diff --git a/cmd/tesseract/aws/main.go b/cmd/tesseract/aws/main.go index 1f7ce516..f8e45cb4 100644 --- a/cmd/tesseract/aws/main.go +++ b/cmd/tesseract/aws/main.go @@ -12,6 +12,9 @@ // See the License for the specific language governing permissions and // limitations under the License. +// Temporary MPTCP fix, needs to be above package declaration: +//go:debug multipathtcp=0 + // The ct_server binary runs the CT personality. package main @@ -56,11 +59,11 @@ func init() { // Global flags that affect all log instances. var ( - notAfterStart timestampFlag - notAfterLimit timestampFlag + notAfterStart timestampFlag + notAfterLimit timestampFlag rootsRejectFingerprints multiStringFlag intermediatesRejectFingerprints multiStringFlag - dedupRL float64 + dedupRL float64 // Functionality flags httpEndpoint = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).") diff --git a/cmd/tesseract/gcp/main.go b/cmd/tesseract/gcp/main.go index efcfa5ac..a1d90d42 100644 --- a/cmd/tesseract/gcp/main.go +++ b/cmd/tesseract/gcp/main.go @@ -12,6 +12,9 @@ // See the License for the specific language governing permissions and // limitations under the License. +// Temporary MPTCP fix, needs to be above package declaration: +//go:debug multipathtcp=0 + // The ct_server binary runs the CT personality. package main @@ -70,24 +73,24 @@ var ( dedupRL float64 // Functionality flags - httpEndpoint = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).") - maskInternalErrors = flag.Bool("mask_internal_errors", false, "Don't return error strings with Internal Server Error HTTP responses.") - origin = flag.String("origin", "", "Origin of the log, for checkpoints. This MUST match the log's submission prefix as per https://c2sp.org/static-ct-api.") - pathPrefix = flag.String("path_prefix", "", "Prefix to use on endpoints URL paths: HOST:PATH_PREFIX/ct/v1/ENDPOINT.") - rootsPemFile = flag.String("roots_pem_file", "", "Path to the file containing root certificates that are acceptable to the log.") - rootsRemoteFetchURLs multiStringFlag - rootsRemoteFetchInterval = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "Interval between two fetches from roots_fetch_url, e.g. \"1h\".") + httpEndpoint = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).") + maskInternalErrors = flag.Bool("mask_internal_errors", false, "Don't return error strings with Internal Server Error HTTP responses.") + origin = flag.String("origin", "", "Origin of the log, for checkpoints. This MUST match the log's submission prefix as per https://c2sp.org/static-ct-api.") + pathPrefix = flag.String("path_prefix", "", "Prefix to use on endpoints URL paths: HOST:PATH_PREFIX/ct/v1/ENDPOINT.") + rootsPemFile = flag.String("roots_pem_file", "", "Path to the file containing root certificates that are acceptable to the log.") + rootsRemoteFetchURLs multiStringFlag + rootsRemoteFetchInterval = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "Interval between two fetches from roots_fetch_url, e.g. \"1h\".") rootsRejectFingerprints multiStringFlag intermediatesRejectFingerprints multiStringFlag - rejectExpired = flag.Bool("reject_expired", false, "If true then the certificate validity period will be checked against the current time during the validation of submissions. This will cause expired certificates to be rejected.") - rejectUnexpired = flag.Bool("reject_unexpired", false, "If true then TesseraCT rejects certificates that are either currently valid or not yet valid.") - extKeyUsages = flag.String("ext_key_usages", "Any", "If set, will restrict the set of such usages that the server will accept. By default, 'Any' accepts all chains. Accepted values are defined in internal/ct.") - rejectExtensions = flag.String("reject_extension", "", "A list of X.509 extension OIDs, in dotted string form (e.g. '2.3.4.5') which, if present, should cause submissions to be rejected.") - acceptSHA1 = flag.Bool("accept_sha1_signing_algorithms", true, "If true, accept chains that use SHA-1 based signing algorithms. This flag will eventually be removed, and such algorithms will be rejected.") - enablePublicationAwaiter = flag.Bool("enable_publication_awaiter", true, "If true, waits for the submitted certificate to be covered by a published checkpoint before responding to an add-* request.") - witnessPolicyFile = flag.String("witness_policy_file", "", "(Optional) Path to the file containing the witness policy in the format described at https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/doc/policy.md") - witnessTimeout = flag.Duration("witness_timeout", tessera.DefaultWitnessTimeout, "Maximum time to wait for witness responses.") - notBeforeRL = flag.String("rate_limit_old_not_before", "28h:500", "Optionally rate limits submissions with old notBefore dates. Expects a value of with the format: \":\", e.g. \"30d:50\" would impose a limit of 50 certs/s on submissions whose notBefore date is >= 30days old.") + rejectExpired = flag.Bool("reject_expired", false, "If true then the certificate validity period will be checked against the current time during the validation of submissions. This will cause expired certificates to be rejected.") + rejectUnexpired = flag.Bool("reject_unexpired", false, "If true then TesseraCT rejects certificates that are either currently valid or not yet valid.") + extKeyUsages = flag.String("ext_key_usages", "Any", "If set, will restrict the set of such usages that the server will accept. By default, 'Any' accepts all chains. Accepted values are defined in internal/ct.") + rejectExtensions = flag.String("reject_extension", "", "A list of X.509 extension OIDs, in dotted string form (e.g. '2.3.4.5') which, if present, should cause submissions to be rejected.") + acceptSHA1 = flag.Bool("accept_sha1_signing_algorithms", true, "If true, accept chains that use SHA-1 based signing algorithms. This flag will eventually be removed, and such algorithms will be rejected.") + enablePublicationAwaiter = flag.Bool("enable_publication_awaiter", true, "If true, waits for the submitted certificate to be covered by a published checkpoint before responding to an add-* request.") + witnessPolicyFile = flag.String("witness_policy_file", "", "(Optional) Path to the file containing the witness policy in the format described at https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/doc/policy.md") + witnessTimeout = flag.Duration("witness_timeout", tessera.DefaultWitnessTimeout, "Maximum time to wait for witness responses.") + notBeforeRL = flag.String("rate_limit_old_not_before", "28h:500", "Optionally rate limits submissions with old notBefore dates. Expects a value of with the format: \":\", e.g. \"30d:50\" would impose a limit of 50 certs/s on submissions whose notBefore date is >= 30days old.") // Performance flags httpDeadline = flag.Duration("http_deadline", time.Second*10, "Deadline for HTTP requests.") diff --git a/cmd/tesseract/posix/main.go b/cmd/tesseract/posix/main.go index ce3422ad..618beeff 100644 --- a/cmd/tesseract/posix/main.go +++ b/cmd/tesseract/posix/main.go @@ -12,6 +12,9 @@ // See the License for the specific language governing permissions and // limitations under the License. +// Temporary MPTCP fix, needs to be above package declaration: +//go:debug multipathtcp=0 + // The ct_server binary runs the CT personality. package main @@ -62,13 +65,13 @@ func init() { // Global flags that affect all log instances. var ( - notAfterStart timestampFlag - notAfterLimit timestampFlag - additionalSigners multiStringFlag + notAfterStart timestampFlag + notAfterLimit timestampFlag + additionalSigners multiStringFlag rootsRejectFingerprints multiStringFlag intermediatesRejectFingerprints multiStringFlag - rootsRemoteFetchURLs multiStringFlag - dedupRL float64 + rootsRemoteFetchURLs multiStringFlag + dedupRL float64 // Functionality flags httpEndpoint = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).")