Disable MPTCP on tesseract binaries

cmd/tesseract/aws/main.go

@@ -12,6 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Temporary MPTCP fix, needs to be above package declaration:
+//go:debug multipathtcp=0
+
 // The ct_server binary runs the CT personality.
 package main
 
@@ -56,11 +59,11 @@ func init() {
 
 // Global flags that affect all log instances.
 var (
-	notAfterStart           timestampFlag
-	notAfterLimit           timestampFlag
+	notAfterStart                   timestampFlag
+	notAfterLimit                   timestampFlag
 	rootsRejectFingerprints         multiStringFlag
 	intermediatesRejectFingerprints multiStringFlag
-	dedupRL                 float64
+	dedupRL                         float64
 
 	// Functionality flags
 	httpEndpoint             = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).")

cmd/tesseract/gcp/main.go

@@ -12,6 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Temporary MPTCP fix, needs to be above package declaration:
+//go:debug multipathtcp=0
+
 // The ct_server binary runs the CT personality.
 package main
 
@@ -70,24 +73,24 @@ var (
 	dedupRL           float64
 
 	// Functionality flags
-	httpEndpoint             = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).")
-	maskInternalErrors       = flag.Bool("mask_internal_errors", false, "Don't return error strings with Internal Server Error HTTP responses.")
-	origin                   = flag.String("origin", "", "Origin of the log, for checkpoints. This MUST match the log's submission prefix as per https://c2sp.org/static-ct-api.")
-	pathPrefix               = flag.String("path_prefix", "", "Prefix to use on endpoints URL paths: HOST:PATH_PREFIX/ct/v1/ENDPOINT.")
-	rootsPemFile             = flag.String("roots_pem_file", "", "Path to the file containing root certificates that are acceptable to the log.")
-	rootsRemoteFetchURLs     multiStringFlag
-	rootsRemoteFetchInterval = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "Interval between two fetches from roots_fetch_url, e.g. \"1h\".")
+	httpEndpoint                    = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).")
+	maskInternalErrors              = flag.Bool("mask_internal_errors", false, "Don't return error strings with Internal Server Error HTTP responses.")
+	origin                          = flag.String("origin", "", "Origin of the log, for checkpoints. This MUST match the log's submission prefix as per https://c2sp.org/static-ct-api.")
+	pathPrefix                      = flag.String("path_prefix", "", "Prefix to use on endpoints URL paths: HOST:PATH_PREFIX/ct/v1/ENDPOINT.")
+	rootsPemFile                    = flag.String("roots_pem_file", "", "Path to the file containing root certificates that are acceptable to the log.")
+	rootsRemoteFetchURLs            multiStringFlag
+	rootsRemoteFetchInterval        = flag.Duration("roots_remote_fetch_interval", time.Duration(0), "Interval between two fetches from roots_fetch_url, e.g. \"1h\".")
 	rootsRejectFingerprints         multiStringFlag
 	intermediatesRejectFingerprints multiStringFlag
-	rejectExpired            = flag.Bool("reject_expired", false, "If true then the certificate validity period will be checked against the current time during the validation of submissions. This will cause expired certificates to be rejected.")
-	rejectUnexpired          = flag.Bool("reject_unexpired", false, "If true then TesseraCT rejects certificates that are either currently valid or not yet valid.")
-	extKeyUsages             = flag.String("ext_key_usages", "Any", "If set, will restrict the set of such usages that the server will accept. By default, 'Any' accepts all chains. Accepted values are defined in internal/ct.")
-	rejectExtensions         = flag.String("reject_extension", "", "A list of X.509 extension OIDs, in dotted string form (e.g. '2.3.4.5') which, if present, should cause submissions to be rejected.")
-	acceptSHA1               = flag.Bool("accept_sha1_signing_algorithms", true, "If true, accept chains that use SHA-1 based signing algorithms. This flag will eventually be removed, and such algorithms will be rejected.")
-	enablePublicationAwaiter = flag.Bool("enable_publication_awaiter", true, "If true, waits for the submitted certificate to be covered by a published checkpoint before responding to an add-* request.")
-	witnessPolicyFile        = flag.String("witness_policy_file", "", "(Optional) Path to the file containing the witness policy in the format described at https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/doc/policy.md")
-	witnessTimeout           = flag.Duration("witness_timeout", tessera.DefaultWitnessTimeout, "Maximum time to wait for witness responses.")
-	notBeforeRL              = flag.String("rate_limit_old_not_before", "28h:500", "Optionally rate limits submissions with old notBefore dates. Expects a value of with the format: \"<go duration>:<rate limit>\", e.g. \"30d:50\" would impose a limit of 50 certs/s on submissions whose notBefore date is >= 30days old.")
+	rejectExpired                   = flag.Bool("reject_expired", false, "If true then the certificate validity period will be checked against the current time during the validation of submissions. This will cause expired certificates to be rejected.")
+	rejectUnexpired                 = flag.Bool("reject_unexpired", false, "If true then TesseraCT rejects certificates that are either currently valid or not yet valid.")
+	extKeyUsages                    = flag.String("ext_key_usages", "Any", "If set, will restrict the set of such usages that the server will accept. By default, 'Any' accepts all chains. Accepted values are defined in internal/ct.")
+	rejectExtensions                = flag.String("reject_extension", "", "A list of X.509 extension OIDs, in dotted string form (e.g. '2.3.4.5') which, if present, should cause submissions to be rejected.")
+	acceptSHA1                      = flag.Bool("accept_sha1_signing_algorithms", true, "If true, accept chains that use SHA-1 based signing algorithms. This flag will eventually be removed, and such algorithms will be rejected.")
+	enablePublicationAwaiter        = flag.Bool("enable_publication_awaiter", true, "If true, waits for the submitted certificate to be covered by a published checkpoint before responding to an add-* request.")
+	witnessPolicyFile               = flag.String("witness_policy_file", "", "(Optional) Path to the file containing the witness policy in the format described at https://git.glasklar.is/sigsum/core/sigsum-go/-/blob/main/doc/policy.md")
+	witnessTimeout                  = flag.Duration("witness_timeout", tessera.DefaultWitnessTimeout, "Maximum time to wait for witness responses.")
+	notBeforeRL                     = flag.String("rate_limit_old_not_before", "28h:500", "Optionally rate limits submissions with old notBefore dates. Expects a value of with the format: \"<go duration>:<rate limit>\", e.g. \"30d:50\" would impose a limit of 50 certs/s on submissions whose notBefore date is >= 30days old.")
 
 	// Performance flags
 	httpDeadline                = flag.Duration("http_deadline", time.Second*10, "Deadline for HTTP requests.")

cmd/tesseract/posix/main.go

@@ -12,6 +12,9 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// Temporary MPTCP fix, needs to be above package declaration:
+//go:debug multipathtcp=0
+
 // The ct_server binary runs the CT personality.
 package main
 
@@ -62,13 +65,13 @@ func init() {
 
 // Global flags that affect all log instances.
 var (
-	notAfterStart           timestampFlag
-	notAfterLimit           timestampFlag
-	additionalSigners       multiStringFlag
+	notAfterStart                   timestampFlag
+	notAfterLimit                   timestampFlag
+	additionalSigners               multiStringFlag
 	rootsRejectFingerprints         multiStringFlag
 	intermediatesRejectFingerprints multiStringFlag
-	rootsRemoteFetchURLs    multiStringFlag
-	dedupRL                 float64
+	rootsRemoteFetchURLs            multiStringFlag
+	dedupRL                         float64
 
 	// Functionality flags
 	httpEndpoint             = flag.String("http_endpoint", "localhost:6962", "Endpoint for HTTP (host:port).")