diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2020-06-18 14:18:50 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2020-06-18 14:18:50 +0300 |
commit | 8c7f4e9d5f36cff46365a7f8c4b9c21578c1e781 (patch) | |
tree | a77e7fe7a93de11213032ed4ab1f33a3db51b738 /doc/security | |
parent | 00b35af3db1abfe813a778f643dad221aad51fca (diff) |
Add latest changes from gitlab-org/gitlab@13-1-stable-ee
Diffstat (limited to 'doc/security')
-rw-r--r-- | doc/security/img/allowlist_v13_0.png | bin | 0 -> 16076 bytes | |||
-rw-r--r-- | doc/security/img/whitelist.png | bin | 10650 -> 0 bytes | |||
-rw-r--r-- | doc/security/rack_attack.md | 3 | ||||
-rw-r--r-- | doc/security/webhooks.md | 20 |
4 files changed, 10 insertions, 13 deletions
diff --git a/doc/security/img/allowlist_v13_0.png b/doc/security/img/allowlist_v13_0.png Binary files differnew file mode 100644 index 00000000000..973b53a57a4 --- /dev/null +++ b/doc/security/img/allowlist_v13_0.png diff --git a/doc/security/img/whitelist.png b/doc/security/img/whitelist.png Binary files differdeleted file mode 100644 index 897000e804d..00000000000 --- a/doc/security/img/whitelist.png +++ /dev/null diff --git a/doc/security/rack_attack.md b/doc/security/rack_attack.md index 5d18746e4e0..605b669d498 100644 --- a/doc/security/rack_attack.md +++ b/doc/security/rack_attack.md @@ -121,9 +121,6 @@ The following settings can be configured: **Installations from source** -NOTE: **Note:** Rack Attack initializer was temporarily renamed to `rack_attack_new`, to -support backwards compatibility with the one [Omnibus initializer](https://docs.gitlab.com/omnibus/settings/configuration.html#setting-up-paths-to-be-protected-by-rack-attack). It'll be renamed back to `rack_attack.rb` once Omnibus throttle is removed. Please see the [GitLab issue](https://gitlab.com/gitlab-org/gitlab/issues/29952) for more information. - These settings can be found in `config/initializers/rack_attack.rb`. If you are missing `config/initializers/rack_attack.rb`, the following steps need to be taken in order to enable protection for your GitLab instance: diff --git a/doc/security/webhooks.md b/doc/security/webhooks.md index 27f79dbdf66..af9be499e80 100644 --- a/doc/security/webhooks.md +++ b/doc/security/webhooks.md @@ -52,29 +52,29 @@ NOTE: **Note:** set up by administrators. However, you can turn this off by disabling the **Allow requests to the local network from system hooks** option. -## Whitelist for local requests +## Allowlist for local requests -> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/issues/44496) in GitLab 12.2 +> [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/issues/44496) in GitLab 12.2 You can allow certain domains and IP addresses to be accessible to both *system hooks* and *webhooks* even when local requests are not allowed by adding them to the -whitelist. Navigate to **Admin Area > Settings > Network** (`/admin/application_settings/network`) +allowlist. Navigate to **Admin Area > Settings > Network** (`/admin/application_settings/network`) and expand **Outbound requests**: -![Outbound local requests whitelist](img/whitelist.png) +![Outbound local requests allowlist](img/allowlist_v13_0.png) -The whitelist entries can be separated by semicolons, commas or whitespaces +The allowed entries can be separated by semicolons, commas or whitespaces (including newlines) and be in different formats like hostnames, IP addresses and/or -IP ranges. IPv6 is supported. Hostnames that contain unicode characters should +IP ranges. IPv6 is supported. Hostnames that contain Unicode characters should use IDNA encoding. -The whitelist can hold a maximum of 1000 entries. Each entry can be a maximum of +The allowlist can hold a maximum of 1000 entries. Each entry can be a maximum of 255 characters. -You can whitelist a particular port by specifying it in the whitelist entry. +You can allow a particular port by specifying it in the allowlist entry. For example `127.0.0.1:8080` will only allow connections to port 8080 on `127.0.0.1`. -If no port is mentioned, all ports on that IP/domain are whitelisted. An IP range -will whitelist all ports on all IPs in that range. +If no port is mentioned, all ports on that IP/domain are allowed. An IP range +will allow all ports on all IPs in that range. Example: |