Commit Graph

9 Commits

Author SHA1 Message Date
Omar Polo e45334e6ae move hosts into the config struct 2023-06-09 16:54:04 +00:00
Omar Polo 5d22294a59 move fastcgi from global var to the config struct
while here also make them a list rather than a fixed-size array.
2023-06-09 10:42:36 +00:00
Omar Polo deadd9e131 readd proxy certs and `require client ca' support
Was temporarly disabled during the transition to real privsep.
While here, fix a memory leak when using `require client ca'.

Also, avoid leaking info about the parent address space layout to
server processes by not sending pointer values.
2023-06-09 09:28:26 +00:00
Omar Polo 9b2587bb33 safety measure, explicitly memset config in config_init 2023-06-08 19:35:05 +00:00
Omar Polo 1c6967b33a keep cert/key/ocsp path as strings and don't send them via imsg 2023-06-08 19:34:49 +00:00
Omar Polo f5c8360ade fix previous 2023-06-08 19:24:37 +00:00
Omar Polo 4f4937f06a move make_socket to config.c and make it private 2023-06-08 16:07:01 +00:00
Omar Polo c26f2460e4 rework the daemon to do fork+exec
It uses the 'common' proc.c from various OpenBSD-daemons.

gmid grew organically bit by bit and it was also the first place where I
tried to implement privsep.  It wasn't done very well, in fact the
parent process (that retains root privileges) just fork()s a generation
of servers, all sharing *exactly* the same address space.  No good!

Now, we fork() and re-exec() ourselves, so that each process has a fresh
address space.

Some features (require client ca for example) are temporarly disabled,
will be fixed in subsequent commits.  The "ge" program is also
temporarly disabled as it needs tweaks to do privsep too.
2023-06-08 13:59:31 +00:00
Omar Polo c68baad22a move config-related code to config.c
reuse it in ge too.
2023-06-06 08:18:57 +00:00