status: Reintroduce StatusSensitiveInput

This commit is a follow-up to 56774408 which does not take into account
the case that the parent directory of the known_hosts file does not already exist.

certificate/create.go

@@ -1,4 +1,4 @@
-// Package certificate provides utility functions for TLS certificates.
+// Package certificate provides functions for creating and storing TLS certificates.
 package certificate
 
 import (

certificate/store.go

@@ -6,46 +6,55 @@ import (
 	"crypto/x509/pkix"
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
 	"strings"
 	"sync"
 	"time"
 )
 
-// Store represents a certificate store.
+// A Store represents a TLS certificate store.
 // The zero value for Store is an empty store ready to use.
 //
+// Store can be used to store server certificates.
+// Servers should provide a hostname or wildcard pattern as a certificate scope.
+// Servers will most likely use the methods Register, Load and Get.
+//
+// Store can also be used to store client certificates.
+// Clients should provide a hostname as a certificate scope.
+// Clients will most likely use the methods Add, Load, and Lookup.
+//
 // Store is safe for concurrent use by multiple goroutines.
 type Store struct {
-	// CreateCertificate, if not nil, is called to create a new certificate
-	// to replace a missing or expired certificate. If CreateCertificate
-	// is nil, a certificate with a duration of 1 year will be created.
+	// CreateCertificate, if not nil, is called by Get to create a new
+	// certificate to replace a missing or expired certificate.
+	// The provided scope is suitable for use in a certificate's DNSNames.
 	CreateCertificate func(scope string) (tls.Certificate, error)
 
-	certs map[string]tls.Certificate
-	path  string
-	mu    sync.RWMutex
+	scopes map[string]struct{}
+	certs  map[string]tls.Certificate
+	path   string
+	mu     sync.RWMutex
 }
 
-// Register registers the provided scope in the certificate store.
-// The certificate will be created upon calling GetCertificate.
+// Register registers the provided scope with the certificate store.
+// The scope can either be a hostname or a wildcard pattern (e.g. "*.example.com").
+// To accept all hostnames, use the special pattern "*".
+//
+// Calls to Get will only succeed for registered scopes.
+// Other methods are not affected.
 func (s *Store) Register(scope string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	if s.certs == nil {
-		s.certs = make(map[string]tls.Certificate)
+	if s.scopes == nil {
+		s.scopes = make(map[string]struct{})
 	}
-	s.certs[scope] = tls.Certificate{}
+	s.scopes[scope] = struct{}{}
 }
 
-// Add adds a certificate for the given scope to the certificate store.
+// Add registers the certificate for the given scope.
+// If a certificate already exists for scope, Add will overwrite it.
 func (s *Store) Add(scope string, cert tls.Certificate) error {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-	if s.certs == nil {
-		s.certs = make(map[string]tls.Certificate)
-	}
-
 	// Parse certificate if not already parsed
 	if cert.Leaf == nil {
 		parsed, err := x509.ParseCertificate(cert.Certificate[0])
@@ -55,20 +64,76 @@ func (s *Store) Add(scope string, cert tls.Certificate) error {
 		cert.Leaf = parsed
 	}
 
+	if err := s.write(scope, cert); err != nil {
+		return err
+	}
+
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if s.certs == nil {
+		s.certs = make(map[string]tls.Certificate)
+	}
+	s.certs[scope] = cert
+	return nil
+}
+
+func (s *Store) write(scope string, cert tls.Certificate) error {
+	s.mu.RLock()
+	defer s.mu.RUnlock()
 	if s.path != "" {
-		// Escape slash character
-		path := strings.ReplaceAll(scope, "/", ":")
-		certPath := filepath.Join(s.path, path+".crt")
-		keyPath := filepath.Join(s.path, path+".key")
+		certPath := filepath.Join(s.path, scope+".crt")
+		keyPath := filepath.Join(s.path, scope+".key")
 		if err := Write(cert, certPath, keyPath); err != nil {
 			return err
 		}
 	}
-
-	s.certs[scope] = cert
 	return nil
 }
 
+// Get retrieves a certificate for the given hostname.
+// If no matching scope has been registered, Get returns an error.
+// Get generates new certificates as needed and rotates expired certificates.
+// It calls CreateCertificate to create a new certificate if it is not nil,
+// otherwise it creates certificates with a duration of 100 years.
+//
+// Get is suitable for use in a gemini.Server's GetCertificate field.
+func (s *Store) Get(hostname string) (*tls.Certificate, error) {
+	s.mu.RLock()
+	_, ok := s.scopes[hostname]
+	if !ok {
+		// Try wildcard
+		wildcard := strings.SplitN(hostname, ".", 2)
+		if len(wildcard) == 2 {
+			hostname = "*." + wildcard[1]
+			_, ok = s.scopes[hostname]
+		}
+	}
+	if !ok {
+		// Try "*"
+		_, ok = s.scopes["*"]
+	}
+	if !ok {
+		s.mu.RUnlock()
+		return nil, errors.New("unrecognized scope")
+	}
+	cert := s.certs[hostname]
+	s.mu.RUnlock()
+
+	// If the certificate is empty or expired, generate a new one.
+	if cert.Leaf == nil || cert.Leaf.NotAfter.Before(time.Now()) {
+		var err error
+		cert, err = s.createCertificate(hostname)
+		if err != nil {
+			return nil, err
+		}
+		if err := s.Add(hostname, cert); err != nil {
+			return nil, fmt.Errorf("failed to add certificate for %s: %w", hostname, err)
+		}
+	}
+
+	return &cert, nil
+}
+
 // Lookup returns the certificate for the provided scope.
 func (s *Store) Lookup(scope string) (tls.Certificate, bool) {
 	s.mu.RLock()
@@ -77,41 +142,6 @@ func (s *Store) Lookup(scope string) (tls.Certificate, bool) {
 	return cert, ok
 }
 
-// GetCertificate retrieves the certificate for the given scope.
-// If the retrieved certificate is expired or the scope is registered but
-// has no certificate, it calls CreateCertificate to create a new certificate.
-func (s *Store) GetCertificate(scope string) (*tls.Certificate, error) {
-	cert, ok := s.Lookup(scope)
-	if !ok {
-		// Try wildcard
-		wildcard := strings.SplitN(scope, ".", 2)
-		if len(wildcard) == 2 {
-			cert, ok = s.Lookup("*." + wildcard[1])
-		}
-	}
-	if !ok {
-		// Try "*"
-		_, ok = s.Lookup("*")
-	}
-	if !ok {
-		return nil, errors.New("unrecognized scope")
-	}
-
-	// If the certificate is empty or expired, generate a new one.
-	if cert.Leaf == nil || cert.Leaf.NotAfter.Before(time.Now()) {
-		var err error
-		cert, err = s.createCertificate(scope)
-		if err != nil {
-			return nil, err
-		}
-		if err := s.Add(scope, cert); err != nil {
-			return nil, fmt.Errorf("failed to add certificate for %s: %w", scope, err)
-		}
-	}
-
-	return &cert, nil
-}
-
 func (s *Store) createCertificate(scope string) (tls.Certificate, error) {
 	if s.CreateCertificate != nil {
 		return s.CreateCertificate(scope)
@@ -121,17 +151,21 @@ func (s *Store) createCertificate(scope string) (tls.Certificate, error) {
 		Subject: pkix.Name{
 			CommonName: scope,
 		},
-		Duration: 365 * 24 * time.Hour,
+		Duration: 100 * 365 * 24 * time.Hour,
 	})
 }
 
 // Load loads certificates from the provided path.
 // New certificates will be written to this path.
-//
 // The path should lead to a directory containing certificates
 // and private keys named "scope.crt" and "scope.key" respectively,
 // where "scope" is the scope of the certificate.
 func (s *Store) Load(path string) error {
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return err
+	}
+
+	path = filepath.Clean(path)
 	matches, err := filepath.Glob(filepath.Join(path, "*.crt"))
 	if err != nil {
 		return err
@@ -142,12 +176,15 @@ func (s *Store) Load(path string) error {
 		if err != nil {
 			continue
 		}
-		scope := strings.TrimSuffix(filepath.Base(crtPath), ".crt")
-		// Unescape slash character
-		scope = strings.ReplaceAll(scope, ":", "/")
+
+		scope := strings.TrimPrefix(crtPath, path)
+		scope = strings.TrimPrefix(scope, "/")
+		scope = strings.TrimSuffix(scope, ".crt")
 		s.Add(scope, cert)
 	}
-	s.SetPath(path)
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	s.path = path
 	return nil
 }
 
@@ -166,5 +203,5 @@ func (s *Store) Entries() map[string]tls.Certificate {
 func (s *Store) SetPath(path string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
-	s.path = path
+	s.path = filepath.Clean(path)
 }

client.go

@@ -4,43 +4,38 @@ import (
 	"context"
 	"crypto/tls"
 	"crypto/x509"
-	"errors"
 	"net"
 	"net/url"
-	"time"
+	"unicode/utf8"
+
+	"golang.org/x/net/idna"
 )
 
 // A Client is a Gemini client. Its zero value is a usable client.
 type Client struct {
-	// TrustCertificate is called to determine whether the client
-	// should trust the certificate provided by the server.
-	// If TrustCertificate is nil, the client will accept any certificate.
-	// If the returned error is not nil, the certificate will not be trusted
+	// TrustCertificate is called to determine whether the client should
+	// trust the certificate provided by the server.
+	// If TrustCertificate is nil or returns nil, the client will accept
+	// any certificate. Otherwise, the certificate will not be trusted
 	// and the request will be aborted.
 	//
 	// See the tofu submodule for an implementation of trust on first use.
 	TrustCertificate func(hostname string, cert *x509.Certificate) error
 
-	// Timeout specifies a time limit for requests made by this
-	// Client. The timeout includes connection time and reading
-	// the response body. The timer remains running after
-	// Get or Do return and will interrupt reading of the Response.Body.
-	//
-	// A Timeout of zero means no timeout.
-	Timeout time.Duration
-
 	// DialContext specifies the dial function for creating TCP connections.
 	// If DialContext is nil, the client dials using package net.
 	DialContext func(ctx context.Context, network, addr string) (net.Conn, error)
 }
 
 // Get sends a Gemini request for the given URL.
+// The context controls the entire lifetime of a request and its response:
+// obtaining a connection, sending the request, and reading the response
+// header and body.
 //
 // An error is returned if there was a Gemini protocol error.
 // A non-2x status code doesn't cause an error.
 //
-// If the returned error is nil, the Response will contain a non-nil Body
-// which the user is expected to close.
+// If the returned error is nil, the user is expected to close the Response.
 //
 // For more control over requests, use NewRequest and Client.Do.
 func (c *Client) Get(ctx context.Context, url string) (*Response, error) {
@@ -51,16 +46,15 @@ func (c *Client) Get(ctx context.Context, url string) (*Response, error) {
 	return c.Do(ctx, req)
 }
 
-// Do sends a Gemini request and returns a Gemini response, following
-// policy as configured on the client.
+// Do sends a Gemini request and returns a Gemini response.
+// The context controls the entire lifetime of a request and its response:
+// obtaining a connection, sending the request, and reading the response
+// header and body.
 //
 // An error is returned if there was a Gemini protocol error.
 // A non-2x status code doesn't cause an error.
 //
-// If the returned error is nil, the Response will contain a non-nil Body
-// which the user is expected to close.
-//
-// Generally Get will be used instead of Do.
+// If the returned error is nil, the user is expected to close the Response.
 func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 	if ctx == nil {
 		panic("nil context")
@@ -75,15 +69,17 @@ func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 	if host != punycode {
 		host = punycode
 
-		// Make a copy of the request
-		r2 := new(Request)
-		*r2 = *req
-		r2.URL = new(url.URL)
-		*r2.URL = *req.URL
-		req = r2
+		// Copy the URL and update the host
+		u := new(url.URL)
+		*u = *req.URL
+		u.Host = net.JoinHostPort(host, port)
 
-		// Set the host
-		req.URL.Host = net.JoinHostPort(host, port)
+		// Use the new URL in the request so that the server gets
+		// the punycoded hostname
+		r := new(Request)
+		*r = *req
+		r.URL = u
+		req = r
 	}
 
 	// Use request host if provided
@@ -98,17 +94,11 @@ func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 	addr := net.JoinHostPort(host, port)
 
 	// Connect to the host
-	start := time.Now()
 	conn, err := c.dialContext(ctx, "tcp", addr)
 	if err != nil {
 		return nil, err
 	}
 
-	// Set the connection deadline
-	if c.Timeout != 0 {
-		conn.SetDeadline(start.Add(c.Timeout))
-	}
-
 	// Setup TLS
 	conn = tls.Client(conn, &tls.Config{
 		InsecureSkipVerify: true,
@@ -132,7 +122,7 @@ func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 
 	res := make(chan result, 1)
 	go func() {
-		resp, err := c.do(conn, req)
+		resp, err := c.do(ctx, conn, req)
 		res <- result{resp, err}
 	}()
 
@@ -145,23 +135,33 @@ func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 	}
 }
 
-func (c *Client) do(conn net.Conn, req *Request) (*Response, error) {
+func (c *Client) do(ctx context.Context, conn net.Conn, req *Request) (*Response, error) {
+	ctx, cancel := context.WithCancel(ctx)
+	done := ctx.Done()
+	w := &contextWriter{
+		ctx:    ctx,
+		done:   done,
+		cancel: cancel,
+		wc:     conn,
+	}
+	rc := &contextReader{
+		ctx:    ctx,
+		done:   done,
+		cancel: cancel,
+		rc:     conn,
+	}
+
 	// Write the request
-	if err := req.Write(conn); err != nil {
+	if _, err := req.WriteTo(w); err != nil {
 		return nil, err
 	}
 
 	// Read the response
-	resp, err := ReadResponse(conn)
+	resp, err := ReadResponse(rc)
 	if err != nil {
 		return nil, err
 	}
-
-	// Store TLS connection state
-	if tlsConn, ok := conn.(*tls.Conn); ok {
-		state := tlsConn.ConnectionState()
-		resp.TLS = &state
-	}
+	resp.conn = conn
 
 	return resp, nil
 }
@@ -170,21 +170,11 @@ func (c *Client) dialContext(ctx context.Context, network, addr string) (net.Con
 	if c.DialContext != nil {
 		return c.DialContext(ctx, network, addr)
 	}
-	return (&net.Dialer{
-		Timeout: c.Timeout,
-	}).DialContext(ctx, network, addr)
+	return (&net.Dialer{}).DialContext(ctx, network, addr)
 }
 
 func (c *Client) verifyConnection(cs tls.ConnectionState, hostname string) error {
 	cert := cs.PeerCertificates[0]
-	// Verify hostname
-	if err := verifyHostname(cert, hostname); err != nil {
-		return err
-	}
-	// Check expiration date
-	if !time.Now().Before(cert.NotAfter) {
-		return errors.New("gemini: certificate expired")
-	}
 	// See if the client trusts the certificate
 	if c.TrustCertificate != nil {
 		return c.TrustCertificate(hostname, cert)
@@ -202,3 +192,23 @@ func splitHostPort(hostport string) (host, port string) {
 	}
 	return
 }
+
+func isASCII(s string) bool {
+	for i := 0; i < len(s); i++ {
+		if s[i] >= utf8.RuneSelf {
+			return false
+		}
+	}
+	return true
+}
+
+// punycodeHostname returns the punycoded version of hostname.
+func punycodeHostname(hostname string) (string, error) {
+	if net.ParseIP(hostname) != nil {
+		return hostname, nil
+	}
+	if isASCII(hostname) {
+		return hostname, nil
+	}
+	return idna.Lookup.ToASCII(hostname)
+}

doc.go

@@ -4,7 +4,8 @@ Package gemini provides Gemini client and server implementations.
 Client is a Gemini client.
 
 	client := &gemini.Client{}
-	resp, err := client.Get("gemini://example.com")
+	ctx := context.Background()
+	resp, err := client.Get(ctx, "gemini://example.com")
 	if err != nil {
 		// handle error
 	}
@@ -21,11 +22,12 @@ Server is a Gemini server.
 Servers should be configured with certificates:
 
 	certificates := &certificate.Store{}
+	certificates.Register("localhost")
 	err := certificates.Load("/var/lib/gemini/certs")
 	if err != nil {
 		// handle error
 	}
-	server.GetCertificate = certificates.GetCertificate
+	server.GetCertificate = certificates.Get
 
 ServeMux is a Gemini request multiplexer.
 ServeMux can handle requests for multiple hosts and schemes.
@@ -44,7 +46,8 @@ ServeMux can handle requests for multiple hosts and schemes.
 
 To start the server, call ListenAndServe:
 
-	err := server.ListenAndServe(context.Background())
+	ctx := context.Background()
+	err := server.ListenAndServe(ctx)
 	if err != nil {
 		// handle error
 	}

examples/auth.go

@@ -38,7 +38,7 @@ func main() {
 		Handler:        mux,
 		ReadTimeout:    30 * time.Second,
 		WriteTimeout:   1 * time.Minute,
-		GetCertificate: certificates.GetCertificate,
+		GetCertificate: certificates.Get,
 	}
 
 	if err := server.ListenAndServe(context.Background()); err != nil {
@@ -52,11 +52,12 @@ func fingerprint(cert *x509.Certificate) string {
 }
 
 func profile(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
-	if len(r.TLS.PeerCertificates) == 0 {
+	tls := r.TLS()
+	if len(tls.PeerCertificates) == 0 {
 		w.WriteHeader(gemini.StatusCertificateRequired, "Certificate required")
 		return
 	}
-	fingerprint := fingerprint(r.TLS.PeerCertificates[0])
+	fingerprint := fingerprint(tls.PeerCertificates[0])
 	user, ok := users[fingerprint]
 	if !ok {
 		user = &User{}
@@ -67,7 +68,8 @@ func profile(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
 }
 
 func changeUsername(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
-	if len(r.TLS.PeerCertificates) == 0 {
+	tls := r.TLS()
+	if len(tls.PeerCertificates) == 0 {
 		w.WriteHeader(gemini.StatusCertificateRequired, "Certificate required")
 		return
 	}
@@ -77,7 +79,7 @@ func changeUsername(ctx context.Context, w gemini.ResponseWriter, r *gemini.Requ
 		w.WriteHeader(gemini.StatusInput, "Username")
 		return
 	}
-	fingerprint := fingerprint(r.TLS.PeerCertificates[0])
+	fingerprint := fingerprint(tls.PeerCertificates[0])
 	user, ok := users[fingerprint]
 	if !ok {
 		user = &User{}

examples/client.go

@@ -6,7 +6,6 @@ package main
 
 import (
 	"bufio"
-	"bytes"
 	"context"
 	"crypto/x509"
 	"errors"
@@ -16,7 +15,6 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
-	"time"
 
 	"git.sr.ht/~adnano/go-gemini"
 	"git.sr.ht/~adnano/go-gemini/tofu"
@@ -61,15 +59,14 @@ Otherwise, this should be safe to trust.
 => `
 
 func trustCertificate(hostname string, cert *x509.Certificate) error {
-	host := tofu.NewHost(hostname, cert.Raw, cert.NotAfter)
-
+	host := tofu.NewHost(hostname, cert.Raw)
 	knownHost, ok := hosts.Lookup(hostname)
-	if ok && time.Now().Before(knownHost.Expires) {
+	if ok {
 		// Check fingerprint
-		if bytes.Equal(knownHost.Fingerprint, host.Fingerprint) {
-			return nil
+		if knownHost.Fingerprint != host.Fingerprint {
+			return errors.New("error: fingerprint does not match!")
 		}
-		return errors.New("error: fingerprint does not match!")
+		return nil
 	}
 
 	fmt.Printf(trustPrompt, hostname, host.Fingerprint)
@@ -87,7 +84,7 @@ func trustCertificate(hostname string, cert *x509.Certificate) error {
 	}
 }
 
-func getInput(prompt string, sensitive bool) (input string, ok bool) {
+func getInput(prompt string) (input string, ok bool) {
 	fmt.Printf("%s ", prompt)
 	scanner.Scan()
 	return scanner.Text(), true
@@ -97,14 +94,15 @@ func do(req *gemini.Request, via []*gemini.Request) (*gemini.Response, error) {
 	client := gemini.Client{
 		TrustCertificate: trustCertificate,
 	}
-	resp, err := client.Do(context.Background(), req)
+	ctx := context.Background()
+	resp, err := client.Do(ctx, req)
 	if err != nil {
 		return resp, err
 	}
 
 	switch resp.Status.Class() {
 	case gemini.StatusInput:
-		input, ok := getInput(resp.Meta, resp.Status == gemini.StatusSensitiveInput)
+		input, ok := getInput(resp.Meta)
 		if !ok {
 			break
 		}
@@ -156,11 +154,10 @@ func main() {
 
 	// Handle response
 	if resp.Status.Class() == gemini.StatusSuccess {
-		body, err := io.ReadAll(resp.Body)
+		_, err := io.Copy(os.Stdout, resp.Body)
 		if err != nil {
 			log.Fatal(err)
 		}
-		fmt.Print(string(body))
 	} else {
 		fmt.Printf("%d %s\n", resp.Status, resp.Meta)
 		os.Exit(1)

examples/server.go

@@ -8,6 +8,7 @@ import (
 	"context"
 	"log"
 	"os"
+	"os/signal"
 	"time"
 
 	"git.sr.ht/~adnano/go-gemini"
@@ -25,13 +26,33 @@ func main() {
 	mux.Handle("/", gemini.FileServer(os.DirFS("/var/www")))
 
 	server := &gemini.Server{
-		Handler:        mux,
+		Handler:        gemini.LoggingMiddleware(mux),
 		ReadTimeout:    30 * time.Second,
 		WriteTimeout:   1 * time.Minute,
-		GetCertificate: certificates.GetCertificate,
+		GetCertificate: certificates.Get,
 	}
 
-	if err := server.ListenAndServe(context.Background()); err != nil {
+	// Listen for interrupt signal
+	c := make(chan os.Signal, 1)
+	signal.Notify(c, os.Interrupt)
+
+	errch := make(chan error)
+	go func() {
+		ctx := context.Background()
+		errch <- server.ListenAndServe(ctx)
+	}()
+
+	select {
+	case err := <-errch:
 		log.Fatal(err)
+	case <-c:
+		// Shutdown the server
+		log.Println("Shutting down...")
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
+		defer cancel()
+		err := server.Shutdown(ctx)
+		if err != nil {
+			log.Fatal(err)
+		}
 	}
 }

examples/stream.go

@@ -8,7 +8,6 @@ import (
 	"context"
 	"fmt"
 	"log"
-	"sync"
 	"time"
 
 	"git.sr.ht/~adnano/go-gemini"
@@ -29,64 +28,27 @@ func main() {
 		Handler:        mux,
 		ReadTimeout:    30 * time.Second,
 		WriteTimeout:   1 * time.Minute,
-		GetCertificate: certificates.GetCertificate,
+		GetCertificate: certificates.Get,
 	}
 
-	var shutdownOnce sync.Once
-	var wg sync.WaitGroup
-	wg.Add(1)
-	defer wg.Wait()
-	mux.HandleFunc("/shutdown", func(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
-		fmt.Fprintln(w, "Shutting down...")
-		if flusher, ok := w.(gemini.Flusher); ok {
-			flusher.Flush()
-		}
-		go shutdownOnce.Do(func() {
-			server.Shutdown(context.Background())
-			wg.Done()
-		})
-	})
-
-	if err := server.ListenAndServe(context.Background()); err != nil {
-		log.Println(err)
+	ctx := context.Background()
+	if err := server.ListenAndServe(ctx); err != nil {
+		log.Fatal(err)
 	}
 }
 
 // stream writes an infinite stream to w.
 func stream(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
-	flusher, ok := w.(gemini.Flusher)
-	if !ok {
-		w.WriteHeader(gemini.StatusTemporaryFailure, "Internal error")
-		return
-	}
-
-	ch := make(chan string)
-	ctx, cancel := context.WithCancel(ctx)
-
-	go func(ctx context.Context) {
-		for {
-			select {
-			case <-ctx.Done():
-				return
-			default:
-				ch <- fmt.Sprint(time.Now().UTC())
-			}
-			time.Sleep(time.Second)
-		}
-		// Close channel when finished.
-		// In this example this will never be reached.
-		close(ch)
-	}(ctx)
-
 	for {
-		s, ok := <-ch
-		if !ok {
-			break
+		select {
+		case <-ctx.Done():
+			return
+		default:
 		}
-		fmt.Fprintln(w, s)
-		if err := flusher.Flush(); err != nil {
-			cancel()
+		fmt.Fprintln(w, time.Now().UTC())
+		if err := w.Flush(); err != nil {
 			return
 		}
+		time.Sleep(time.Second)
 	}
 }

fs.go

@@ -2,6 +2,7 @@ package gemini
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"io"
 	"io/fs"
@@ -12,12 +13,6 @@ import (
 	"strings"
 )
 
-func init() {
-	// Add Gemini mime types
-	mime.AddExtensionType(".gmi", "text/gemini")
-	mime.AddExtensionType(".gemini", "text/gemini")
-}
-
 // FileServer returns a handler that serves Gemini requests with the contents
 // of the provided file system.
 //
@@ -33,7 +28,7 @@ type fileServer struct {
 }
 
 func (fs fileServer) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
-	serveFile(ctx, w, r, fs, path.Clean(r.URL.Path), true)
+	serveFile(w, r, fs, path.Clean(r.URL.Path), true)
 }
 
 // ServeContent replies to the request using the content in the
@@ -42,15 +37,15 @@ func (fs fileServer) ServeGemini(ctx context.Context, w ResponseWriter, r *Reque
 //
 // ServeContent tries to deduce the type from name's file extension.
 // The name is otherwise unused; it is never sent in the response.
-func ServeContent(ctx context.Context, w ResponseWriter, r *Request, name string, content io.Reader) {
-	serveContent(ctx, w, name, content)
+func ServeContent(w ResponseWriter, r *Request, name string, content io.Reader) {
+	serveContent(w, name, content)
 }
 
-func serveContent(ctx context.Context, w ResponseWriter, name string, content io.Reader) {
+func serveContent(w ResponseWriter, name string, content io.Reader) {
 	// Detect mimetype from file extension
 	ext := path.Ext(name)
 	mimetype := mime.TypeByExtension(ext)
-	w.MediaType(mimetype)
+	w.SetMediaType(mimetype)
 	io.Copy(w, content)
 }
 
@@ -64,8 +59,8 @@ func serveContent(ctx context.Context, w ResponseWriter, name string, content io
 //
 // As a precaution, ServeFile will reject requests where r.URL.Path contains a
 // ".." path element; this protects against callers who might unsafely use
-// filepath.Join on r.URL.Path without sanitizing it and then use that
-// filepath.Join result as the name argument.
+// path.Join on r.URL.Path without sanitizing it and then use that
+// path.Join result as the name argument.
 //
 // As another special case, ServeFile redirects any request where r.URL.Path
 // ends in "/index.gmi" to the same path, without the final "index.gmi". To
@@ -74,17 +69,17 @@ func serveContent(ctx context.Context, w ResponseWriter, name string, content io
 // Outside of those two special cases, ServeFile does not use r.URL.Path for
 // selecting the file or directory to serve; only the file or directory
 // provided in the name argument is used.
-func ServeFile(ctx context.Context, w ResponseWriter, r *Request, fsys fs.FS, name string) {
+func ServeFile(w ResponseWriter, r *Request, fsys fs.FS, name string) {
 	if containsDotDot(r.URL.Path) {
 		// Too many programs use r.URL.Path to construct the argument to
 		// serveFile. Reject the request under the assumption that happened
 		// here and ".." may not be wanted.
 		// Note that name might not contain "..", for example if code (still
-		// incorrectly) used filepath.Join(myDir, r.URL.Path).
+		// incorrectly) used path.Join(myDir, r.URL.Path).
 		w.WriteHeader(StatusBadRequest, "invalid URL path")
 		return
 	}
-	serveFile(ctx, w, r, fsys, name, false)
+	serveFile(w, r, fsys, name, false)
 }
 
 func containsDotDot(v string) bool {
@@ -101,7 +96,7 @@ func containsDotDot(v string) bool {
 
 func isSlashRune(r rune) bool { return r == '/' || r == '\\' }
 
-func serveFile(ctx context.Context, w ResponseWriter, r *Request, fsys fs.FS, name string, redirect bool) {
+func serveFile(w ResponseWriter, r *Request, fsys fs.FS, name string, redirect bool) {
 	const indexPage = "/index.gmi"
 
 	// Redirect .../index.gmi to .../
@@ -118,14 +113,14 @@ func serveFile(ctx context.Context, w ResponseWriter, r *Request, fsys fs.FS, na
 
 	f, err := fsys.Open(name)
 	if err != nil {
-		w.WriteHeader(StatusNotFound, "Not found")
+		w.WriteHeader(toGeminiError(err))
 		return
 	}
 	defer f.Close()
 
 	stat, err := f.Stat()
 	if err != nil {
-		w.WriteHeader(StatusTemporaryFailure, "Temporary failure")
+		w.WriteHeader(toGeminiError(err))
 		return
 	}
 
@@ -173,7 +168,7 @@ func serveFile(ctx context.Context, w ResponseWriter, r *Request, fsys fs.FS, na
 		return
 	}
 
-	serveContent(ctx, w, name, f)
+	serveContent(w, name, f)
 }
 
 func dirList(w ResponseWriter, f fs.File) {
@@ -204,3 +199,13 @@ func dirList(w ResponseWriter, f fs.File) {
 		fmt.Fprintln(w, link.String())
 	}
 }
+
+func toGeminiError(err error) (status Status, meta string) {
+	if errors.Is(err, fs.ErrNotExist) {
+		return StatusNotFound, "Not found"
+	}
+	if errors.Is(err, fs.ErrPermission) {
+		return StatusNotFound, "Forbidden"
+	}
+	return StatusTemporaryFailure, "Internal server error"
+}

gemini.go

@@ -2,31 +2,23 @@ package gemini
 
 import (
 	"errors"
+	"mime"
 )
 
+func init() {
+	// Add Gemini mime types
+	mime.AddExtensionType(".gmi", "text/gemini")
+	mime.AddExtensionType(".gemini", "text/gemini")
+}
+
 var crlf = []byte("\r\n")
 
 // Errors.
 var (
-	ErrInvalidURL      = errors.New("gemini: invalid URL")
 	ErrInvalidRequest  = errors.New("gemini: invalid request")
 	ErrInvalidResponse = errors.New("gemini: invalid response")
 
 	// ErrBodyNotAllowed is returned by ResponseWriter.Write calls
 	// when the response status code does not permit a body.
 	ErrBodyNotAllowed = errors.New("gemini: response status code does not allow body")
-
-	// ErrServerClosed is returned by the Server's Serve and ListenAndServe
-	// methods after a call to Shutdown or Close.
-	ErrServerClosed = errors.New("gemini: server closed")
-
-	// ErrAbortHandler is a sentinel panic value to abort a handler.
-	// While any panic from ServeGemini aborts the response to the client,
-	// panicking with ErrAbortHandler also suppresses logging of a stack
-	// trace to the server's error log.
-	ErrAbortHandler = errors.New("gemini: abort Handler")
-
-	// ErrHandlerTimeout is returned on ResponseWriter Write calls
-	// in handlers which have timed out.
-	ErrHandlerTimeout = errors.New("gemini: Handler timeout")
 )

handler.go

@@ -1,9 +1,12 @@
 package gemini
 
 import (
+	"bytes"
 	"context"
+	"io"
 	"net/url"
 	"strings"
+	"time"
 )
 
 // A Handler responds to a Gemini request.
@@ -13,14 +16,10 @@ import (
 // valid to use the ResponseWriter after or concurrently with the completion
 // of the ServeGemini call.
 //
-// Handlers should not modify the provided Request.
+// The provided context is canceled when the client's connection is closed
+// or the ServeGemini method returns.
 //
-// If ServeGemini panics, the server (the caller of ServeGemini) assumes that
-// the effect of the panic was isolated to the active request. It recovers
-// the panic, logs a stack trace to the server error log, and closes the
-// network connection. To abort a handler so the client sees an interrupted
-// response but the server doesn't log an error, panic with the value
-// ErrAbortHandler.
+// Handlers should not modify the provided Request.
 type Handler interface {
 	ServeGemini(context.Context, ResponseWriter, *Request)
 }
@@ -38,24 +37,15 @@ func (f HandlerFunc) ServeGemini(ctx context.Context, w ResponseWriter, r *Reque
 // StatusHandler returns a request handler that responds to each request
 // with the provided status code and meta.
 func StatusHandler(status Status, meta string) Handler {
-	return &statusHandler{status, meta}
-}
-
-type statusHandler struct {
-	status Status
-	meta   string
-}
-
-func (h *statusHandler) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
-	w.WriteHeader(h.status, h.meta)
+	return HandlerFunc(func(ctx context.Context, w ResponseWriter, r *Request) {
+		w.WriteHeader(status, meta)
+	})
 }
 
 // NotFoundHandler returns a simple request handler that replies to each
 // request with a “51 Not found” reply.
 func NotFoundHandler() Handler {
-	return HandlerFunc(func(ctx context.Context, w ResponseWriter, r *Request) {
-		w.WriteHeader(StatusNotFound, "Not found")
-	})
+	return StatusHandler(StatusNotFound, "Not found")
 }
 
 // StripPrefix returns a handler that serves Gemini requests by removing the
@@ -84,3 +74,85 @@ func StripPrefix(prefix string, h Handler) Handler {
 		}
 	})
 }
+
+// TimeoutHandler returns a Handler that runs h with the given time limit.
+//
+// The new Handler calls h.ServeGemini to handle each request, but
+// if a call runs for longer than its time limit, the handler responds with a
+// 40 Temporary Failure status code and the given message in its response meta.
+// After such a timeout, writes by h to its ResponseWriter will return
+// context.DeadlineExceeded.
+func TimeoutHandler(h Handler, dt time.Duration, message string) Handler {
+	return &timeoutHandler{
+		h:   h,
+		dt:  dt,
+		msg: message,
+	}
+}
+
+type timeoutHandler struct {
+	h   Handler
+	dt  time.Duration
+	msg string
+}
+
+func (t *timeoutHandler) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
+	ctx, cancel := context.WithTimeout(ctx, t.dt)
+	defer cancel()
+
+	buf := &bytes.Buffer{}
+	tw := &timeoutWriter{
+		wr: &contextWriter{
+			ctx:    ctx,
+			cancel: cancel,
+			done:   ctx.Done(),
+			wc:     nopCloser{buf},
+		},
+	}
+
+	done := make(chan struct{})
+	go func() {
+		t.h.ServeGemini(ctx, tw, r)
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		w.WriteHeader(tw.status, tw.meta)
+		w.Write(buf.Bytes())
+	case <-ctx.Done():
+		w.WriteHeader(StatusTemporaryFailure, t.msg)
+	}
+}
+
+type timeoutWriter struct {
+	wr          io.Writer
+	status      Status
+	meta        string
+	mediatype   string
+	wroteHeader bool
+}
+
+func (w *timeoutWriter) SetMediaType(mediatype string) {
+	w.mediatype = mediatype
+}
+
+func (w *timeoutWriter) Write(b []byte) (int, error) {
+	if !w.wroteHeader {
+		w.WriteHeader(StatusSuccess, w.mediatype)
+	}
+	return w.wr.Write(b)
+}
+
+func (w *timeoutWriter) WriteHeader(status Status, meta string) {
+	if w.wroteHeader {
+		return
+	}
+	w.status = status
+	w.meta = meta
+	w.wroteHeader = true
+}
+
+func (w *timeoutWriter) Flush() error {
+	return nil
+}

io.go

@@ -0,0 +1,104 @@
+package gemini
+
+import (
+	"bufio"
+	"context"
+	"io"
+)
+
+type contextReader struct {
+	ctx    context.Context
+	done   <-chan struct{}
+	cancel func()
+	rc     io.ReadCloser
+}
+
+func (r *contextReader) Read(p []byte) (int, error) {
+	select {
+	case <-r.done:
+		r.rc.Close()
+		return 0, r.ctx.Err()
+	default:
+	}
+	n, err := r.rc.Read(p)
+	if err != nil {
+		r.cancel()
+	}
+	return n, err
+}
+
+func (r *contextReader) Close() error {
+	r.cancel()
+	return r.rc.Close()
+}
+
+type contextWriter struct {
+	ctx    context.Context
+	done   <-chan struct{}
+	cancel func()
+	wc     io.WriteCloser
+}
+
+func (w *contextWriter) Write(b []byte) (int, error) {
+	select {
+	case <-w.done:
+		w.wc.Close()
+		return 0, w.ctx.Err()
+	default:
+	}
+	n, err := w.wc.Write(b)
+	if err != nil {
+		w.cancel()
+	}
+	return n, err
+}
+
+func (w *contextWriter) Close() error {
+	w.cancel()
+	return w.wc.Close()
+}
+
+type nopCloser struct {
+	io.Writer
+}
+
+func (nopCloser) Close() error {
+	return nil
+}
+
+type nopReadCloser struct{}
+
+func (nopReadCloser) Read(p []byte) (int, error) {
+	return 0, io.EOF
+}
+
+func (nopReadCloser) Close() error {
+	return nil
+}
+
+type bufReadCloser struct {
+	br *bufio.Reader // used until empty
+	io.ReadCloser
+}
+
+func newBufReadCloser(br *bufio.Reader, rc io.ReadCloser) io.ReadCloser {
+	body := &bufReadCloser{ReadCloser: rc}
+	if br.Buffered() != 0 {
+		body.br = br
+	}
+	return body
+}
+
+func (b *bufReadCloser) Read(p []byte) (n int, err error) {
+	if b.br != nil {
+		if n := b.br.Buffered(); len(p) > n {
+			p = p[:n]
+		}
+		n, err = b.br.Read(p)
+		if b.br.Buffered() == 0 {
+			b.br = nil
+		}
+		return n, err
+	}
+	return b.ReadCloser.Read(p)
+}

middleware.go

@@ -0,0 +1,53 @@
+package gemini
+
+import (
+	"context"
+	"log"
+)
+
+// LoggingMiddleware returns a handler that wraps h and logs Gemini requests
+// and their responses to the log package's standard logger.
+// Requests are logged with the format "gemini: {host} {URL} {status code} {bytes written}".
+func LoggingMiddleware(h Handler) Handler {
+	return HandlerFunc(func(ctx context.Context, w ResponseWriter, r *Request) {
+		lw := &logResponseWriter{rw: w}
+		h.ServeGemini(ctx, lw, r)
+		host := r.ServerName()
+		log.Printf("gemini: %s %q %d %d", host, r.URL, lw.Status, lw.Wrote)
+	})
+}
+
+type logResponseWriter struct {
+	Status      Status
+	Wrote       int
+	rw          ResponseWriter
+	mediatype   string
+	wroteHeader bool
+}
+
+func (w *logResponseWriter) SetMediaType(mediatype string) {
+	w.mediatype = mediatype
+}
+
+func (w *logResponseWriter) Write(b []byte) (int, error) {
+	if !w.wroteHeader {
+		w.WriteHeader(StatusSuccess, w.mediatype)
+	}
+	n, err := w.rw.Write(b)
+	w.Wrote += n
+	return n, err
+}
+
+func (w *logResponseWriter) WriteHeader(status Status, meta string) {
+	if w.wroteHeader {
+		return
+	}
+	w.wroteHeader = true
+	w.Status = status
+	w.Wrote += len(meta) + 5
+	w.rw.WriteHeader(status, meta)
+}
+
+func (w *logResponseWriter) Flush() error {
+	return nil
+}

mux.go

@@ -294,9 +294,6 @@ func appendSorted(es []muxEntry, e muxEntry) []muxEntry {
 }
 
 // HandleFunc registers the handler function for the given pattern.
-func (mux *ServeMux) HandleFunc(pattern string, handler func(context.Context, ResponseWriter, *Request)) {
-	if handler == nil {
-		panic("gemini: nil handler")
-	}
-	mux.Handle(pattern, HandlerFunc(handler))
+func (mux *ServeMux) HandleFunc(pattern string, handler HandlerFunc) {
+	mux.Handle(pattern, handler)
 }

punycode.go

@@ -1,28 +0,0 @@
-package gemini
-
-import (
-	"net"
-	"unicode/utf8"
-
-	"golang.org/x/net/idna"
-)
-
-func isASCII(s string) bool {
-	for i := 0; i < len(s); i++ {
-		if s[i] >= utf8.RuneSelf {
-			return false
-		}
-	}
-	return true
-}
-
-// punycodeHostname returns the punycoded version of hostname.
-func punycodeHostname(hostname string) (string, error) {
-	if net.ParseIP(hostname) != nil {
-		return hostname, nil
-	}
-	if isASCII(hostname) {
-		return hostname, nil
-	}
-	return idna.Lookup.ToASCII(hostname)
-}

query.go

@@ -12,7 +12,8 @@ func QueryEscape(query string) string {
 	return strings.ReplaceAll(url.PathEscape(query), "+", "%2B")
 }
 
-// QueryUnescape is identical to url.PathUnescape.
+// QueryUnescape unescapes a Gemini URL query.
+// It is identical to url.PathUnescape.
 func QueryUnescape(query string) (string, error) {
 	return url.PathUnescape(query)
 }

request.go

@@ -10,11 +10,8 @@ import (
 
 // A Request represents a Gemini request received by a server or to be sent
 // by a client.
-//
-// The field semantics differ slightly between client and server usage.
 type Request struct {
-	// URL specifies the URL being requested (for server
-	// requests) or the URL to access (for client requests).
+	// URL specifies the URL being requested.
 	URL *url.URL
 
 	// For client requests, Host optionally specifies the server to
@@ -23,9 +20,7 @@ type Request struct {
 	// For international domain names, Host may be in Punycode or
 	// Unicode form. Use golang.org/x/net/idna to convert it to
 	// either format if needed.
-	//
-	// For server requests, Host specifies the host on which the URL
-	// is sought.
+	// This field is ignored by the Gemini server.
 	Host string
 
 	// For client requests, Certificate optionally specifies the
@@ -33,24 +28,11 @@ type Request struct {
 	// This field is ignored by the Gemini server.
 	Certificate *tls.Certificate
 
-	// RemoteAddr allows Gemini servers and other software to record
-	// the network address that sent the request, usually for
-	// logging. This field is not filled in by ReadRequest.
-	// This field is ignored by the Gemini client.
-	RemoteAddr net.Addr
-
-	// TLS allows Gemini servers and other software to record
-	// information about the TLS connection on which the request
-	// was received. This field is not filled in by ReadRequest.
-	// The Gemini server in this package sets the field for
-	// TLS-enabled connections before invoking a handler;
-	// otherwise it leaves the field nil.
-	// This field is ignored by the Gemini client.
-	TLS *tls.ConnectionState
+	conn net.Conn
+	tls  *tls.ConnectionState
 }
 
 // NewRequest returns a new request.
-//
 // The returned Request is suitable for use with Client.Do.
 //
 // Callers should be careful that the URL query is properly escaped.
@@ -95,19 +77,53 @@ func ReadRequest(r io.Reader) (*Request, error) {
 	return &Request{URL: u}, nil
 }
 
-// Write writes a Gemini request in wire format.
+// WriteTo writes r to w in the Gemini request format.
 // This method consults the request URL only.
-func (r *Request) Write(w io.Writer) error {
+func (r *Request) WriteTo(w io.Writer) (int64, error) {
 	bw := bufio.NewWriterSize(w, 1026)
 	url := r.URL.String()
 	if len(url) > 1024 {
-		return ErrInvalidRequest
+		return 0, ErrInvalidRequest
 	}
-	if _, err := bw.WriteString(url); err != nil {
-		return err
+	var wrote int64
+	n, err := bw.WriteString(url)
+	wrote += int64(n)
+	if err != nil {
+		return wrote, err
 	}
-	if _, err := bw.Write(crlf); err != nil {
-		return err
+	n, err = bw.Write(crlf)
+	wrote += int64(n)
+	if err != nil {
+		return wrote, err
 	}
-	return bw.Flush()
+	return wrote, bw.Flush()
+}
+
+// Conn returns the network connection on which the request was received.
+// Conn returns nil for client requests.
+func (r *Request) Conn() net.Conn {
+	return r.conn
+}
+
+// TLS returns information about the TLS connection on which the
+// request was received.
+// TLS returns nil for client requests.
+func (r *Request) TLS() *tls.ConnectionState {
+	if r.tls == nil {
+		if tlsConn, ok := r.conn.(*tls.Conn); ok {
+			state := tlsConn.ConnectionState()
+			r.tls = &state
+		}
+	}
+	return r.tls
+}
+
+// ServerName returns the value of the TLS Server Name Indication extension
+// sent by the client.
+// ServerName returns an empty string for client requests.
+func (r *Request) ServerName() string {
+	if tls := r.TLS(); tls != nil {
+		return tls.ServerName
+	}
+	return ""
 }

request_test.go

@@ -119,7 +119,7 @@ func TestWriteRequest(t *testing.T) {
 		t.Logf("%s", test.Req.URL)
 		var b strings.Builder
 		bw := bufio.NewWriter(&b)
-		err := test.Req.Write(bw)
+		_, err := test.Req.WriteTo(bw)
 		if err != test.Err {
 			t.Errorf("expected err = %v, got %v", test.Err, err)
 		}

response.go

@@ -5,6 +5,7 @@ import (
 	"crypto/tls"
 	"fmt"
 	"io"
+	"net"
 	"strconv"
 )
 
@@ -17,13 +18,12 @@ const defaultMediaType = "text/gemini; charset=utf-8"
 // header has been received. The response body is streamed on demand
 // as the Body field is read.
 type Response struct {
-	// Status contains the response status code.
+	// Status is the response status code.
 	Status Status
 
-	// Meta contains more information related to the response status.
-	// For successful responses, Meta should contain the media type of the response.
-	// For failure responses, Meta should contain a short description of the failure.
-	// Meta should not be longer than 1024 bytes.
+	// Meta returns the response meta.
+	// For successful responses, the meta should contain the media type of the response.
+	// For failure responses, the meta should contain a short description of the failure.
 	Meta string
 
 	// Body represents the response body.
@@ -38,15 +38,13 @@ type Response struct {
 	// close Body.
 	Body io.ReadCloser
 
-	// TLS contains information about the TLS connection on which the
-	// response was received. It is nil for unencrypted responses.
-	TLS *tls.ConnectionState
+	conn net.Conn
 }
 
 // ReadResponse reads a Gemini response from the provided io.ReadCloser.
-func ReadResponse(rc io.ReadCloser) (*Response, error) {
+func ReadResponse(r io.ReadCloser) (*Response, error) {
 	resp := &Response{}
-	br := bufio.NewReader(rc)
+	br := bufio.NewReader(r)
 
 	// Read the status
 	statusB := make([]byte, 2)
@@ -91,67 +89,50 @@ func ReadResponse(rc io.ReadCloser) (*Response, error) {
 	}
 
 	if resp.Status.Class() == StatusSuccess {
-		resp.Body = newReadCloserBody(br, rc)
+		resp.Body = newBufReadCloser(br, r)
 	} else {
 		resp.Body = nopReadCloser{}
-		rc.Close()
+		r.Close()
 	}
 	return resp, nil
 }
 
-type nopReadCloser struct{}
-
-func (nopReadCloser) Read(p []byte) (int, error) {
-	return 0, io.EOF
+// Conn returns the network connection on which the response was received.
+func (r *Response) Conn() net.Conn {
+	return r.conn
 }
 
-func (nopReadCloser) Close() error {
+// TLS returns information about the TLS connection on which the
+// response was received.
+func (r *Response) TLS() *tls.ConnectionState {
+	if tlsConn, ok := r.conn.(*tls.Conn); ok {
+		state := tlsConn.ConnectionState()
+		return &state
+	}
 	return nil
 }
 
-type readCloserBody struct {
-	br *bufio.Reader // used until empty
-	io.ReadCloser
-}
-
-func newReadCloserBody(br *bufio.Reader, rc io.ReadCloser) io.ReadCloser {
-	body := &readCloserBody{ReadCloser: rc}
-	if br.Buffered() != 0 {
-		body.br = br
-	}
-	return body
-}
-
-func (b *readCloserBody) Read(p []byte) (n int, err error) {
-	if b.br != nil {
-		if n := b.br.Buffered(); len(p) > n {
-			p = p[:n]
-		}
-		n, err = b.br.Read(p)
-		if b.br.Buffered() == 0 {
-			b.br = nil
-		}
-		return n, err
-	}
-	return b.ReadCloser.Read(p)
-}
-
-// Write writes r to w in the Gemini response format, including the
+// WriteTo writes r to w in the Gemini response format, including the
 // header and body.
 //
 // This method consults the Status, Meta, and Body fields of the response.
 // The Response Body is closed after it is sent.
-func (r *Response) Write(w io.Writer) error {
-	if _, err := fmt.Fprintf(w, "%02d %s\r\n", r.Status, r.Meta); err != nil {
-		return err
+func (r *Response) WriteTo(w io.Writer) (int64, error) {
+	var wrote int64
+	n, err := fmt.Fprintf(w, "%02d %s\r\n", r.Status, r.Meta)
+	wrote += int64(n)
+	if err != nil {
+		return wrote, err
 	}
 	if r.Body != nil {
 		defer r.Body.Close()
-		if _, err := io.Copy(w, r.Body); err != nil {
-			return err
+		n, err := io.Copy(w, r.Body)
+		wrote += n
+		if err != nil {
+			return wrote, err
 		}
 	}
-	return nil
+	return wrote, nil
 }
 
 // A ResponseWriter interface is used by a Gemini handler to construct
@@ -160,18 +141,18 @@ func (r *Response) Write(w io.Writer) error {
 // A ResponseWriter may not be used after the Handler.ServeGemini method
 // has returned.
 type ResponseWriter interface {
-	// MediaType sets the media type that will be sent by Write for a
+	// SetMediaType sets the media type that will be sent by Write for a
 	// successful response. If no media type is set, a default of
 	// "text/gemini; charset=utf-8" will be used.
 	//
 	// Setting the media type after a call to Write or WriteHeader has
 	// no effect.
-	MediaType(string)
+	SetMediaType(mediatype string)
 
 	// Write writes the data to the connection as part of a Gemini response.
 	//
 	// If WriteHeader has not yet been called, Write calls WriteHeader with
-	// StatusSuccess and the media type set in MediaType before writing the data.
+	// StatusSuccess and the media type set in SetMediaType before writing the data.
 	// If no media type was set, Write uses a default media type of
 	// "text/gemini; charset=utf-8".
 	Write([]byte) (int, error)
@@ -181,44 +162,32 @@ type ResponseWriter interface {
 	//
 	// If WriteHeader is not called explicitly, the first call to Write
 	// will trigger an implicit call to WriteHeader with a successful
-	// status code and the media type set in MediaType.
+	// status code and the media type set in SetMediaType.
 	//
 	// The provided code must be a valid Gemini status code.
 	// The provided meta must not be longer than 1024 bytes.
 	// Only one header may be written.
 	WriteHeader(status Status, meta string)
-}
 
-// The Flusher interface is implemented by ResponseWriters that allow a
-// Gemini handler to flush buffered data to the client.
-//
-// The default Gemini ResponseWriter implementation supports Flusher,
-// but ResponseWriter wrappers may not. Handlers should always test
-// for this ability at runtime.
-type Flusher interface {
 	// Flush sends any buffered data to the client.
 	Flush() error
 }
 
 type responseWriter struct {
-	b           *bufio.Writer
+	bw          *bufio.Writer
+	cl          io.Closer
 	mediatype   string
 	wroteHeader bool
 	bodyAllowed bool
 }
 
-// NewResponseWriter returns a ResponseWriter that uses the provided io.Writer.
-func NewResponseWriter(w io.Writer) ResponseWriter {
-	return newResponseWriter(w)
-}
-
 func newResponseWriter(w io.Writer) *responseWriter {
 	return &responseWriter{
-		b: bufio.NewWriter(w),
+		bw: bufio.NewWriter(w),
 	}
 }
 
-func (w *responseWriter) MediaType(mediatype string) {
+func (w *responseWriter) SetMediaType(mediatype string) {
 	w.mediatype = mediatype
 }
 
@@ -234,7 +203,7 @@ func (w *responseWriter) Write(b []byte) (int, error) {
 	if !w.bodyAllowed {
 		return 0, ErrBodyNotAllowed
 	}
-	return w.b.Write(b)
+	return w.bw.Write(b)
 }
 
 func (w *responseWriter) WriteHeader(status Status, meta string) {
@@ -246,10 +215,10 @@ func (w *responseWriter) WriteHeader(status Status, meta string) {
 		w.bodyAllowed = true
 	}
 
-	w.b.WriteString(strconv.Itoa(int(status)))
-	w.b.WriteByte(' ')
-	w.b.WriteString(meta)
-	w.b.Write(crlf)
+	w.bw.WriteString(strconv.Itoa(int(status)))
+	w.bw.WriteByte(' ')
+	w.bw.WriteString(meta)
+	w.bw.Write(crlf)
 	w.wroteHeader = true
 }
 
@@ -257,6 +226,6 @@ func (w *responseWriter) Flush() error {
 	if !w.wroteHeader {
 		w.WriteHeader(StatusTemporaryFailure, "Temporary failure")
 	}
-	// Write errors from writeHeader will be returned here.
-	return w.b.Flush()
+	// Write errors from WriteHeader will be returned here.
+	return w.bw.Flush()
 }

response_test.go

@@ -37,6 +37,15 @@ func TestReadWriteResponse(t *testing.T) {
 			Meta:      "/redirect",
 			SkipWrite: true, // skip write test since result won't match Raw
 		},
+		{
+			Raw:    "32 " + maxURL + "\r\n",
+			Status: 32,
+			Meta:   maxURL,
+		},
+		{
+			Raw: "33 " + maxURL + "xxxx" + "\r\n",
+			Err: ErrInvalidResponse,
+		},
 		{
 			Raw:    "99 Unknown status code\r\n",
 			Status: 99,
@@ -86,7 +95,7 @@ func TestReadWriteResponse(t *testing.T) {
 		if err != test.Err {
 			t.Errorf("expected err = %v, got %v", test.Err, err)
 		}
-		if test.Err != nil {
+		if err != nil {
 			// No response
 			continue
 		}
@@ -107,14 +116,12 @@ func TestReadWriteResponse(t *testing.T) {
 		if test.Err != nil || test.SkipWrite {
 			continue
 		}
-		resp := &Response{
-			Status: test.Status,
-			Meta:   test.Meta,
-			Body:   io.NopCloser(strings.NewReader(test.Body)),
-		}
 
 		var b strings.Builder
-		if err := resp.Write(&b); err != nil {
+		w := newResponseWriter(nopCloser{&b})
+		w.WriteHeader(test.Status, test.Meta)
+		io.Copy(w, strings.NewReader(test.Body))
+		if err := w.Flush(); err != nil {
 			t.Error(err)
 			continue
 		}

server.go

@@ -6,9 +6,7 @@ import (
 	"errors"
 	"log"
 	"net"
-	"runtime"
 	"sync"
-	"sync/atomic"
 	"time"
 )
 
@@ -40,21 +38,34 @@ type Server struct {
 	//
 	// If GetCertificate is nil or returns nil, then no certificate
 	// will be used and the connection will be aborted.
+	//
+	// See the certificate submodule for a certificate store that creates
+	// and rotates certificates as needed.
 	GetCertificate func(hostname string) (*tls.Certificate, error)
 
 	// ErrorLog specifies an optional logger for errors accepting connections,
 	// unexpected behavior from handlers, and underlying file system errors.
 	// If nil, logging is done via the log package's standard logger.
-	ErrorLog *log.Logger
+	ErrorLog interface {
+		Printf(format string, v ...interface{})
+	}
 
 	listeners map[*net.Listener]context.CancelFunc
 	conns     map[*net.Conn]context.CancelFunc
+	closed    bool // true if Close or Shutdown called
+	shutdown  bool // true if Shutdown called
 	doneChan  chan struct{}
-	closed    int32
 	mu        sync.Mutex
 }
 
-// done returns a channel that's closed when the server has finished closing.
+func (srv *Server) isClosed() bool {
+	srv.mu.Lock()
+	defer srv.mu.Unlock()
+	return srv.closed
+}
+
+// done returns a channel that's closed when the server is closed and
+// all listeners and connections are closed.
 func (srv *Server) done() chan struct{} {
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
@@ -68,16 +79,24 @@ func (srv *Server) doneLocked() chan struct{} {
 	return srv.doneChan
 }
 
-// tryFinishShutdown closes srv.done() if there are no active listeners or requests.
-func (srv *Server) tryFinishShutdown() {
+// tryCloseDone closes srv.done() if the server is closed and
+// there are no active listeners or connections.
+func (srv *Server) tryCloseDone() {
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
+	srv.tryCloseDoneLocked()
+}
+
+func (srv *Server) tryCloseDoneLocked() {
+	if !srv.closed {
+		return
+	}
 	if len(srv.listeners) == 0 && len(srv.conns) == 0 {
-		done := srv.doneLocked()
+		ch := srv.doneLocked()
 		select {
-		case <-done:
+		case <-ch:
 		default:
-			close(done)
+			close(ch)
 		}
 	}
 }
@@ -85,17 +104,23 @@ func (srv *Server) tryFinishShutdown() {
 // Close immediately closes all active net.Listeners and connections.
 // For a graceful shutdown, use Shutdown.
 func (srv *Server) Close() error {
-	if !atomic.CompareAndSwapInt32(&srv.closed, 0, 1) {
-		return ErrServerClosed
-	}
-
-	// Close active listeners and connections.
 	srv.mu.Lock()
-	for _, cancel := range srv.listeners {
-		cancel()
-	}
-	for _, cancel := range srv.conns {
-		cancel()
+	{
+		if srv.closed {
+			srv.mu.Unlock()
+			return nil
+		}
+		srv.closed = true
+
+		srv.tryCloseDoneLocked()
+
+		// Close all active connections and listeners.
+		for _, cancel := range srv.listeners {
+			cancel()
+		}
+		for _, cancel := range srv.conns {
+			cancel()
+		}
 	}
 	srv.mu.Unlock()
 
@@ -106,27 +131,33 @@ func (srv *Server) Close() error {
 }
 
 // Shutdown gracefully shuts down the server without interrupting any
-// active connections. Shutdown works by first closing all open
-// listeners and then waiting indefinitely for connections
-// to close and then shut down.
+// active connections. Shutdown works by first closing all open listeners
+// and then waiting indefinitely for connections to close.
 // If the provided context expires before the shutdown is complete,
 // Shutdown returns the context's error.
 //
-// When Shutdown is called, Serve and ListenAndServer immediately
-// return ErrServerClosed. Make sure the program doesn't exit and
-// waits instead for Shutdown to return.
+// When Shutdown is called, Serve and ListenAndServe immediately
+// return an error. Make sure the program doesn't exit and waits instead for
+// Shutdown to return.
 //
 // Once Shutdown has been called on a server, it may not be reused;
-// future calls to methods such as Serve will return ErrServerClosed.
+// future calls to methods such as Serve will return an error.
 func (srv *Server) Shutdown(ctx context.Context) error {
-	if !atomic.CompareAndSwapInt32(&srv.closed, 0, 1) {
-		return ErrServerClosed
-	}
-
-	// Close active listeners.
 	srv.mu.Lock()
-	for _, cancel := range srv.listeners {
-		cancel()
+	{
+		if srv.closed {
+			srv.mu.Unlock()
+			return nil
+		}
+		srv.closed = true
+		srv.shutdown = true
+
+		srv.tryCloseDoneLocked()
+
+		// Close all active listeners.
+		for _, cancel := range srv.listeners {
+			cancel()
+		}
 	}
 	srv.mu.Unlock()
 
@@ -141,15 +172,16 @@ func (srv *Server) Shutdown(ctx context.Context) error {
 
 // ListenAndServe listens for requests at the server's configured address.
 // ListenAndServe listens on the TCP network address srv.Addr and then calls
-// Serve to handle requests on incoming connections.
+// Serve to handle requests on incoming connections. If the provided
+// context expires, ListenAndServe closes l and returns the context's error.
 //
 // If srv.Addr is blank, ":1965" is used.
 //
-// ListenAndServe always returns a non-nil error. After Shutdown or Close, the
-// returned error is ErrServerClosed.
+// ListenAndServe always returns a non-nil error.
+// After Shutdown or Closed, the returned error is context.Canceled.
 func (srv *Server) ListenAndServe(ctx context.Context) error {
-	if atomic.LoadInt32(&srv.closed) == 1 {
-		return ErrServerClosed
+	if srv.isClosed() {
+		return context.Canceled
 	}
 
 	addr := srv.Addr
@@ -177,13 +209,17 @@ func (srv *Server) getCertificate(h *tls.ClientHelloInfo) (*tls.Certificate, err
 	return srv.GetCertificate(h.ServerName)
 }
 
-func (srv *Server) trackListener(l *net.Listener, cancel context.CancelFunc) {
+func (srv *Server) trackListener(l *net.Listener, cancel context.CancelFunc) bool {
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
+	if srv.closed {
+		return false
+	}
 	if srv.listeners == nil {
 		srv.listeners = make(map[*net.Listener]context.CancelFunc)
 	}
 	srv.listeners[l] = cancel
+	return true
 }
 
 func (srv *Server) deleteListener(l *net.Listener) {
@@ -193,23 +229,22 @@ func (srv *Server) deleteListener(l *net.Listener) {
 }
 
 // Serve accepts incoming connections on the Listener l, creating a new
-// service goroutine for each. The service goroutines read requests and
-// then calls the appropriate Handler to reply to them.
+// service goroutine for each. The service goroutines read the requests and
+// then call the appropriate Handler to reply to them. If the provided
+// context expires, Serve closes l and returns the context's error.
 //
-// Serve always returns a non-nil error and closes l. After Shutdown or Close,
-// the returned error is ErrServerClosed.
+// Serve always closes l and returns a non-nil error.
+// After Shutdown or Close, the returned error is context.Canceled.
 func (srv *Server) Serve(ctx context.Context, l net.Listener) error {
 	defer l.Close()
 
-	if atomic.LoadInt32(&srv.closed) == 1 {
-		return ErrServerClosed
-	}
-
 	lnctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	srv.trackListener(&l, cancel)
-	defer srv.tryFinishShutdown()
+	if !srv.trackListener(&l, cancel) {
+		return context.Canceled
+	}
+	defer srv.tryCloseDone()
 	defer srv.deleteListener(&l)
 
 	errch := make(chan error, 1)
@@ -219,9 +254,6 @@ func (srv *Server) Serve(ctx context.Context, l net.Listener) error {
 
 	select {
 	case <-lnctx.Done():
-		if atomic.LoadInt32(&srv.closed) == 1 {
-			return ErrServerClosed
-		}
 		return lnctx.Err()
 	case err := <-errch:
 		return err
@@ -229,21 +261,10 @@ func (srv *Server) Serve(ctx context.Context, l net.Listener) error {
 }
 
 func (srv *Server) serve(ctx context.Context, l net.Listener) error {
-	// how long to sleep on accept failure
-	var tempDelay time.Duration
-
+	var tempDelay time.Duration // how long to sleep on accept failure
 	for {
 		rw, err := l.Accept()
 		if err != nil {
-			select {
-			case <-ctx.Done():
-				if atomic.LoadInt32(&srv.closed) == 1 {
-					return ErrServerClosed
-				}
-				return ctx.Err()
-			default:
-			}
-
 			// If this is a temporary error, sleep
 			if ne, ok := err.(net.Error); ok && ne.Temporary() {
 				if tempDelay == 0 {
@@ -258,22 +279,27 @@ func (srv *Server) serve(ctx context.Context, l net.Listener) error {
 				time.Sleep(tempDelay)
 				continue
 			}
-
 			return err
 		}
-
 		tempDelay = 0
-		go srv.serveConn(ctx, rw)
+		go srv.serveConn(ctx, rw, false)
 	}
 }
 
-func (srv *Server) trackConn(conn *net.Conn, cancel context.CancelFunc) {
+func (srv *Server) trackConn(conn *net.Conn, cancel context.CancelFunc, external bool) bool {
 	srv.mu.Lock()
 	defer srv.mu.Unlock()
+	// Reject the connection under the following conditions:
+	// - Shutdown or Close has been called and conn is external (from ServeConn)
+	// - Close (not Shutdown) has been called and conn is internal (from Serve)
+	if srv.closed && (external || !srv.shutdown) {
+		return false
+	}
 	if srv.conns == nil {
 		srv.conns = make(map[*net.Conn]context.CancelFunc)
 	}
 	srv.conns[conn] = cancel
+	return true
 }
 
 func (srv *Server) deleteConn(conn *net.Conn) {
@@ -282,31 +308,26 @@ func (srv *Server) deleteConn(conn *net.Conn) {
 	delete(srv.conns, conn)
 }
 
-// serveConn serves a Gemini response over the provided connection.
+// ServeConn serves a Gemini response over the provided connection.
 // It closes the connection when the response has been completed.
-func (srv *Server) serveConn(ctx context.Context, conn net.Conn) {
-	defer conn.Close()
+// If the provided context expires before the response has completed,
+// ServeConn closes the connection and returns the context's error.
+func (srv *Server) ServeConn(ctx context.Context, conn net.Conn) error {
+	return srv.serveConn(ctx, conn, true)
+}
 
-	if atomic.LoadInt32(&srv.closed) == 1 {
-		return
-	}
+func (srv *Server) serveConn(ctx context.Context, conn net.Conn, external bool) error {
+	defer conn.Close()
 
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()
 
-	srv.trackConn(&conn, cancel)
-	defer srv.tryFinishShutdown()
+	if !srv.trackConn(&conn, cancel, external) {
+		return context.Canceled
+	}
+	defer srv.tryCloseDone()
 	defer srv.deleteConn(&conn)
 
-	defer func() {
-		if err := recover(); err != nil && err != ErrAbortHandler {
-			const size = 64 << 10
-			buf := make([]byte, size)
-			buf = buf[:runtime.Stack(buf, false)]
-			srv.logf("gemini: panic serving %v: %v\n%s", conn.RemoteAddr(), err, buf)
-		}
-	}()
-
 	if d := srv.ReadTimeout; d != 0 {
 		conn.SetReadDeadline(time.Now().Add(d))
 	}
@@ -314,45 +335,52 @@ func (srv *Server) serveConn(ctx context.Context, conn net.Conn) {
 		conn.SetWriteDeadline(time.Now().Add(d))
 	}
 
-	done := make(chan struct{})
+	errch := make(chan error, 1)
 	go func() {
-		srv.respond(ctx, conn)
-		close(done)
+		errch <- srv.goServeConn(ctx, conn)
 	}()
 
 	select {
 	case <-ctx.Done():
-	case <-done:
+		return ctx.Err()
+	case err := <-errch:
+		return err
 	}
 }
 
-func (srv *Server) respond(ctx context.Context, conn net.Conn) {
-	w := newResponseWriter(conn)
-	defer w.Flush()
+func (srv *Server) goServeConn(ctx context.Context, conn net.Conn) error {
+	ctx, cancel := context.WithCancel(ctx)
+	done := ctx.Done()
+	cw := &contextWriter{
+		ctx:    ctx,
+		done:   done,
+		cancel: cancel,
+		wc:     conn,
+	}
+	r := &contextReader{
+		ctx:    ctx,
+		done:   done,
+		cancel: cancel,
+		rc:     conn,
+	}
 
-	req, err := ReadRequest(conn)
+	w := newResponseWriter(cw)
+
+	req, err := ReadRequest(r)
 	if err != nil {
 		w.WriteHeader(StatusBadRequest, "Bad request")
-		return
+		return w.Flush()
 	}
-
-	// Store the TLS connection state
-	if tlsConn, ok := conn.(*tls.Conn); ok {
-		state := tlsConn.ConnectionState()
-		req.TLS = &state
-		req.Host = state.ServerName
-	}
-
-	// Store remote address
-	req.RemoteAddr = conn.RemoteAddr()
+	req.conn = conn
 
 	h := srv.Handler
 	if h == nil {
 		w.WriteHeader(StatusNotFound, "Not found")
-		return
+		return w.Flush()
 	}
 
 	h.ServeGemini(ctx, w, req)
+	return w.Flush()
 }
 
 func (srv *Server) logf(format string, args ...interface{}) {

text.go

@@ -9,38 +9,39 @@ import (
 
 // Line represents a line of a Gemini text response.
 type Line interface {
+	// String formats the line for use in a Gemini text response.
 	String() string
 	line() // private function to prevent other packages from implementing Line
 }
 
-// A link line.
+// LineLink is a link line.
 type LineLink struct {
 	URL  string
 	Name string
 }
 
-// A preformatting toggle line.
+// LinePreformattingToggle is a preformatting toggle line.
 type LinePreformattingToggle string
 
-// A preformatted text line.
+// LinePreformattedText is a preformatted text line.
 type LinePreformattedText string
 
-// A first-level heading line.
+// LineHeading1 is a first-level heading line.
 type LineHeading1 string
 
-// A second-level heading line.
+// LineHeading2 is a second-level heading line.
 type LineHeading2 string
 
-// A third-level heading line.
+// LineHeading3 is a third-level heading line.
 type LineHeading3 string
 
-// An unordered list item line.
+// LineListItem is an unordered list item line.
 type LineListItem string
 
-// A quote line.
+// LineQuote is a quote line.
 type LineQuote string
 
-// A text line.
+// LineText is a text line.
 type LineText string
 
 func (l LineLink) String() string {

timeout.go

@@ -1,110 +0,0 @@
-package gemini
-
-import (
-	"bytes"
-	"context"
-	"sync"
-	"time"
-)
-
-// TimeoutHandler returns a Handler that runs h with the given time limit.
-//
-// The new Handler calls h.ServeGemini to handle each request, but
-// if a call runs for longer than its time limit, the handler responds with a
-// 40 Temporary Failure error. After such a timeout, writes by h to its
-// ResponseWriter will return ErrHandlerTimeout.
-//
-// TimeoutHandler does not support the Hijacker or Flusher interfaces.
-func TimeoutHandler(h Handler, dt time.Duration) Handler {
-	return &timeoutHandler{
-		h:  h,
-		dt: dt,
-	}
-}
-
-type timeoutHandler struct {
-	h  Handler
-	dt time.Duration
-}
-
-func (t *timeoutHandler) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
-	ctx, cancel := context.WithTimeout(ctx, t.dt)
-	defer cancel()
-
-	done := make(chan struct{})
-	tw := &timeoutWriter{}
-	panicChan := make(chan interface{}, 1)
-	go func() {
-		defer func() {
-			if p := recover(); p != nil {
-				panicChan <- p
-			}
-		}()
-		t.h.ServeGemini(ctx, tw, r)
-		close(done)
-	}()
-
-	select {
-	case p := <-panicChan:
-		panic(p)
-	case <-done:
-		tw.mu.Lock()
-		defer tw.mu.Unlock()
-		if !tw.wroteHeader {
-			tw.status = StatusSuccess
-		}
-		w.WriteHeader(tw.status, tw.meta)
-		w.Write(tw.b.Bytes())
-	case <-ctx.Done():
-		tw.mu.Lock()
-		defer tw.mu.Unlock()
-		w.WriteHeader(StatusTemporaryFailure, "Timeout")
-		tw.timedOut = true
-	}
-}
-
-type timeoutWriter struct {
-	mu          sync.Mutex
-	b           bytes.Buffer
-	status      Status
-	meta        string
-	mediatype   string
-	wroteHeader bool
-	timedOut    bool
-}
-
-func (w *timeoutWriter) MediaType(mediatype string) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	w.mediatype = mediatype
-}
-
-func (w *timeoutWriter) Write(b []byte) (int, error) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.timedOut {
-		return 0, ErrHandlerTimeout
-	}
-	if !w.wroteHeader {
-		w.writeHeaderLocked(StatusSuccess, w.mediatype)
-	}
-	return w.b.Write(b)
-}
-
-func (w *timeoutWriter) WriteHeader(status Status, meta string) {
-	w.mu.Lock()
-	defer w.mu.Unlock()
-	if w.timedOut {
-		return
-	}
-	w.writeHeaderLocked(status, meta)
-}
-
-func (w *timeoutWriter) writeHeaderLocked(status Status, meta string) {
-	if w.wroteHeader {
-		return
-	}
-	w.status = status
-	w.meta = meta
-	w.wroteHeader = true
-}

tofu/tofu.go

@@ -4,17 +4,16 @@ package tofu
 import (
 	"bufio"
 	"bytes"
-	"crypto/sha512"
+	"crypto/sha256"
 	"crypto/x509"
-	"errors"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"os"
+	"path/filepath"
 	"sort"
-	"strconv"
 	"strings"
 	"sync"
-	"time"
 )
 
 // KnownHosts represents a list of known hosts.
@@ -84,7 +83,11 @@ func (k *KnownHosts) WriteTo(w io.Writer) (int64, error) {
 
 // Load loads the known hosts entries from the provided path.
 func (k *KnownHosts) Load(path string) error {
-	f, err := os.Open(path)
+	if err := os.MkdirAll(filepath.Dir(path), 0700); err != nil {
+		return err
+	}
+
+	f, err := os.OpenFile(path, os.O_CREATE|os.O_RDONLY, 0644)
 	if err != nil {
 		return err
 	}
@@ -133,6 +136,9 @@ func (k *KnownHosts) Parse(r io.Reader) error {
 		if err != nil {
 			continue
 		}
+		if h.Algorithm != "sha256" {
+			continue
+		}
 
 		k.hosts[h.Hostname] = h
 	}
@@ -143,22 +149,17 @@ func (k *KnownHosts) Parse(r io.Reader) error {
 // TOFU implements basic trust on first use.
 //
 // If the host is not on file, it is added to the list.
-// If the host on file is expired, a new entry is added to the list.
 // If the fingerprint does not match the one on file, an error is returned.
 func (k *KnownHosts) TOFU(hostname string, cert *x509.Certificate) error {
-	host := NewHost(hostname, cert.Raw, cert.NotAfter)
-
+	host := NewHost(hostname, cert.Raw)
 	knownHost, ok := k.Lookup(hostname)
-	if !ok || time.Now().After(knownHost.Expires) {
+	if !ok {
 		k.Add(host)
 		return nil
 	}
-
-	// Check fingerprint
-	if !bytes.Equal(knownHost.Fingerprint, host.Fingerprint) {
+	if host.Fingerprint != knownHost.Fingerprint {
 		return fmt.Errorf("fingerprint for %q does not match", hostname)
 	}
-
 	return nil
 }
 
@@ -217,7 +218,8 @@ type PersistentHosts struct {
 	writer *HostWriter
 }
 
-// NewPersistentHosts returns a new persistent set of known hosts.
+// NewPersistentHosts returns a new persistent set of known hosts that stores
+// known hosts in hosts and writes new hosts to writer.
 func NewPersistentHosts(hosts *KnownHosts, writer *HostWriter) *PersistentHosts {
 	return &PersistentHosts{
 		hosts,
@@ -265,21 +267,16 @@ func (p *PersistentHosts) Entries() []Host {
 // TOFU implements trust on first use with a persistent set of known hosts.
 //
 // If the host is not on file, it is added to the list.
-// If the host on file is expired, a new entry is added to the list.
 // If the fingerprint does not match the one on file, an error is returned.
 func (p *PersistentHosts) TOFU(hostname string, cert *x509.Certificate) error {
-	host := NewHost(hostname, cert.Raw, cert.NotAfter)
-
+	host := NewHost(hostname, cert.Raw)
 	knownHost, ok := p.Lookup(hostname)
-	if !ok || time.Now().After(knownHost.Expires) {
+	if !ok {
 		return p.Add(host)
 	}
-
-	// Check fingerprint
-	if !bytes.Equal(knownHost.Fingerprint, host.Fingerprint) {
+	if host.Fingerprint != knownHost.Fingerprint {
 		return fmt.Errorf("fingerprint for %q does not match", hostname)
 	}
-
 	return nil
 }
 
@@ -290,22 +287,20 @@ func (p *PersistentHosts) Close() error {
 
 // Host represents a host entry with a fingerprint using a certain algorithm.
 type Host struct {
-	Hostname    string      // hostname
-	Algorithm   string      // fingerprint algorithm e.g. SHA-512
-	Fingerprint Fingerprint // fingerprint
-	Expires     time.Time   // unix time of the fingerprint expiration date
+	Hostname    string // hostname
+	Algorithm   string // fingerprint algorithm e.g. sha256
+	Fingerprint string // fingerprint
 }
 
-// NewHost returns a new host with a SHA-512 fingerprint of
+// NewHost returns a new host with a SHA256 fingerprint of
 // the provided raw data.
-func NewHost(hostname string, raw []byte, expires time.Time) Host {
-	sum := sha512.Sum512(raw)
+func NewHost(hostname string, raw []byte) Host {
+	sum := sha256.Sum256(raw)
 
 	return Host{
 		Hostname:    hostname,
-		Algorithm:   "SHA-512",
-		Fingerprint: sum[:],
-		Expires:     expires,
+		Algorithm:   "sha256",
+		Fingerprint: base64.StdEncoding.EncodeToString(sum[:]),
 	}
 }
 
@@ -323,95 +318,19 @@ func (h Host) String() string {
 	b.WriteByte(' ')
 	b.WriteString(h.Algorithm)
 	b.WriteByte(' ')
-	b.WriteString(h.Fingerprint.String())
-	b.WriteByte(' ')
-	b.WriteString(strconv.FormatInt(h.Expires.Unix(), 10))
+	b.WriteString(h.Fingerprint)
 	return b.String()
 }
 
 // UnmarshalText unmarshals the host from the provided text.
 func (h *Host) UnmarshalText(text []byte) error {
-	const format = "hostname algorithm hex-fingerprint expiry-unix-ts"
-
 	parts := bytes.Split(text, []byte(" "))
-	if len(parts) != 4 {
-		return fmt.Errorf("expected the format %q", format)
-	}
-
-	if len(parts[0]) == 0 {
-		return errors.New("empty hostname")
+	if len(parts) != 3 {
+		return fmt.Errorf("expected the format 'hostname algorithm fingerprint'")
 	}
 
 	h.Hostname = string(parts[0])
-
-	algorithm := string(parts[1])
-	if algorithm != "SHA-512" {
-		return fmt.Errorf("unsupported algorithm %q", algorithm)
-	}
-
-	h.Algorithm = algorithm
-
-	fingerprint := make([]byte, 0, sha512.Size)
-	scanner := bufio.NewScanner(bytes.NewReader(parts[2]))
-	scanner.Split(scanFingerprint)
-
-	for scanner.Scan() {
-		b, err := strconv.ParseUint(scanner.Text(), 16, 8)
-		if err != nil {
-			return fmt.Errorf("failed to parse fingerprint hash: %w", err)
-		}
-		fingerprint = append(fingerprint, byte(b))
-	}
-
-	if len(fingerprint) != sha512.Size {
-		return fmt.Errorf("invalid fingerprint size %d, expected %d",
-			len(fingerprint), sha512.Size)
-	}
-
-	h.Fingerprint = fingerprint
-
-	unix, err := strconv.ParseInt(string(parts[3]), 10, 0)
-	if err != nil {
-		return fmt.Errorf("invalid unix timestamp: %w", err)
-	}
-
-	h.Expires = time.Unix(unix, 0)
-
+	h.Algorithm = string(parts[1])
+	h.Fingerprint = string(parts[2])
 	return nil
 }
-
-func scanFingerprint(data []byte, atEOF bool) (advance int, token []byte, err error) {
-	if atEOF && len(data) == 0 {
-		return 0, nil, nil
-	}
-	if i := bytes.IndexByte(data, ':'); i >= 0 {
-		// We have a full newline-terminated line.
-		return i + 1, data[0:i], nil
-	}
-
-	// If we're at EOF, we have a final, non-terminated hex byte
-	if atEOF {
-		return len(data), data, nil
-	}
-
-	// Request more data.
-	return 0, nil, nil
-}
-
-// Fingerprint represents a fingerprint.
-type Fingerprint []byte
-
-// String returns a string representation of the fingerprint.
-func (f Fingerprint) String() string {
-	var sb strings.Builder
-
-	for i, b := range f {
-		if i > 0 {
-			sb.WriteByte(':')
-		}
-
-		fmt.Fprintf(&sb, "%02X", b)
-	}
-
-	return sb.String()
-}

vendor.go

@@ -1,212 +0,0 @@
-// Hostname verification code from the crypto/x509 package.
-// Modified to allow Common Names in the short term, until new certificates
-// can be issued with SANs.
-
-// Copyright 2011 The Go Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style
-// license that can be found in the LICENSE file.
-
-package gemini
-
-import (
-	"crypto/x509"
-	"net"
-	"strings"
-	"unicode/utf8"
-)
-
-var oidExtensionSubjectAltName = []int{2, 5, 29, 17}
-
-func hasSANExtension(c *x509.Certificate) bool {
-	for _, e := range c.Extensions {
-		if e.Id.Equal(oidExtensionSubjectAltName) {
-			return true
-		}
-	}
-	return false
-}
-
-func validHostnamePattern(host string) bool { return validHostname(host, true) }
-func validHostnameInput(host string) bool   { return validHostname(host, false) }
-
-// validHostname reports whether host is a valid hostname that can be matched or
-// matched against according to RFC 6125 2.2, with some leniency to accommodate
-// legacy values.
-func validHostname(host string, isPattern bool) bool {
-	if !isPattern {
-		host = strings.TrimSuffix(host, ".")
-	}
-	if len(host) == 0 {
-		return false
-	}
-
-	for i, part := range strings.Split(host, ".") {
-		if part == "" {
-			// Empty label.
-			return false
-		}
-		if isPattern && i == 0 && part == "*" {
-			// Only allow full left-most wildcards, as those are the only ones
-			// we match, and matching literal '*' characters is probably never
-			// the expected behavior.
-			continue
-		}
-		for j, c := range part {
-			if 'a' <= c && c <= 'z' {
-				continue
-			}
-			if '0' <= c && c <= '9' {
-				continue
-			}
-			if 'A' <= c && c <= 'Z' {
-				continue
-			}
-			if c == '-' && j != 0 {
-				continue
-			}
-			if c == '_' {
-				// Not a valid character in hostnames, but commonly
-				// found in deployments outside the WebPKI.
-				continue
-			}
-			return false
-		}
-	}
-
-	return true
-}
-
-// commonNameAsHostname reports whether the Common Name field should be
-// considered the hostname that the certificate is valid for. This is a legacy
-// behavior, disabled by default or if the Subject Alt Name extension is present.
-//
-// It applies the strict validHostname check to the Common Name field, so that
-// certificates without SANs can still be validated against CAs with name
-// constraints if there is no risk the CN would be matched as a hostname.
-// See NameConstraintsWithoutSANs and issue 24151.
-func commonNameAsHostname(c *x509.Certificate) bool {
-	return !hasSANExtension(c) && validHostnamePattern(c.Subject.CommonName)
-}
-
-func matchExactly(hostA, hostB string) bool {
-	if hostA == "" || hostA == "." || hostB == "" || hostB == "." {
-		return false
-	}
-	return toLowerCaseASCII(hostA) == toLowerCaseASCII(hostB)
-}
-
-func matchHostnames(pattern, host string) bool {
-	pattern = toLowerCaseASCII(pattern)
-	host = toLowerCaseASCII(strings.TrimSuffix(host, "."))
-
-	if len(pattern) == 0 || len(host) == 0 {
-		return false
-	}
-
-	patternParts := strings.Split(pattern, ".")
-	hostParts := strings.Split(host, ".")
-
-	if len(patternParts) != len(hostParts) {
-		return false
-	}
-
-	for i, patternPart := range patternParts {
-		if i == 0 && patternPart == "*" {
-			continue
-		}
-		if patternPart != hostParts[i] {
-			return false
-		}
-	}
-
-	return true
-}
-
-// toLowerCaseASCII returns a lower-case version of in. See RFC 6125 6.4.1. We use
-// an explicitly ASCII function to avoid any sharp corners resulting from
-// performing Unicode operations on DNS labels.
-func toLowerCaseASCII(in string) string {
-	// If the string is already lower-case then there's nothing to do.
-	isAlreadyLowerCase := true
-	for _, c := range in {
-		if c == utf8.RuneError {
-			// If we get a UTF-8 error then there might be
-			// upper-case ASCII bytes in the invalid sequence.
-			isAlreadyLowerCase = false
-			break
-		}
-		if 'A' <= c && c <= 'Z' {
-			isAlreadyLowerCase = false
-			break
-		}
-	}
-
-	if isAlreadyLowerCase {
-		return in
-	}
-
-	out := []byte(in)
-	for i, c := range out {
-		if 'A' <= c && c <= 'Z' {
-			out[i] += 'a' - 'A'
-		}
-	}
-	return string(out)
-}
-
-// verifyHostname returns nil if c is a valid certificate for the named host.
-// Otherwise it returns an error describing the mismatch.
-//
-// IP addresses can be optionally enclosed in square brackets and are checked
-// against the IPAddresses field. Other names are checked case insensitively
-// against the DNSNames field. If the names are valid hostnames, the certificate
-// fields can have a wildcard as the left-most label.
-//
-// The legacy Common Name field is ignored unless it's a valid hostname, the
-// certificate doesn't have any Subject Alternative Names, and the GODEBUG
-// environment variable is set to "x509ignoreCN=0". Support for Common Name is
-// deprecated will be entirely removed in the future.
-func verifyHostname(c *x509.Certificate, h string) error {
-	// IP addresses may be written in [ ].
-	candidateIP := h
-	if len(h) >= 3 && h[0] == '[' && h[len(h)-1] == ']' {
-		candidateIP = h[1 : len(h)-1]
-	}
-	if ip := net.ParseIP(candidateIP); ip != nil {
-		// We only match IP addresses against IP SANs.
-		// See RFC 6125, Appendix B.2.
-		for _, candidate := range c.IPAddresses {
-			if ip.Equal(candidate) {
-				return nil
-			}
-		}
-		return x509.HostnameError{c, candidateIP}
-	}
-
-	names := c.DNSNames
-	if commonNameAsHostname(c) {
-		names = []string{c.Subject.CommonName}
-	}
-
-	candidateName := toLowerCaseASCII(h) // Save allocations inside the loop.
-	validCandidateName := validHostnameInput(candidateName)
-
-	for _, match := range names {
-		// Ideally, we'd only match valid hostnames according to RFC 6125 like
-		// browsers (more or less) do, but in practice Go is used in a wider
-		// array of contexts and can't even assume DNS resolution. Instead,
-		// always allow perfect matches, and only apply wildcard and trailing
-		// dot processing to valid hostnames.
-		if validCandidateName && validHostnamePattern(match) {
-			if matchHostnames(match, candidateName) {
-				return nil
-			}
-		} else {
-			if matchExactly(match, candidateName) {
-				return nil
-			}
-		}
-	}
-
-	return x509.HostnameError{c, h}
-}