RDODCP-914: Chisel Upstream Sync (v1.12.1) + Security Fixes - #618
Open
anurag-outsystems wants to merge 56 commits into
Open
RDODCP-914: Chisel Upstream Sync (v1.12.1) + Security Fixes#618anurag-outsystems wants to merge 56 commits into
anurag-outsystems wants to merge 56 commits into
Conversation
* Set ServerName (SNI) to *hostname. Useful for spoofing our way through restrictive gateways. * Bump actions/checkout from 2 to 3.1.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.1.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v2...v3.1.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Added --sni switch to control the ServerName when connecting with TLS. Makes 'domain fronting' possible. * feat: dependabot workflow automation for updating dependency Signed-off-by: Pratik Raj <rajpratik71@gmail.com> * Bump github.com/fsnotify/fsnotify from 1.4.9 to 1.6.0 (jpillora#389) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * UDP buffer size override with CHISEL_UDP_MAX_SIZE environment variable (jpillora#367) * Add locking around the connection count to fix a data race. (jpillora#342) Co-authored-by: andres-portainer <andres-portainer@users.noreply.github.com> * fix: small typo error in main.go (jpillora#334) * Respond to /health and /version by request path rather than by the whole url string (jpillora#328) Co-authored-by: bar <foo@example.org> * Update version.go (jpillora#288) * Providing chisel's client with a logger level (jpillora#281) Co-authored-by: Barak Sharoni <barak.sharoni@velocity.tech> Co-authored-by: barak-sharoni-velocity <81081183+barak-sharoni-velocity@users.noreply.github.com> * add EnvBool * Fix jpillora#390: Use code to generate certificates for client & server (jpillora#400) * docker alpine->google-distroless * docker to use scratch * Fix missing NetDialContext: c.config.DialContext (jpillora#398) * actions: setup go v3 * switch to scratch image * update dependabot * move chisel to flyio * update from upstream --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Pratik Raj <rajpratik71@gmail.com> Co-authored-by: ip-rw <s@ip.rw> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pratik Raj <Rajpratik71@gmail.com> Co-authored-by: Jaime Pillora <jpillora@gmail.com> Co-authored-by: fsiegmund <siegmund@slb.com> Co-authored-by: andres-portainer <91705312+andres-portainer@users.noreply.github.com> Co-authored-by: andres-portainer <andres-portainer@users.noreply.github.com> Co-authored-by: 0xflotus <0xflotus@gmail.com> Co-authored-by: BigSully <BigSully@users.noreply.github.com> Co-authored-by: bar <foo@example.org> Co-authored-by: invist <35263248+c-f@users.noreply.github.com> Co-authored-by: zuzgon <zuzgon@gmail.com> Co-authored-by: Barak Sharoni <barak.sharoni@velocity.tech> Co-authored-by: barak-sharoni-velocity <81081183+barak-sharoni-velocity@users.noreply.github.com> Co-authored-by: Jaime Pillora <dev@jpillora.com> Co-authored-by: Guillaume SMAHA <GuillaumeSmaha@users.noreply.github.com>
* bump versions * bump versions * trigger actions
* bump versions
* bumped version * bumped version
* Set ServerName (SNI) to *hostname. Useful for spoofing our way through restrictive gateways. * Bump actions/checkout from 2 to 3.1.0 Bumps [actions/checkout](https://github.com/actions/checkout) from 2 to 3.1.0. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](actions/checkout@v2...v3.1.0) --- updated-dependencies: - dependency-name: actions/checkout dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * Added --sni switch to control the ServerName when connecting with TLS. Makes 'domain fronting' possible. * feat: dependabot workflow automation for updating dependency Signed-off-by: Pratik Raj <rajpratik71@gmail.com> * Bump github.com/fsnotify/fsnotify from 1.4.9 to 1.6.0 (jpillora#389) Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * UDP buffer size override with CHISEL_UDP_MAX_SIZE environment variable (jpillora#367) * Add locking around the connection count to fix a data race. (jpillora#342) Co-authored-by: andres-portainer <andres-portainer@users.noreply.github.com> * fix: small typo error in main.go (jpillora#334) * Respond to /health and /version by request path rather than by the whole url string (jpillora#328) Co-authored-by: bar <foo@example.org> * Update version.go (jpillora#288) * Providing chisel's client with a logger level (jpillora#281) Co-authored-by: Barak Sharoni <barak.sharoni@velocity.tech> Co-authored-by: barak-sharoni-velocity <81081183+barak-sharoni-velocity@users.noreply.github.com> * add EnvBool * Fix jpillora#390: Use code to generate certificates for client & server (jpillora#400) * docker alpine->google-distroless * docker to use scratch * Fix missing NetDialContext: c.config.DialContext (jpillora#398) * actions: setup go v3 * switch to scratch image * update dependabot * move chisel to flyio * Bump to Go 1.21 (jpillora#440) Co-authored-by: cmeng <cmenginnz@gmail.com> * add arm v5 builds (jpillora#395) * Sync with upstream --------- Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Pratik Raj <rajpratik71@gmail.com> Co-authored-by: ip-rw <s@ip.rw> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Pratik Raj <Rajpratik71@gmail.com> Co-authored-by: Jaime Pillora <jpillora@gmail.com> Co-authored-by: fsiegmund <siegmund@slb.com> Co-authored-by: andres-portainer <91705312+andres-portainer@users.noreply.github.com> Co-authored-by: andres-portainer <andres-portainer@users.noreply.github.com> Co-authored-by: 0xflotus <0xflotus@gmail.com> Co-authored-by: BigSully <BigSully@users.noreply.github.com> Co-authored-by: bar <foo@example.org> Co-authored-by: invist <35263248+c-f@users.noreply.github.com> Co-authored-by: zuzgon <zuzgon@gmail.com> Co-authored-by: Barak Sharoni <barak.sharoni@velocity.tech> Co-authored-by: barak-sharoni-velocity <81081183+barak-sharoni-velocity@users.noreply.github.com> Co-authored-by: Jaime Pillora <dev@jpillora.com> Co-authored-by: Guillaume SMAHA <GuillaumeSmaha@users.noreply.github.com> Co-authored-by: cmeng <cmenginnz@gmail.com> Co-authored-by: maurerr <maurerr@users.noreply.github.com>
* feat(RDGRS-662): build image * feat(RDGRS-662): restore test CI and dependabot * feat(RDGRS-662): test CI only on linux * feat(RDGRS-662): add version to goreleaser
* fix(RDGRS-662): server side keep alive From chisel#442 . Not tested * feat(RDGRS-662): build image (#20) (#21) * feat(RDGRS-662): build image * feat(RDGRS-662): restore test CI and dependabot * feat(RDGRS-662): test CI only on linux * feat(RDGRS-662): add version to goreleaser * Revert "feat(RDGRS-662): build image (#20) (#21)" This reverts commit a0feabe. * feat(RDGRS-662): add explicit timer stop
* chore(RDGRS-662): remove reference updates and add replace * adding replace
Version update of upstream
* go/libs versions updated
* Added .gitattributes to ensure .github/workflows/ci.yml doesn't get merged from upstream.
* dependabots minor update
Go version updated from 1.23.8 to 1.24.6 to address security vulnerabilities. Consolidated Dependabot updates Updated CODEOWNERS file to reflect the PaaS team as owners.
* Bump Go version * Fix: Force GOTOOLCHAIN=local to use installed Go 1.25.6 * reset to default config * chore: align go version with master (1.25.5) * updated goreleaser to use dockerfile
* updated goreleaser to use dockerfile * updated base image * updated goreleaser
* Bump Go version * Fix: Force GOTOOLCHAIN=local to use installed Go 1.25.6 * reset to default config * chore: align go version with master (1.25.5) * updated goreleaser to use dockerfile * updated base image * updated goreleaser * updated Dockerfile * updated Dockerfile
* Security Patch * Removed GRS from Codeowners
…d) (#48) Initialize comprehensive project documentation for the chisel fork: - ARCHITECTURE.md with system diagrams and design decisions - CONTRIBUTING.md with build, test, and PR guidelines - CLAUDE.md with AI agent guidance and quick-reference
Cherry-picked from upstream commit 44310b6. Previously, authfile ACL restrictions were only checked during the initial config handshake. This adds ACL enforcement at the tunnel layer when processing SSH channel requests, ensuring that each outbound connection is validated against the user's allowed addresses. This is a security enhancement that closes a gap where ACL restrictions could potentially be bypassed after initial authentication. Note: Dependency update commits (57d2249, 4df5fcf) were not included as the fork already has newer dependency versions than upstream v1.11.5. Co-authored-by: Jaime Pillora <dev@jpillora.com>
* security patch * dependency updates
…#56) * RDODCP-917: Update golang.org/x dependencies to match cloud-connector * RDODCP-917: Bump Go to 1.26.4 (mitigate CVE-2026-42504)
* Fix race in tunnel waitGroup causing negative counter panic (jpillora#586) Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Improve SOCKS auth: enforce per-user ACL on socks channels (jpillora#591) Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com> * clean workspace dependencies for release * Add .trivyignore to suppress CVE-2026-48113 false positive Trivy flags CVE-2026-48113 on our build because the OutSystems fork tag `1.11.5-os.N` is a SemVer pre-release of `1.11.5`, sorting below the fixed version. The fix is already present via PR #51. Ref: RDODCP-917 * Remove .trivyignore * Wire Verbose flag to client logger level (upstream jpillora#281) The Verbose field was present in Config but never used. Apply the missing half of upstream commit 200a8e2: set Logger.Info = c.Verbose so callers can control log verbosity programmatically. --------- Co-authored-by: Jaime Pillora <jpillora@gmail.com> Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Reliability, security, and observability across client/server/tunnel: keepalive ping timeouts, TCP half-close propagation, dial-before-accept, graceful SIGTERM shutdown, UDP flow-cap sweep, pre-auth WS size cap, SOCKS ACL enforcement + live authfile reload, exact legacy-fingerprint match, --auth validation, session/failed-login logs, jpillora#608 panic fix, goreleaser multi-arch Docker images, and a two-stage release pipeline (draft + versioned images at tag time; latest promoted on publish). Full detail: 1.12-changes.md, the PR (34 commits), and https://jpillora.com/chisel-112-ux-review Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- remove the local opts module replacement\n- upgrade opts to v1.8.1 for margin-aware help wrapping\n\nCo-Authored-By: Codex GPT-5 <noreply@openai.com>
- build releases with Go 1.27.0 - update x/crypto to v0.55.0 for GO-2026-6303 Co-Authored-By: Codex GPT-5.2 <noreply@openai.com>
- record only listener peers observed from inbound UDP - expire and cap peer state, rejecting untrusted destinations - cover reverse UDP flow and destination validation Co-Authored-By: Codex GPT-5 <noreply@openai.com>
OutSystems uses Azure DevOps for releases with security scanning. The upstream promote.yml workflow references jpillora registries and conflicts with our release pipeline. Applied merge=ours strategy (same as ci.yml) to preserve our empty file during future upstream syncs.
…HIGH severity vulnerabilities blocking Azure pipeline: - GO-2026-6354: SSH security issue - GO-2026-6355: SSH security issue The v0.55.0 update only fixed GO-2026-6303. This completes the security patch by upgrading to v0.56.0 which addresses all remaining HIGH CVEs in golang.org/x/crypto. No breaking changes - tested with existing test suite.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
RDODCP-914: Chisel Upstream Sync (v1.12.1) and Dependency Updates
Summary
Syncs OutSystems Chisel fork with upstream v1.12.1, bringing reliability improvements, security fixes, and dependency updates.
Key Changes
Security & Reliability:
Features:
optslibrary for better flag parsingDependencies:
Files Changed
main.go,client/,server/,share/tunnel/test/e2e/(ACL reload, UDP caps, keepalive, half-close)Upstream Sync Status
Synced commits: 7/7 relevant upstream commits from v1.11.7 → v1.12.1
Excluded: 3 upstream commits (CI/release pipeline changes specific to jpillora/chisel)
Fork-Specific Exclusions:
.github/workflows/ci.yml- Empty (Azure DevOps CI).github/workflows/promote.yml- Empty (Azure DevOps release pipeline)merge=oursstrategy to preserve OutSystems infrastructureTesting
Commits
Release Notes
Target version: v1.11.8-os.3.0