mirror of
https://gitea.com/gitea/tea.git
synced 2026-10-26 19:11:25 +01:00
bircni
c5f674111a
Reverts #1126, #1125, #1124, #1123 and #1122. `go.mod` keeps the Go 1.26 line with toolchain `go1.26.9` (instead of the original `go1.26.6`) so the security fix from #1131 isn't lost. reopens #69 reopens #141 reopens #162 reopens #172 reopens #197 reopens #232 reopens #240 reopens #246 reopens #323 reopens #325 reopens #326 reopens #328 reopens #344 reopens #351 reopens #373 reopens #403 reopens #406 reopens #417 reopens #430 reopens #457 reopens #480 reopens #482 reopens #489 reopens #490 reopens #498 reopens #500 reopens #504 reopens #510 reopens #516 reopens #523 reopens #556 reopens #560 reopens #569 reopens #571 reopens #602 reopens #632 reopens #633 reopens #643 reopens #666 reopens #670 reopens #672 reopens #677 reopens #683 reopens #697 reopens #726 reopens #737 reopens #770 reopens #779 reopens #804 reopens #817 reopens #831 reopens #833 reopens #834 reopens #908 reopens #966 reopens #1023 reopens #1029 reopens #1032 reopens #1050 reopens #1052 reopens #1069 reopens #1073 reopens #1087 reopens #1091 reopens #1094 reopens #1110 reopens #1115 reopens #1116 reopens #1118 Reviewed-on: https://gitea.com/gitea/tea/pulls/1146 Reviewed-by: TheFox0x7 <95654+thefox0x7@noreply.gitea.com>
58 lines
2.5 KiB
Go
58 lines
2.5 KiB
Go
// Copyright 2026 The Gitea Authors. All rights reserved.
|
|
// SPDX-License-Identifier: MIT
|
|
|
|
package httputil
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net"
|
|
"net/http"
|
|
"time"
|
|
)
|
|
|
|
// Timeout values applied to every Gitea API request. These are deliberately
|
|
// connection-establishment and time-to-first-response-byte timeouts, NOT an
|
|
// overall request deadline: a large release-attachment upload can legitimately
|
|
// run for minutes, and as long as bytes keep flowing none of these fire. They
|
|
// only trip when a server accepts the connection but never (or far too slowly)
|
|
// starts responding — the "hangs forever" case from a stalled or unresponsive
|
|
// server (issue #1018).
|
|
const (
|
|
// DialTimeout bounds establishing the TCP connection.
|
|
DialTimeout = 10 * time.Second
|
|
// TLSHandshakeTimeout bounds completing the TLS handshake.
|
|
TLSHandshakeTimeout = 10 * time.Second
|
|
// ResponseHeaderTimeout bounds the wait, after the request is written, for
|
|
// the server to begin sending response headers. This is the only timeout
|
|
// that protects against a server which accepts the connection but then goes
|
|
// silent — the originally reported #1018 symptom; DialTimeout/
|
|
// TLSHandshakeTimeout do not, because the connection already succeeded.
|
|
//
|
|
// The value must clear Gitea's legitimate synchronous pre-response work.
|
|
// Profiling a self-hosted Gitea 1.24.6 (on hardware slower than gitea.com)
|
|
// showed creating a pull request that triggers conflict detection across
|
|
// ~1500 changed files takes ~10s before the first byte (3 runs: 10.06 /
|
|
// 10.08 / 10.24s); clean-diff PR creation was ~1s and large attachment
|
|
// uploads ~9ms. 120s is ~12x that measured worst case, leaving generous
|
|
// headroom for larger repos and busier servers while still failing in two
|
|
// minutes instead of hanging forever.
|
|
ResponseHeaderTimeout = 120 * time.Second
|
|
)
|
|
|
|
// timeoutTransport returns an *http.Transport configured with tea's standard
|
|
// timeouts. The supplied tlsConfig is attached as-is (callers use it for
|
|
// insecure / skip-verify logins). It is a clone of http.DefaultTransport so
|
|
// connection pooling, proxy support and HTTP/2 keep working. Callers obtain it
|
|
// through WrapTransport, which also adds the User-Agent header.
|
|
func timeoutTransport(tlsConfig *tls.Config) *http.Transport {
|
|
t := http.DefaultTransport.(*http.Transport).Clone()
|
|
t.DialContext = (&net.Dialer{
|
|
Timeout: DialTimeout,
|
|
KeepAlive: 30 * time.Second,
|
|
}).DialContext
|
|
t.TLSHandshakeTimeout = TLSHandshakeTimeout
|
|
t.ResponseHeaderTimeout = ResponseHeaderTimeout
|
|
t.TLSClientConfig = tlsConfig
|
|
return t
|
|
}
|