - Anonymous clones are counted per IPv4 address or IPv6 /64, and
-  together hold at most =pack_concurrency= − 1 slots, so a signed-in
+  together hold at most =pack_concurrency= − 1 slots: an account can
-  client can always get the last one (#262).
+  take the last slot when it is free, and anonymous clients cannot hold
+  it (#262).
 - A request turned away by the pack limit logs a warning naming the
   transport and whether the client was signed in, never its address,
   at most once a minute per transport (#262).

internal/hookd/hookd.go +12 −4

 // peerCheck is checkPeer; tests replace it.
 var peerCheck = checkPeer
+// auditedRefs is how many ref names a refused-push row keeps; the rest
+// are counted, so one push of many refs cannot write an unbounded row.
+const auditedRefs = 20
 // refusePush answers a pre-receive refusal and audits it.
 func (s *Server) refusePush(enc *json.Encoder, req Request, repo store.Repo, msg string) {
-	refs := make([]string, len(req.Updates))
+	n := min(len(req.Updates), auditedRefs)
-	for i, u := range req.Updates {
+	refs := make([]string, n)
+	for i, u := range req.Updates[:n] {
 		refs[i] = u.Ref
 	}
-	control.AuditRefused(s.st, req.UserID, "refused push",
+	data := map[string]any{"repo": repo.Path(), "refs": refs, "reason": msg}
-		map[string]any{"repo": repo.Path(), "refs": refs, "reason": msg})
+	if more := len(req.Updates) - n; more > 0 {
+		data["more_refs"] = more
+	}
+	control.AuditRefused(s.st, req.UserID, "refused push", data)
 	enc.Encode(Response{Allow: false, Message: msg})
 }

internal/hookd/socket_test.go +34

	@@ -1,7 +1,9 @@
1	package hookd	1	package hookd
2		2
3	import (	3	import (
		4	"encoding/json"
4	"errors"	5	"errors"
		6	"fmt"
5	"net"	7	"net"
6	"os"	8	"os"
7	"path/filepath"	9	"path/filepath"
	@@ -161,3 +163,35 @@ func TestPeerRefusalIsAudited(t *testing.T) {
161	t.Fatalf("refused hook rows: %+v", rows)	163	t.Fatalf("refused hook rows: %+v", rows)
162	}	164	}
163	}	165	}
		166
		167	// A refused push of many refs records the first auditedRefs names and
		168	// a count of the rest.
		169	func TestRefusedPushCapsRefs(t *testing.T) {
		170	sock, st, repoID, uid := serveSocket(t)
		171	token, err := st.CreatePushToken(repoID, uid, "full")
		172	if err != nil {
		173	t.Fatal(err)
		174	}
		175	req := Request{Hook: "pre-receive", RepoID: repoID, UserID: uid, Scope: "full", Token: token}
		176	for i := range 500 {
		177	req.Updates = append(req.Updates, policy.RefUpdate{Ref: fmt.Sprintf("refs/merge-requests/%d/head", i),
		178	Old: zeroSHA40, New: strings.Repeat("a", 40)})
		179	}
		180	if resp, err := Ask(sock, req, nil); err != nil \|\| resp.Allow {
		181	t.Fatalf("push: %+v, %v", resp, err)
		182	}
		183	rows := refusedRows(t, st, "refused push")
		184	if len(rows) != 1 {
		185	t.Fatalf("rows: %+v", rows)
		186	}
		187	var data struct {
		188	Refs []string `json:"refs"`
		189	MoreRefs int `json:"more_refs"`
		190	}
		191	if err := json.Unmarshal([]byte(rows[0].Data), &data); err != nil {
		192	t.Fatal(err)
		193	}
		194	if len(data.Refs) != auditedRefs \|\| data.MoreRefs != 500-auditedRefs \|\| data.Refs[0] != "refs/merge-requests/0/head" {
		195	t.Fatalf("refs %d, more %d", len(data.Refs), data.MoreRefs)
		196	}
		197	}

Commit 6ee49bebaa