Compare commits

...

27 Commits

Author SHA1 Message Date
Omar Polo 359c56ce35 contrib/gmid.service: remove User and Group
May cause weird errors (status=216/GROUP) on some distros, and
running as root is already the default, so remove the two lines.
Reported by and debugged together with leandro del Flug, thanks!
2024-04-27 17:12:09 +00:00
Omar Polo c2dcb5fa6e contrib/gmid.service: start as root by default
Various techniques used by gmid are effective only when the daemon
is started as root.  Strongly suggest to do so by switching the
sample configuration.  This way, provided that a local user is
created as well, the chroot configuration will work out-of-the-box
and the TLS certificates can be readable only by root.
2024-04-27 16:17:37 +00:00
Omar Polo 5d12e6a104 improve the description for -f 2024-04-27 16:10:46 +00:00
Omar Polo 0d8eb9b60c typo: semicolors -> semicolons 2024-04-11 09:42:15 +00:00
Omar Polo 5864f3ce3c set next version 2024-04-04 19:28:14 +00:00
Omar Polo 9536c8ca63 prepare release 2.0.1 2024-04-04 19:16:33 +00:00
Omar Polo 40b71b6861 changelog for 2.0.2 2024-04-04 19:07:04 +00:00
Omar Polo 42235e3fc2 add a test for the config dumping 2024-04-04 13:07:09 +00:00
Omar Polo f53f5e5fe1 fix config dumping (-nn) handling
with the privsep rework the config dumping was unadvertitely broken,
it prints the content of the key itself.
2024-04-04 11:22:06 +00:00
Omar Polo 40ea7b163e use -Werror=implicit-function-declaration for function detection
the previous -Werror triggers too easily: on NixOS for example the
FORTIFY_SOURCE #warning about a missing optimization level breaks all
the checks when using -O0 (which is the default for non-release builds).
2024-04-03 14:03:42 +00:00
Omar Polo be265175c6 fix landlock test
include stddef.h for size_t
2024-04-03 14:01:34 +00:00
Omar Polo 8aba5d8b21 remove dead code 2024-03-12 14:10:36 +00:00
Omar Polo 7c83689428 update mac CI target to sonoma 2024-03-06 10:11:17 +00:00
Omar Polo 248fb833f9 fix `log access path' with chroot
We should open the log file inside the chroot; missed in
4acf495f41.

See https://github.com/omar-polo/gmid/issues/24
2024-03-03 15:43:58 +00:00
Omar Polo 0ed763b03d revert 9f1cce3d0e
we actually should open the log file in the chroot, the bug is in
the code.
2024-03-03 15:42:06 +00:00
Omar Polo 9f1cce3d0e fix log access doc: path is not relative to the chroot
Reported by Colin Henein, thanks!

See https://github.com/omar-polo/gmid/issues/24
2024-03-03 15:27:03 +00:00
Omar Polo 8f543d941e add a note regarding the usage of the bundled libtls
See https://codeberg.org/op/gmid/issues/2
2024-02-02 08:24:28 +00:00
Omar Polo acf244c516 sync changelog 2024-01-30 09:39:07 +00:00
Anna “CyberTailor” 53ad458e22 contrib/vim: fix indent 2024-01-30 09:35:37 +00:00
Omar Polo bb5a25d287 rename the @common_opt macro back to @common
now common is no longer a reserved keyword
2024-01-30 09:31:09 +00:00
Omar Polo f862d389ff turn log styles into strings from yacc point of view
having styles as reserved keywords means that variables / macros can't
be called `common', `condensed', etc...  which is not great and not
obvious either.

Instead, let's keep the log styles as strings and match on them.  This
also allows to have a slightly better error message in case of a typo.

See: https://codeberg.org/op/gmid/issues/1
2024-01-30 09:30:50 +00:00
Omar Polo 574f71f7a3 remove stray space 2024-01-30 09:28:54 +00:00
Omar Polo ebe2e54900 tweak and update freebsd task 2024-01-26 17:02:08 +00:00
Omar Polo ddb089c157 rework the grammar so that ; is accepted after variables and options
See Codeberg issue #1.
2024-01-26 16:54:58 +00:00
Omar Polo 3524375abe add a test that uses @-style macros
See Codeberg issue #1.
2024-01-26 15:34:46 +00:00
Omar Polo fe37d79200 change the default PUBKEY for the verify-release target
doesn't play well with minor releases such as 2.0.1 since for them
I reuse the 2.0 key.
2024-01-24 15:21:19 +00:00
Omar Polo 33a5425235 set next version 2024-01-24 15:13:35 +00:00
17 changed files with 117 additions and 94 deletions

View File

@ -19,18 +19,18 @@ linux_arm_task:
- make
- make regress REGRESS_HOST="*"
freebsd_13_task:
freebsd_14_task:
freebsd_instance:
image_family: freebsd-13-0
test_script:
- pkg install -y libevent libressl pkgconf
image_family: freebsd-14-0
install_script: pkg install -y libevent libressl pkgconf
script:
- ./configure CFLAGS='-O2 -pipe -Wno-deprecated-declarations' -Werror
- make
- make regress
mac_task:
macos_instance:
image: ghcr.io/cirruslabs/macos-ventura-xcode:latest
image: ghcr.io/cirruslabs/macos-sonoma-xcode:latest
test_script:
- brew install libevent openssl libretls
- PKG_CONFIG_PATH="$(brew --prefix openssl)/lib/pkgconfig" ./configure CFLAGS='-O2 -pipe -Wno-deprecated-declarations' -Werror

View File

@ -1,3 +1,27 @@
2024-04-03 Omar Polo <op@omarpolo.com>
* configure: improve function checking in the configure
* have/landlock.c: fix landlock test
* gmid.c (main_print_conf): fix config dumping with -nn
2024-03-03 Omar Polo <op@omarpolo.com>
* gmid.c: fix `log access path' with a chroot
2024-01-30 Anna “CyberTailor”
* contrib/vim/indent/gmid.vim: fix indent
2024-01-30 Omar Polo <op@omarpolo.com>
* parse.y: don't make log styles reserved keywords. Unbreaks the
example in the manpage with `common = ...'.
2024-01-26 Omar Polo <op@omarpolo.com>
* parse.y: rework grammar to allow the semicolon after
variables/macros definition and top-level options
2024-01-24 Omar Polo <op@omarpolo.com>
* configure (VERSION): release 2.0.1

View File

@ -131,7 +131,7 @@ y.tab.c: parse.y
lint:
man -Tlint -Wstyle -l gmid.8 gmid.conf.5 gemexp.1 gg.1 titan.1
PUBKEY = keys/gmid-${VERSION}.pub
PUBKEY = keys/gmid-2.0.pub
PRIVKEY = set-PRIVKEY
DISTFILES = .cirrus.yml .dockerignore .gitignore ChangeLog LICENSE \
Makefile README.md config.c configure crypto.c dirs.c fcgi.c \

8
configure vendored
View File

@ -19,7 +19,7 @@
set -e
RELEASE=no
VERSION=2.0.1
VERSION=2.0.2-current
usage()
{
@ -59,6 +59,10 @@ CDIAGFLAGS="${CDIAGFLAGS} -Wsign-compare -Wno-unused-parameter" # -Wshadow
CDIAGFLAGS="${CDIAGFLAGS} -Wno-missing-field-initializers"
CDIAGFLAGS="${CDIAGFLAGS} -Wno-pointer-sign"
# On all OSes except OpenBSD use the bundled one. It may crash at
# runtime otherwise since we depend on the libtls internals for the
# privsep crypto engine.
# See <https://codeberg.org/op/gmid/issues/2>.
LIBTLS=bundled # or system
if [ "$(uname || true)" = OpenBSD ]; then
LIBTLS=system
@ -142,7 +146,7 @@ NEED_OPENBSD_SOURCE=0
NEED_LIBBSD_OPENBSD_VIS=0
COMPATS=
COMP="${CC} ${CFLAGS} -Wno-unused -Werror"
COMP="${CC} ${CFLAGS} -Werror=implicit-function-declaration"
# singletest name var extra-cflags extra-libs msg
singletest() {

View File

@ -6,8 +6,6 @@ Wants=network-online.target
[Service]
Type=simple
User=gmid
Group=nobody
ExecStart=/usr/local/bin/gmid -f -c /etc/gmid.conf
ExecStop=/bin/kill -TERM $MAINPID
ExecReload=/bin/kill -HUP $MAINPID

View File

@ -9,3 +9,5 @@ setlocal indentexpr=
setlocal cindent
" Just make sure that the comments are not reset as defs would be.
setlocal cinkeys-=0#
" And indentation works correctly without semicolons.
setlocal cinoptions=+0

7
gmid.8
View File

@ -1,4 +1,4 @@
.\" Copyright (c) 2021, 2022, 2023 Omar Polo <op@omarpolo.com>
.\" Copyright (c) 2021, 2022, 2023, 2024 Omar Polo <op@omarpolo.com>
.\"
.\" Permission to use, copy, modify, and distribute this software for any
.\" purpose with or without fee is hereby granted, provided that the above
@ -11,7 +11,7 @@
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.Dd October 20, 2023
.Dd April 27, 2024
.Dt GMID 8
.Os
.Sh NAME
@ -52,7 +52,8 @@ Overrides the definition of
.Ar macro
in the config file if present.
.It Fl f
Stays and logs on the foreground.
Do not daemonize.
Stay and log in the foreground.
.It Fl h , Fl -help
Print the usage and exit.
.It Fl n

6
gmid.c
View File

@ -412,7 +412,7 @@ main_send_logfd(struct conf *conf)
goto done;
}
fd = open(conf->log_access, O_WRONLY|O_CREAT|O_APPEND, 0600);
fd = open(path, O_WRONLY|O_CREAT|O_APPEND, 0600);
if (fd == -1)
log_warn("can't open %s", conf->log_access);
}
@ -605,8 +605,8 @@ main_print_conf(struct conf *conf)
TAILQ_FOREACH(h, &conf->hosts, vhosts) {
printf("\nserver \"%s\" {\n", h->domain);
printf(" cert \"%s\"\n", h->cert);
printf(" key \"%s\"\n", h->key);
printf(" cert \"%s\"\n", h->cert_path);
printf(" key \"%s\"\n", h->key_path);
/* TODO: print locations... */
printf("}\n");
}

View File

@ -11,7 +11,7 @@
.\" WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
.\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
.\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
.Dd January 11, 2024
.Dd April 4, 2024
.Dt GMID.CONF 5
.Os
.Sh NAME
@ -384,7 +384,7 @@ The port the server is listening on.
.Dq GEMINI
.It Ev SERVER_SOFTWARE
The name and version of the server, i.e.
.Dq gmid/2.0.1
.Dq gmid/2.0.2
.It Ev REMOTE_USER
The subject of the client certificate if provided, otherwise unset.
.It Ev TLS_CLIENT_ISSUER

1
gmid.h
View File

@ -412,7 +412,6 @@ void mark_nonblock(int);
void client_write(struct bufferevent *, void *);
int start_reply(struct client*, int, const char*);
void client_close(struct client *);
struct client *client_by_id(int);
void server_accept(int, short, void *);
void server_init(struct privsep *, struct privsep_proc *, void *);
int server_configure_done(struct conf *);

View File

@ -19,6 +19,8 @@
#include <sys/stat.h>
#include <sys/syscall.h>
#include <stddef.h>
#ifndef landlock_create_ruleset
static inline int
landlock_create_ruleset(const struct landlock_ruleset_attr *attr, size_t size,

89
parse.y
View File

@ -1,7 +1,7 @@
%{
/*
* Copyright (c) 2021, 2022, 2023 Omar Polo <op@omarpolo.com>
* Copyright (c) 2021-2024 Omar Polo <op@omarpolo.com>
* Copyright (c) 2018 Florian Obser <florian@openbsd.org>
* Copyright (c) 2004, 2005 Esben Norby <norby@openbsd.org>
* Copyright (c) 2004 Ryan McBride <mcbride@openbsd.org>
@ -46,7 +46,7 @@ static struct file {
TAILQ_ENTRY(file) entry;
FILE *stream;
char *name;
size_t ungetpos;
size_t ungetpos;
size_t ungetsize;
u_char *ungetbuf;
int eof_reached;
@ -92,11 +92,9 @@ char *ensure_absolute_path(char*);
int check_block_code(int);
char *check_block_fmt(char*);
int check_strip_no(int);
int check_port_num(int);
int check_prefork_num(int);
void advance_loc(void);
void advance_proxy(void);
void parsehp(char *, char **, const char **, const char *);
int fastcgi_conf(const char *, const char *);
void add_param(char *, char *);
int getservice(const char *);
@ -125,12 +123,12 @@ typedef struct {
%token ACCESS ALIAS AUTO
%token BLOCK
%token CA CERT CHROOT CLIENT COMBINED COMMON CONDENSED
%token CA CERT CHROOT CLIENT
%token DEFAULT
%token FACILITY FASTCGI FOR_HOST
%token INCLUDE INDEX IPV6
%token KEY
%token LANG LEGACY LISTEN LOCATION LOG
%token LANG LISTEN LOCATION LOG
%token OCSP OFF ON
%token PARAM PORT PREFORK PROTO PROTOCOLS PROXY
%token RELAY_TO REQUIRE RETURN ROOT
@ -150,13 +148,12 @@ typedef struct {
%%
conf : /* empty */
| conf include '\n'
| conf '\n'
| conf varset '\n'
| conf option '\n'
| conf vhost '\n'
| conf types '\n'
| conf error '\n' { file->errors++; }
| conf include nl
| conf varset nl
| conf option nl
| conf vhost nl
| conf types nl
| conf error nl { file->errors++; }
;
include : INCLUDE STRING {
@ -265,17 +262,18 @@ logopt : ACCESS string {
free(conf->log_access);
conf->log_access = $2;
}
| STYLE COMMON {
conf->log_format = LOG_FORMAT_COMMON;
}
| STYLE COMBINED {
conf->log_format = LOG_FORMAT_COMBINED;
}
| STYLE CONDENSED {
conf->log_format = LOG_FORMAT_CONDENSED;
}
| STYLE LEGACY {
conf->log_format = LOG_FORMAT_LEGACY;
| STYLE string {
if (!strcmp("combined", $2))
conf->log_format = LOG_FORMAT_COMBINED;
else if (!strcmp("common", $2))
conf->log_format = LOG_FORMAT_COMMON;
else if (!strcmp("condensed", $2))
conf->log_format = LOG_FORMAT_CONDENSED;
else if (!strcmp("legacy", $2))
conf->log_format = LOG_FORMAT_LEGACY;
else
yyerror("unknown log style: %s", $2);
free($2);
}
| SYSLOG FACILITY string {
const char *str = $3;
@ -617,7 +615,7 @@ mediaopts_l : mediaopts_l mediaoptsl nl
mediaoptsl : STRING {
free(current_media);
current_media = $1;
} medianames_l optsemicolon
} medianames_l
| include
;
@ -633,17 +631,13 @@ medianamesl : numberstring {
;
nl : '\n' optnl
| ';' optnl
;
optnl : '\n' optnl /* zero or more newlines */
| ';' optnl /* semicolons too */
optnl : nl
| /*empty*/
;
optsemicolon : ';'
|
;
%%
static const struct keyword {
@ -659,9 +653,6 @@ static const struct keyword {
{"cert", CERT},
{"chroot", CHROOT},
{"client", CLIENT},
{"combined", COMBINED},
{"common", COMMON},
{"condensed", CONDENSED},
{"default", DEFAULT},
{"facility", FACILITY},
{"fastcgi", FASTCGI},
@ -671,7 +662,6 @@ static const struct keyword {
{"ipv6", IPV6},
{"key", KEY},
{"lang", LANG},
{"legacy", LEGACY},
{"listen", LISTEN},
{"location", LOCATION},
{"log", LOG},
@ -1211,16 +1201,6 @@ check_strip_no(int n)
return n;
}
int
check_port_num(int n)
{
if (n <= 0 || n >= UINT16_MAX)
yyerror("port number is %s: %d",
n <= 0 ? "too small" : "too large",
n);
return n;
}
int
check_prefork_num(int n)
{
@ -1243,25 +1223,6 @@ advance_proxy(void)
TAILQ_INSERT_TAIL(&host->proxies, proxy, proxies);
}
void
parsehp(char *str, char **host, const char **port, const char *def)
{
char *at;
const char *errstr;
*host = str;
if ((at = strchr(str, ':')) != NULL) {
*at++ = '\0';
*port = at;
} else
*port = def;
strtonum(*port, 1, UINT16_MAX, &errstr);
if (errstr != NULL)
yyerror("port is %s: %s", errstr, *port);
}
int
fastcgi_conf(const char *path, const char *port)
{

View File

@ -20,6 +20,9 @@ fi
run_test test_punycode
run_test test_iri
# Run configuration dumping test.
run_test test_dump_config
if [ "${SKIP_RUNTIME_TESTS:-0}" -eq 1 ]; then
echo
echo "======================"

View File

@ -8,6 +8,34 @@ test_iri() {
./iri_test
}
test_dump_config() {
dont_check_server_alive=yes
gen_config '' ''
exp="$(mktemp)"
got="$(mktemp)"
cat <<EOF >$exp
prefork 3
server "localhost" {
cert "$PWD/localhost.pem"
key "$PWD/localhost.key"
}
EOF
$gmid -nn -c reg.conf > $got 2>/dev/null
ret=0
if ! cmp -s "$exp" "$got"; then
echo "config differs!" >&2
diff -u "$exp" "$got" >&2
ret=1
fi
rm "$exp" "$got"
return $ret
}
test_gemexp() {
dont_check_server_alive=yes
@ -287,6 +315,7 @@ test_fastcgi_deprecated_syntax() {
test_macro_expansion() {
cat <<EOF > reg.conf
pwd = "$PWD"
common = "lang it; auto index on"
server "localhost" {
# the quoting of \$ is for sh
@ -294,6 +323,7 @@ server "localhost" {
key \$pwd "/localhost.key"
root \$pwd "/testdata"
listen on $REGRESS_HOST port $port
@common
}
EOF
@ -305,7 +335,7 @@ EOF
run
fetch /
check_reply "20 text/gemini" "# hello world"
check_reply "20 text/gemini;lang=it" "# hello world"
}
test_proxy_relay_to() {

View File

@ -1329,15 +1329,6 @@ server_accept(int sock, short et, void *d)
connected_clients++;
}
struct client *
client_by_id(int id)
{
struct client find;
find.id = id;
return SPLAY_FIND(client_tree_id, &clients, &find);
}
static void
handle_siginfo(int fd, short ev, void *d)
{

View File

@ -21,7 +21,7 @@ REPOLOGY_URL = https://repology.org/project/gmid/versions
SUBST = ./subst GITHUB=https://github.com/omar-polo/gmid \
SITE=https://ftp.omarpolo.com \
VERS=2.0.1 \
VERS=2.0.2 \
PUBKEY=gmid-2.0.pub \
TREE=https://github.com/omar-polo/gmid/blob/master

View File

@ -1,5 +1,13 @@
# change log
## 2024/04/04 - 2.0.2 “Lady Stardust” bugfix release
- fix `log access path' with `chroot' enabled.
- fix config dumping (-nn).
- rework grammar to allow semicolons after top-level statements.
- don't make the log styles reserved keywords.
- contrib/vim: fixed indent, from Anna “CyberTailor”, thanks!
## 2024/01/24 - 2.0.1 “Lady Stardust” bugfix release
* convert gmid to the new imsg API