Resync master w/upstream #2

Basically the function formerly known as do_main() in main.go has
been renamed launch() and moved into launch.go.  Now there are
main.go and main_unix.go files implementing minmial main()
functions which load a config and pass it to launch.  This allows
separating unix-specific security stuff (both the actual system
calls which won't compile on other platforms and the definition
of command line switches) out from the platform agnostic
implementation of the main server logic.  It also simplifies the
interaction of relative paths in config files with chrooting.

Docs still need updating...

67386cd118 Update README to reflect movement of unix security stuff out of config file into command line switches.

d67f896b84 Add AllowTLS12 option to switch minimum TLS version between 1.2 and 1.3.

800c181668 Ensure supplied TLS certificate is valid for configured hostname.

0274ef8f35 Print warning about expired certificates.

c50accfaec Only drop supplementary groups if root is amongst them.

a9dab7b48c Argh, fix stupid typo.

bff3d6d486 Restore logging functionality after some subtle variable declaration scoping bugs wiped it out!

e70ec82594 Don't try to be clever about when to request client certs: we never know what could be in a .molly file.

eb85a6e94c Another big refactor, splitting the Config struct in two.

The split reflects that between variables which can and cannot be
overridden by .molly files, and this greatly simplifies the
processing of said files, getting rid of the need for lots of
ugly temporary variable thrashing.

f9585ff2b7 Rearrange the logic of handling requests without changing behaviour.

The new order handles certificate zones and redirects defined in the
system-wide config file as well as SCGI paths as early as possible
without doing any unecessary filesystem operations and especially
without the potentially expensive search for .molly files.

eefb1bc3a6 Further simplifications of config parsing code.

d3d415b612 Add missing return.

81b4f1dcc0 Fix small variable name error.

bd07cb3507 Check for errors when parsing TLS certificates even after successful PEM decoding.

3a03995f26 Actually, be *more* clever about client certs...(see e70ec)

e30f39b196 Fix typo in error message.

72a94cab00 Restore Go 1.15 compatibility.

c4866d2965 Check for a CGI path prefix before insisting that an exact path exists on disk. Closes #36 .

5016f40edb Initial implementation of leaky bucket rate limiting.

a6170a355d Make rate limiting configurable.

3c5835f033 Continue to increment drips once bucket is overflowing.

efde852c54 Refactor rate limiting to have soft and hard limits, block clients exceeding hard limits for one hour.

4b9a7e8ad5 Correctly implement bans for clients exceeding hard limit.

8e618a6304 Double hard limit ban durations each time.

4b54eb6134 Set 30 second deadline for reading requests. See #35 .

2c3225c1c0 Fix crash when CGI processes end without writing anything at all to stdout. Closes #38 .

6f0865447d Adds leaky token bucket rate limiting with bans for non-compliant clients.

051df29604 Add a write deadline with maximum allowed download time derived from filesize. See #35 .

1b7d661abd Type trashing to fix last commit.

64a4ff72f0 Remove debugging Println.

2068c3b02a Allow to disable directory listing

Signed-off-by: Solderpunk <solderpunk@posteo.net>

Russtopia merged commit 27bbae5418 into master

2023-09-07 02:07:32 +00:00

Russtopia referenced this issue from a commit

2023-09-07 02:07:33 +00:00

Merge pull request 'Resync master w/upstream' (#2) from solderpunk/molly-brown:master into master

Sign in to join this conversation.

No reviewers

No Label

No Milestone

No project

No Assignees

1 Participants

Notifications

Due Date

The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: Russtopia/molly-brown#2