diff options
author | David Ostrovsky <david.ostrovsky@gmail.com> | 2021-05-11 18:21:40 +0000 |
---|---|---|
committer | Gerrit Code Review <noreply-gerritcodereview@google.com> | 2021-05-11 18:21:40 +0000 |
commit | df853d3e1e73db2f3f19562c0fe066b058bf2616 (patch) | |
tree | 7e895fc95b4007fb424371e7b5ccc112be23c6b9 | |
parent | 778bc9d10930ce4b81b9ce3d8b349522195a51a4 (diff) | |
parent | 7a1980e9e558e03ae8238127c4703fe6b7d7e480 (diff) |
Merge "Log when a new SSH connection is rejected due to exceeded limit" into stable-3.1
-rw-r--r-- | java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java | 42 | ||||
-rw-r--r-- | java/com/google/gerrit/sshd/SshDaemon.java | 4 |
2 files changed, 45 insertions, 1 deletions
diff --git a/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java b/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java new file mode 100644 index 0000000000..6f568b1a5b --- /dev/null +++ b/java/com/google/gerrit/sshd/LogMaxConnectionsPerUserExceeded.java @@ -0,0 +1,42 @@ +// Copyright (C) 2021 The Android Open Source Project +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package com.google.gerrit.sshd; + +import com.google.common.flogger.FluentLogger; +import com.google.inject.Singleton; +import java.io.IOException; +import org.apache.sshd.common.Service; +import org.apache.sshd.common.session.Session; +import org.apache.sshd.common.session.SessionDisconnectHandler; + +@Singleton +public class LogMaxConnectionsPerUserExceeded implements SessionDisconnectHandler { + private static final FluentLogger logger = FluentLogger.forEnclosingClass(); + + @Override + public boolean handleSessionsCountDisconnectReason( + Session session, + Service service, + String username, + int currentSessionCount, + int maxSessionCount) + throws IOException { + logger.atWarning().log( + "Max connection count for user %s exceeded, rejecting new connection." + + " currentSessionCount = %d, maxSessionCount = %d", + username, currentSessionCount, maxSessionCount); + return false; + } +} diff --git a/java/com/google/gerrit/sshd/SshDaemon.java b/java/com/google/gerrit/sshd/SshDaemon.java index a1c057ffc0..f04ff7eadd 100644 --- a/java/com/google/gerrit/sshd/SshDaemon.java +++ b/java/com/google/gerrit/sshd/SshDaemon.java @@ -160,7 +160,8 @@ public class SshDaemon extends SshServer implements SshInfo, LifecycleListener { SshLog sshLog, @SshListenAddresses List<SocketAddress> listen, @SshAdvertisedAddresses List<String> advertised, - MetricMaker metricMaker) { + MetricMaker metricMaker, + LogMaxConnectionsPerUserExceeded logMaxConnectionsPerUserExceeded) { setPort(IANA_SSH_PORT /* never used */); this.cfg = cfg; @@ -240,6 +241,7 @@ public class SshDaemon extends SshServer implements SshInfo, LifecycleListener { setKeyPairProvider(hostKeyProvider); setCommandFactory(commandFactory); setShellFactory(noShell); + setSessionDisconnectHandler(logMaxConnectionsPerUserExceeded); final AtomicInteger connected = new AtomicInteger(); metricMaker.newCallbackMetric( |