This patch release fixes the licensed-region check in Enterprise, which refused SSH clients outside the region even when the device was inside it.
Licensed regions are checked against the device
A license's allowed regions limit where your devices run, but the gateway checked them against the SSH client's address instead. A client outside the region was refused even when the device sat inside it, which blocked automation running in a cloud region in another country.
The gateway now hands the firewall the address the device's agent last authenticated from, and the region check geolocates the device instead of the client (#7926). The client can connect from any country. A device whose country can't be resolved, because of a lookup error, an unknown address range or a missing GeoIP database, is now let through and logged. Before, a miss refused every connection to it.
Also in this release
Internal
- The SSH server's device connection code is split into config, login and serving steps, with no change in behaviour (#7921, #7923)
Full Changelog: v0.30.2...v0.30.3
What's Changed
- refactor(ssh): move a session's device connection out of session.go by @otavio in #7921
- refactor(ssh): split the web terminal's device login from serving it by @otavio in #7923
- fix(server): hand the firewall the device's address by @gustavosbarreto in #7926
- chore: bump shellhub version to v0.30.3 by @gustavosbarreto in #7927
Full Changelog: v0.30.2...v0.30.3