* fix: the public share configuration and fixed graceful shutdown
* fix: [OCISDEV-1433] remove GRPC_MAX_CONNECTION_AGE
The setting closed healthy grpc connections on a timer so that clients would redo
their DNS lookup. It never helped against the failure it was reached for - a
connection whose peer stopped answering - because the age limit is enforced by
the server, the grace period was left at infinity so a request already in flight
was never ended, and any value without a unit suffix silently disabled it again.
Detecting a peer that stops answering is now the job of the grpc clients, which
ping the peer while a request is in flight. The servers here got the matching
enforcement policy so they accept those pings; the client side arrives with the
next reva bump.
* fix: Added the new variable OCDAV_DISABLE_PROPFIND_PUBLIC_LINK_RESOLUTION that disable the resolution of public link shares when answering PROPFIND requests.
* chore: bump reva
* fix: The keepalive added to grpc clinet
* chore: bump reva
* build(deps): bump go 1.26.8, grpc-go dependency
---------
(cherry picked from commit e86eb4d210)
For the 9.0 branch, the reva dependency was pointed at reva's main-branch
merge of PR #748 (commit 373f9509a, pseudo-version
v2.0.0-20261005091647-373f9509a363) instead of the 8.2-targeted
e0beaa380005, since the 8.2 merge predates the VaultMode/UploadSessionFilter.Orphaned
APIs already present on the 9.0 reva lineage.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
# Conflicts:
# changelog/unreleased/security-bump-grpc.md
# go.mod
# go.sum
# vendor/google.golang.org/grpc/server.go
# vendor/google.golang.org/grpc/stream.go
# vendor/google.golang.org/grpc/version.go
# vendor/modules.txt
otelchi and other custom solutions have been replaced with otelhttp to
trace HTTP requests; new middleware is provided to be used across the
platform.
The proxy service will use a custom HTTP client to forward the headers
needed for telemetry automatically (also based on otelhttp)
* feat: add CSP and other security related headers in the oCIS proxy service
* fix: consolidate security related headers - drop middleware.Secure
* fix: use github.com/DeepDiver1975/secure
* fix: acceptance tests
* feat: support env var replacements in csp.yaml
* enhancement: use reva client pool selectors
register mock service to registry and pass tests
* enhancement: bump reva
* Fix a couple of linter issues
---------
Co-authored-by: Ralf Haferkamp <rhaferkamp@owncloud.com>
* add tags to search service resource
add tags getTags, AssignTags and UnassignTags endpoint to graph
use and prefer search event spaceOwner over executant
add tags to search report response
update libre graph api
update reva
Co-authored-by: David Christofas <dchristofas@owncloud.com>
* standalone graph service with LDAP
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* no panic on PATCH and DELETE
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* fix apitoken yaml key
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* update user, fix response codes
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* fix group creation return code
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* remove unknown user property
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* fix create return code checks in graph feature context
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* updating uses 200 OK when returning a body
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* revert user statusCreated change for now
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* revert return code changes
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* use min tls 1.2
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
* add changelog
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
TLS for the services can be configure by setting the "OCIS_HTTP_TLS_ENABLED",
"OCIS_HTTP_TLS_CERTIFICATE" and "OCIS_HTTP_TLS_KEY" environment variables.
Currently the ocis proxy is this only service that directly accesses backend
services. It determines whether to use TLS or not by looking a the new registry
metadata "use_tls". As specific CA Cert for certificate verification
can be set with the "PROXY_HTTPS_CACERT" environment variable.
* use tls for nats connections
* add config options for nats client tls config
* add nats tls config to CI
* add function to create a certpool
* add option to provide a rootCA to validate the server's TLS certificate
* add option to provide a rootCA to validate the server's TLS certificate
* add option to provide a rootCA to validate the server's TLS certificate
* add option to provide a rootCA to validate the server's TLS certificate
* configure nats clients in reva to use tls
