Aliaksandr Valialkin 7026498359 lib/httpserver: revert 9b7e532172 ... Reason for revert: this commit doesn't resolve real security issues, while it complicates the resulting code in subtle ways (aka security circus). Comparison of two strings (passwords, auth keys) takes a few nanoseconds. This comparison is performed in non-trivial http handler, which takes thousands of nanoseconds, and the request handler timing is non-deterministic because of Go runtime, Go GC and other concurrently executed goroutines. The request handler timing is even more non-deterministic when the application is executed in shared environments such as Kubernetes, where many other applications may run on the same host and use shared resources of this host (CPU, RAM bandwidth, network bandwidth). Additionally, it is expected that the passwords and auth keys are passed via TLS-encrypted connections. Establishing TLS connections takes additional non-trivial time (millions of nanoseconds), which depends on many factors such as network latency, network congestion, etc. This makes impossible to conduct timing attack on passwords and auth keys in VictoriaMetrics components. Updates https://github.com/VictoriaMetrics/VictoriaMetrics/pull/6423/files Updates https://github.com/VictoriaMetrics/VictoriaMetrics/issues/6392		2024-06-25 01:51:06 +02:00
..
appmetrics	all: add -metrics.exposeMetadata command-line flag, which can be used for adding TYPE and HELP metadata for metrics exposed at /metrics page	2023-12-19 03:26:02 +02:00
auth	lib/auth: add NewTokenPossibleMultitenant() for parsing auth token, which can be multitenant	2023-08-30 14:13:51 +02:00
awsapi	lib/awsapi: properly assume role with webIdentity token (#5495)	2023-12-20 19:07:04 +02:00
backup	lib/backup/s3remote: fixed credsFilePath flag (#6488)	2024-06-14 14:14:58 +02:00
blockcache	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
bloomfilter	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
bufferedwriter	app/vmselect: move common http functionality from app/vmselect/searchutils to lib/httputils	2023-07-06 17:22:23 -07:00
buildinfo	all: open-sourcing single-node version	2019-05-23 00:18:06 +03:00
bytesutil	lib/bytesutil: optimize internStringMap cleanup	2024-06-13 15:09:42 +02:00
cgroup	lib/cgroup: remove SetGOGC() function	2024-02-05 12:13:08 +02:00
consts	app/vminsert: reduce the max packet size, which vminsert can send to vmstorage	2022-04-05 15:39:58 +03:00
decimal	lib/slicesutil: add helper functions for setting slice length and extending its capacity	2024-05-12 11:33:49 +02:00
encoding	lib/encoding: optimize UnmarshalVarUint64, UnmarshalVarInt64 and UnmarshalBytes a bit	2024-05-14 01:30:25 +02:00
envflag	lib/envflag: do not allow unsupported form for boolean command-line flags in the form -boolFlag value	2023-08-17 13:37:05 +02:00
envtemplate	allowed using dashes and dots in environment variables names (#4009)	2023-03-24 17:57:19 -07:00
fastnum	lib/fastnum: use unsafe.Slice() instead of deprecated reflect.SliceHeader	2024-02-29 17:17:24 +02:00
fasttime	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
filestream	lib/filestream: do not measure read / write duration from / to in-memory buffers	2024-01-23 14:53:35 +02:00
flagutil	app/vmagent: add max_scrape_size to scrape config (#6434)	2024-06-20 14:00:22 +02:00
formatutil	app/vmbackupmanager: add metrics for better observability (#488)	2022-12-20 14:18:43 -08:00
fs	lib/fs/fscore: do not trim content from path (#6503)	2024-06-19 10:37:12 +02:00
handshake	lib/handshake: substitute time.Now() with fastttime.UnixTimestamp(), since profiling shows time.Now() is slow	2024-01-23 18:39:28 +02:00
htmlcomponents	lib/htmlcomponents: use relative links for the top page and for favicon.ico	2023-11-13 20:28:17 +01:00
httpserver	lib/httpserver: revert 9b7e532172	2024-06-25 01:51:06 +02:00
httputils	app/vmalert: support DNS SRV record in -remoteWrite.url (#6299)	2024-05-22 10:53:22 +02:00
influxutils	lib/flagutil: rename Array to ArrayString	2022-10-01 18:28:19 +03:00
ingestserver	lib/logstorage: work-in-progress	2024-06-17 12:13:25 +02:00
leveledbytebufferpool	lib/leveledbytebufferpool: do not pool byte slices bigger than 2^18 bytes	2024-06-13 17:02:05 +02:00
logger	lib/logger: increase default -loggerMaxArgLen command-line flag value from 500 to 1000	2023-11-14 19:55:55 +01:00
logstorage	lib/logstorage: work-in-progress	2024-06-25 00:44:57 +02:00
lrucache	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
memory	all: cleanup: remove // +build ... lines, since they are no longer needed after Go1.17, and the minimum supported Go version for VictoriaMetrics source code is Go1.20	2023-11-13 19:15:42 +01:00
mergeset	lib/mergeset: adds tracking for indexdb records drop (#6297)	2024-05-24 16:08:34 +02:00
metricsql	all: make fmt via the upcoming Go1.19	2022-07-11 19:23:25 +03:00
netutil	app/vmauth: fix discovering backend IPs when url_prefix contains hostname with srv+ prefix (#6401)	2024-06-12 11:47:44 +02:00
persistentqueue	Fixed a typo in the FastQueue mutex comment (#6514)	2024-06-20 14:00:08 +02:00
procutil	all: cleanup: remove // +build ... lines, since they are no longer needed after Go1.17, and the minimum supported Go version for VictoriaMetrics source code is Go1.20	2023-11-13 19:15:42 +01:00
promauth	all: replace old https://docs.victoriametrics.com/sd_configs.html url with the new one - https://docs.victoriametrics.com/sd_configs/	2024-04-18 02:28:26 +02:00
prompb	Exemplar support (#5982)	2024-05-10 13:14:17 +02:00
prompbmarshal	lib/slicesutil: add helper functions for setting slice length and extending its capacity	2024-05-12 11:33:49 +02:00
promrelabel	lib/promrelabel: speedup label match by __name__ (#6432)	2024-06-07 16:35:52 +02:00
promscrape	app/vmagent: add max_scrape_size to scrape config (#6434)	2024-06-20 14:00:22 +02:00
promutils	lib/logstorage: work-in-progress	2024-06-04 01:50:55 +02:00
protoparser	lib/protoparser/opentelemetry/firehose: escape requestID before returning it to user (#6451)	2024-06-10 18:06:24 +02:00
proxy	lib/promscrape: use the standard net/http.Client instead of fasthttp.Client for scraping targets in non-streaming mode	2024-01-30 18:39:55 +02:00
pushmetrics	lib/pushmetrics: wait until the background goroutines, which push metrics, are stopped at pushmetrics.Stop()	2024-01-16 21:18:22 +02:00
querytracer	lib/querytracer: add missing blank comment line after 3121d76bee	2023-11-15 16:11:50 +01:00
ratelimiter	app/vmagent: properly shutdown when -maxIngestionRate limit is reached	2024-04-03 02:41:11 +03:00
regexutil	lib/logstorage: work-in-progress	2024-05-25 22:59:21 +02:00
slicesutil	lib/slicesutil: add helper functions for setting slice length and extending its capacity	2024-05-12 11:33:49 +02:00
snapshot	Revert "app/vmbackup: introduce new flag type URL (#6152)"	2024-04-24 17:08:26 +02:00
storage	lib/storage: filter deleted label names and values from `/api/v1/labe… (#6342)	2024-05-29 14:37:00 +02:00
streamaggr	lib/streamaggr: remove accidentally committed changes	2024-06-17 14:25:45 +02:00
stringsutil	lib/logstorage: work-in-progress	2024-05-22 21:01:28 +02:00
syncwg	all: open-sourcing single-node version	2019-05-23 00:18:06 +03:00
tenantmetrics	lib/encoding/zstd: switch back from atomic.Pointer to atomic.Value for map[...]...	2023-07-20 21:54:51 -07:00
timerpool	lib/timerpool: use timer pool in concurrency limiters	2019-05-28 17:30:10 +03:00
timeutil	all: add up to 10% random jitter to the interval between periodic tasks performed by various components	2024-01-22 18:39:16 +02:00
uint64set	lib/slicesutil: add helper functions for setting slice length and extending its capacity	2024-05-12 11:33:49 +02:00
vmselectapi	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
workingsetcache	lib: consistently use atomic.* types instead of atomic.* functions	2024-02-24 02:10:04 +02:00
writeconcurrencylimiter	app/vmagent/remotewrite: clarify the reason behind the default value for -remoteWrite.queues in the same way as the reason for -maxConcurrentInserts is defined at 73f5fb0f0c	2024-03-06 13:57:53 +02:00