Commits
- Commit:
fe6a8988670d1e54478187f93e22a1980f5926e4
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
call realpath() during early startup in gotd's parse.y
This ensures that all repositories exist when the process is first started.
It will also help to avoid an "rpath" pledge promise in a future gotd which
uses a separate session process, by avoiding realpath() calls while starting
new processes.
- Commit:
1487ee74528d56ab29c4bda3f1812fe857abeb18
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
do not treat nonexistent repositories as a fatal error in gotd
- Commit:
0d26b72c238283ec77e4080f4aba81590a912473
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
gotd: delete unreachable code after gotd_shutdown()
- Commit:
d4940d40064a4fd732c26af1bb551d1ff633852d
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
revoke filesystem access in gotd listen process via unveil(2)
This should avoid involuntary use of bind(2) with arbitrary socket paths.
ok op@
- Commit:
c8cf682107ebbe81da9db3dbd267c51ff151b049
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
expose 'gotctl info' output only to the root user
Now that anyone can connect to the socket, it is probably safer to
expose information about currently connected clients only to root.
- Commit:
f2fc8ce0a3b225e5408c9b26476e395ca7109e63
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
remove the gotsh group requirement from gotd; any user can now connect
Repository access is now controlled by access rules in gotd.conf,
and concurrent connections to the gotd socket by local users are
limited by the listen process. We should keep refining our anti-DoS
measures in the future, but at least we have something in place now.
ok jamsek, op
- Commit:
0781db0e2428460cdb0b48d3797899eede6afa44
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
introduce connection options to gotd.conf
Allow administrators to tweak the default authentication and request
timeouts if needed, and to tweak the limit of concurrent connections
for specific user accounts.
with several tweaks from and ok op@
- Commit:
16373356309bbffea15297b273af79c2c62d9c8b
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fmt
- Commit:
46ecc01f5bf28403be0e41b8438bfbec24faadef
- From:
- Mark Jamsek <mark@jamsek.dev>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
gotd: nix trailing whitespace and indentation fix
ok op@, stsp@
- Commit:
b942ab080a771fcaa36e5806fe6ee2ad2a311c8a
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
remove filesystem access via bind(2) from gotd auth process
op@ pointed out a problem in my initial patch where I forgot
to call unveil(2) with a path before unveil(NULL, NULL).
ok op, jamsek
- Commit:
0bcde4c8df9f0fc2d418667c5f91831a88a6a425
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
move "unix" pledge promise from gotd parent to auth process
The listen process now communicates the client UID/GID to the parent,
and the auth process verifies this on behalf of the parent.
This allows us to remove the "unix" pledge promise from the parent,
removing parent access to syscalls such as listen() and accept() in
the AF_UNIX domain.
ok tracey@ op@
- Commit:
95ef3f8a77725d7ef0d173b0c0da5e8089ba0645
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix gotd authentication timeout
The authentication timeout was accidentally overriden by the request timeout.
Fix this and set both timeouts in the same place for clarity.
ok op@
- Commit:
c669c4892eacfb82355f0fa66bcafe84a600040e
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
run gotd authentication in a separate child process
ok op@
- Commit:
85b37c721947934fb06881ad45bb72f3fed91da9
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fork gotd repo_read/repo_write children on demand
ok op, jamsek
- Commit:
3e7c54e1399c45d211f67d16b6a5ea9310e774d3
- From:
- Omar Polo <op@omarpolo.com>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
gotd: tweak error message if getpwnam fails
errno may not be set to something interesting so switch to fatalx, and
simplify the error message (knowing the failed function, which is also
wrong, doesn't buy much here.)
ok jamsek
- Commit:
414e37cb372bbd59f72febdb05c68456c2bff9eb
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
switch gotd from chroot(2) to unveil(2)
In the future, gotd will fork+exec new processes for each client connection.
Using unveil instead of chroot avoids having to start such processes as root.
The -portable version could use chroot(2) where no equivalent to unveil(2)
exists. A future component which starts new processes will be isolated as
a separate process, which could run as root in the -portable version.
ok op@
- Commit:
2b3d32a184dad78705d52ecd06a87282ca9340ba
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
add a gotd "listen" process which watches the unix socket
ok op@
- Commit:
1eec6e4e1a57b96e578a3d92788fd803330a7cdf
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix gotd startup without any -v options
- Commit:
bb3a6ce991b3210583bd710c3b959c544cc3e28f
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
rename GOTD_SOCK_FILENO to GOTD_FILENO_MSG_PIPE for clarity (it's not a socket)
- Commit:
7c55ad47894887b0799d0f0bb8d93419f51ade61
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
tedu Ted's copyright added to gotd.c by accident; doas-derived code is in auth.c
- Commit:
ff260661299dea92ad32c7d92d4e206bac21fb1b
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix group membership check in gotd auth
ok op@
- Commit:
729a7e249e3aa74792dbeb9b1b02cf6638e00312
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
implement per-repository read/write authorization rules in gotd
ok op@
- Commit:
c2ff0c53ce7237c9073d4d552823ff62ed2f1958
- From:
- Josiah Frentsos <jfrent@tilde.team>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
gotd: Don't include stdlib.h twice
- Commit:
965fcba660e4b5245c9fafb15153269228e11c9d
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
fix crash in gotd if client gets disconnected on error; reported by Mikhail
- Commit:
fc2a50f28951c340fb573e7fcb0646ddf93fde8f
- From:
- Stefan Sperling <stsp@stsp.name>
- Via:
- Thomas Adam <thomas@xteddy.org>
- Date:
use mkstemps(3) instead of mkstemp(3) for opening named temporary files
Allows 'got commit' to use a ".diff" suffix for temporary diff files.
ok op@