1. Forum
  2. DOVE-Net
  3. Synchronet Programming

  • src/sbbs3/websrvr.cpp

    From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Tue Jun 23 22:21:39 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/b0f02c4e61aa835f2b9b9e21
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    websrvr: read buffered TLS request body directly (fix #1169 login stall)

    A webv4 login/logout is an HTTPS POST whose body (credentials) often arrives
    in the same TLS record as the headers, so it sits decrypted-but-unread in the TLS layer with nothing left on the raw socket. read_post_data() -> recvbufsocket() gated each read on session_check(), which since 50258e70b ("detect TLS client disconnect", #1155) only treats a TLS session as readable when a byte has been peeked (peeked_valid) - it no longer short-circuits on tls_pending. With the body buffered but no peeked byte, session_check() fell through to socket_check() on the raw socket and blocked for the full MaxInactivity timeout (60-90s) before the buffered body was finally read.
    That is the #1169 "login stalls ~90s at Initializing User Objects" symptom: POST-only (login/logout), duration == MaxInactivity, no wire traffic.

    Guard the recvbufsocket() wait with tls_pending the same way sockreadline() already does for header reads: when TLS data is already buffered, read it directly instead of waiting on the raw socket. Header reads were unaffected because sockreadline() kept its own tls_pending guard; only the body read regressed.

    Manifests whenever the body is TLS-buffered at read time (reliably on Windows, intermittently on Linux v3.22a); absent in v3.21f, which predates 50258e70b. Verified on vert: the auth POST's "Authorization check complete" -> "Responding to request" gap went from 60s to 0s.

    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Tue Jun 23 23:20:54 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/659de100d04037459107de30
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    websrvr: remove #1169 timing probes (issue resolved)

    Reverts the debug-level timing probes added in f6d382c13 to localize the
    webv4 login stall; #1169 is now root-caused and fixed in b0f02c4e6 (recvbufsocket reads buffered TLS data directly instead of waiting on the
    raw socket for MaxInactivity).

    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Tue Jun 23 23:20:54 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/a6cb9dffb18f6ba070113911
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    websrvr: consolidate js_CreateUserObjects() branches in http_checkuser()

    The user>0 and guest (NULL user) branches differed only in the user argument and an error-log string; collapse them into a single call with a ternary for the user pointer. No functional change (the anonymous failure path now logs the same "creating user objects" message as the authenticated path).

    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Windows 11)@VERT to Git commit to main/sbbs/master on Tue Jun 23 23:20:54 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/3e57627a712015d1e417056b
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    websrvr: log authenticated user logon/logoff at LOG_INFO

    http_logon()/http_logoff() logged every web logon and logoff at LOG_DEBUG, so webv4 (and HTTP-auth) user logins were invisible in the server log unless debug-level web logging was enabled - unlike the FTP (ftpsrvr.cpp:2695), mail (mailsrvr.cpp:1422/4380/4489) and terminal (answer.cpp:452) servers, which all record a successful user login at LOG_INFO.

    Log a logon at LOG_INFO when a real user authenticated (user.number > 0) and keep anonymous/Guest logons (number == 0) at LOG_DEBUG, so the constant per-request anonymous churn (bots, crawlers) stays quiet. http_logoff() already early-returns unless a user was logged in, so it moves to LOG_INFO unconditionally.

    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Tue Aug 4 22:12:21 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/0ca5676148730160b440cf02
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    websrvr: always read the file header when resolving a file-vpath request

    4de1032086 (payroll-20-queue, 2026-08-01) skipped the header record for
    a file in a free directory, on the grounds that loadfile() zeroes the
    cost there and download_is_free() short-circuits on the same flag before
    any credit comparison.

    The cost is not the only field that comes from the header. The index
    record stores the filename truncated to SMB_FILEIDX_NAMELEN (64 bytes, extension preserved), and smb_getfile() points file.name at it, so at
    index detail file.name was that truncated form. Names longer than the
    limit are not hypothetical: one in this file base is 78 characters. The
    name reaches user_downloaded_file(), which embeds it in the uploader's
    "file downloaded" notification, and mqtt_file_download(), which
    publishes it.

    The transfer and the credit accounting survived it, because deriving an
    index name from an already-truncated one is idempotent and the record
    still resolved, but the name recorded and announced was wrong.

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Sat Aug 8 18:05:04 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/0791f3e3bfcdb04afeda7134
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Don't hand a CGI the web server's descriptors (#1174)

    The CGI child sets up stdin, stdout and stderr and then execs with everything else this process had open still in hand. Close the rest, as externals now
    do. Nothing above stderr is a CGI's business: the client socket it reads
    from, where it has one, has already been duplicated onto stdin.

    Verified against a listen socket left deliberately inheritable, standing in
    for the descriptors this cannot otherwise reach - the ones opened inside libraries, where there is no call site to mark. Before, the CGI inherited it; after, the CGI starts with stdio alone.

    The exec-failure message now goes to stderr directly, which is the pipe the parent already reads and logs as a CGI error. errprintf() is not usable after the close: it is not fork-safe, and its descriptors are among those closed.

    Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From DaiTengu@VERT to Git commit to main/sbbs/master on Wed Oct 14 20:32:26 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/d217da6f41ee2c4e931ecb7f
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Make RemoteIPHeader actually reach the access log

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell@VERT to Git commit to main/sbbs/master on Wed Oct 14 20:32:26 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/574a32b0fdcd5033cce7267a
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Merge branch 'remoteipheader-access-log' into 'master'

    Make RemoteIPHeader actually reach the access log

    See merge request main/sbbs!735

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Thu Oct 22 10:11:17 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/6b8902bab7a555c145012dbc
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Web Server: don't let lingering client sockets stall termination

    close_socket() half-closes the socket and then waits for the peer to
    close its side, for up to max_inactivity seconds in a single blocking
    call that ignored terminate_server. Clients that never close (abandoned
    scraper connections, typically) held each session thread there for up to
    a minute after its inactivity timeout. By then close_session_socket() had already removed the session from current_connections, so
    shutdown_sessions() could not reach it, and a server stop or recycle
    waited on these threads for minutes.

    Poll in one-second slices and stop waiting once terminate_server is set.
    The normal-operation bound is unchanged. This also applies to sockets
    the listener thread rejects (rate-limited, ip-silent.can, max clients),
    which go through the same function.

    Also, after "!TIMEOUT waiting for N active clients to disconnect", no
    longer follow it with "Done waiting for active clients to disconnect".

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Thu Oct 22 10:11:17 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/85b2ca4b23bad6e3786ca893
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Web Server: don't keep a stale content handler after PathInfoIndex

    is_dynamic_req() runs once before a directory's webctrl.ini is read and
    again after PathInfoIndex resolves the request to the index script. The
    first pass, seeing the original path's extension (e.g. /robots.txt or
    /x.md), stored the matching web_handler.ini handler in req.xjs_handler,
    and the re-check never cleared it, so the handler (txt_handler.js, md_handler.js, ...) ran against the index script instead: the script's
    source was rendered as a text page, and requests that should reach the
    script never did. Clear the handler on every check.

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net
  • From Rob Swindell (on Debian Linux)@VERT to Git commit to main/sbbs/master on Thu Oct 22 10:11:17 2026
    https://gitlab.synchro.net/main/sbbs/-/commit/00ce71ebc56082e4af1c90e2
    Modified Files:
    src/sbbs3/websrvr.cpp
    Log Message:
    Web Server: fix doubled byte count for large non-chunked POSTs

    A non-chunked POST body larger than MAX_POST_LEN (4 MiB) is spooled to a
    temp file by post_to_file(), which adds each read to req.post_len. That
    field still held the Content-Length, so it ended at twice the body size
    and every such request logged a false "!ERROR Browser said they sent N
    bytes, but I got 2N". The following clamp to the Content-Length hid the
    error from everything else, so the stored body and the length seen by
    scripts were already correct.

    Zero post_len before spooling, as the chunked path already does.

    Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

    ---
    Synchronet Vertrauen Home of Synchronet [vert/cvs/bbs].synchro.net