diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-03-28 18:07:51 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-03-28 18:07:51 +0300 |
commit | b213b675ec1d6fa633497c5f71c195f00b56be6d (patch) | |
tree | 40b871f2124307dfe2326f1d116d3fd7b4e2f86d /app/models/application_setting_implementation.rb | |
parent | e4dad5d33053f0facde637888363a8954d0d5e46 (diff) |
Add latest changes from gitlab-org/gitlab@master
Diffstat (limited to 'app/models/application_setting_implementation.rb')
-rw-r--r-- | app/models/application_setting_implementation.rb | 29 |
1 files changed, 21 insertions, 8 deletions
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb index 42049713883..8914ecf033d 100644 --- a/app/models/application_setting_implementation.rb +++ b/app/models/application_setting_implementation.rb @@ -14,7 +14,6 @@ module ApplicationSettingImplementation # Setting a key restriction to `-1` means that all keys of this type are # forbidden. FORBIDDEN_KEY_VALUE = KeyRestrictionValidator::FORBIDDEN - SUPPORTED_KEY_TYPES = Gitlab::SSHPublicKey.supported_types VALID_RUNNER_REGISTRAR_TYPES = %w(project group).freeze DEFAULT_PROTECTED_PATHS = [ @@ -67,11 +66,11 @@ module ApplicationSettingImplementation disabled_oauth_sign_in_sources: [], dns_rebinding_protection_enabled: true, domain_allowlist: Settings.gitlab['domain_allowlist'], - dsa_key_restriction: 0, - ecdsa_key_restriction: 0, - ecdsa_sk_key_restriction: 0, - ed25519_key_restriction: 0, - ed25519_sk_key_restriction: 0, + dsa_key_restriction: default_min_key_size(:dsa), + ecdsa_key_restriction: default_min_key_size(:ecdsa), + ecdsa_sk_key_restriction: default_min_key_size(:ecdsa_sk), + ed25519_key_restriction: default_min_key_size(:ed25519), + ed25519_sk_key_restriction: default_min_key_size(:ed25519_sk), eks_access_key_id: nil, eks_account_id: nil, eks_integration_enabled: false, @@ -143,7 +142,7 @@ module ApplicationSettingImplementation require_admin_approval_after_user_signup: true, require_two_factor_authentication: false, restricted_visibility_levels: Settings.gitlab['restricted_visibility_levels'], - rsa_key_restriction: 0, + rsa_key_restriction: default_min_key_size(:rsa), send_user_confirmation_email: false, session_expire_delay: Settings.gitlab['session_expire_delay'], shared_runners_enabled: Settings.gitlab_ci['shared_runners_enabled'], @@ -244,6 +243,20 @@ module ApplicationSettingImplementation "users.noreply.#{Gitlab.config.gitlab.host}" end + # Return the default allowed minimum key size for a type. + # By default this is 0 (unrestricted), but in FIPS mode + # this will return the smallest allowed key size. If no + # size is available, this type is denied. + # + # @return [Integer] + def default_min_key_size(name) + if Gitlab::FIPS.enabled? + Gitlab::SSHPublicKey.supported_sizes(name).select(&:positive?).min || -1 + else + 0 + end + end + def create_from_defaults build_from_defaults.tap(&:save) end @@ -442,7 +455,7 @@ module ApplicationSettingImplementation alias_method :usage_ping_enabled?, :usage_ping_enabled def allowed_key_types - SUPPORTED_KEY_TYPES.select do |type| + Gitlab::SSHPublicKey.supported_types.select do |type| key_restriction_for(type) != FORBIDDEN_KEY_VALUE end end |