Update deps

go.mod

@@ -10,19 +10,19 @@ require (
 	github.com/hashicorp/go-immutable-radix v1.3.1
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/hectane/go-acl v0.0.0-20230122075934-ca0b05cb1adb
-	github.com/jedisct1/dlog v0.0.0-20210927135244-3381aa132e7f
+	github.com/jedisct1/dlog v0.0.0-20230211133026-0338add8743f
-	github.com/jedisct1/go-clocksmith v0.0.0-20210101121932-da382b963868
+	github.com/jedisct1/go-clocksmith v0.0.0-20230211133011-392c1afea73e
-	github.com/jedisct1/go-dnsstamps v0.0.0-20220328103132-6fb2da762370
+	github.com/jedisct1/go-dnsstamps v0.0.0-20230211133001-124a632de565
-	github.com/jedisct1/go-hpke-compact v0.0.0-20210930135406-0763750339f0
+	github.com/jedisct1/go-hpke-compact v0.0.0-20230211184420-51d4440017ce
-	github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b
+	github.com/jedisct1/go-minisign v0.0.0-20230211184525-1f273d8dc776
-	github.com/jedisct1/xsecretbox v0.0.0-20210927135450-ebe41aef7bef
+	github.com/jedisct1/xsecretbox v0.0.0-20230211185120-2025cdbb9f0f
 	github.com/k-sone/critbitgo v1.4.0
 	github.com/kardianos/service v1.2.2
 	github.com/miekg/dns v1.1.50
 	github.com/powerman/check v1.6.0
 	github.com/quic-go/quic-go v0.32.0
 	golang.org/x/crypto v0.6.0
-	golang.org/x/net v0.6.0
+	golang.org/x/net v0.7.0
 	golang.org/x/sys v0.5.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 )

go.sum

@@ -358,18 +358,18 @@ github.com/imdario/mergo v0.3.4/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJ
 github.com/imdario/mergo v0.3.8/go.mod h1:2EnlNZ0deacrJVfApfmtdGgDfMuh/nq6Ok1EcJh5FfA=
 github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
 github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/jedisct1/dlog v0.0.0-20210927135244-3381aa132e7f h1:XICcphytniQKdtd4FGrK0b1ERzS7FBvFtVUCReSppmU=
+github.com/jedisct1/dlog v0.0.0-20230211133026-0338add8743f h1:FBZqNKGn+mB/9PZG/1bNGKQ1azw2o7dZV0ZGmTPoboA=
-github.com/jedisct1/dlog v0.0.0-20210927135244-3381aa132e7f/go.mod h1:35aII3PkLMvmc8daWy0vcZXDU+a40lJczHHTFRJmnvw=
+github.com/jedisct1/dlog v0.0.0-20230211133026-0338add8743f/go.mod h1:35aII3PkLMvmc8daWy0vcZXDU+a40lJczHHTFRJmnvw=
-github.com/jedisct1/go-clocksmith v0.0.0-20210101121932-da382b963868 h1:QZ79mRbNwYYYmiVjyv+X0NKgYE6nyN1yo3gtEFdzpiE=
+github.com/jedisct1/go-clocksmith v0.0.0-20230211133011-392c1afea73e h1:tzG4EjKgHIqKVkLIAC4pXTIapuM2BR05uXokEEysAXA=
-github.com/jedisct1/go-clocksmith v0.0.0-20210101121932-da382b963868/go.mod h1:SAINchklztk2jcLWJ4bpNF4KnwDUSUTX+cJbspWC2Rw=
+github.com/jedisct1/go-clocksmith v0.0.0-20230211133011-392c1afea73e/go.mod h1:SAINchklztk2jcLWJ4bpNF4KnwDUSUTX+cJbspWC2Rw=
-github.com/jedisct1/go-dnsstamps v0.0.0-20220328103132-6fb2da762370 h1:VQyy4FYgkGVvMnfMauP3phjlwmQQu+DxnE5jBBH4It8=
+github.com/jedisct1/go-dnsstamps v0.0.0-20230211133001-124a632de565 h1:BPBMaUCgtmiHvqgugbSuegXjADJfERsPbmRqgdq8Pjo=
-github.com/jedisct1/go-dnsstamps v0.0.0-20220328103132-6fb2da762370/go.mod h1:mEGEFZsGe4sG5Mb3Xi89pmsy+TZ0946ArbYMGKAM5uA=
+github.com/jedisct1/go-dnsstamps v0.0.0-20230211133001-124a632de565/go.mod h1:mEGEFZsGe4sG5Mb3Xi89pmsy+TZ0946ArbYMGKAM5uA=
-github.com/jedisct1/go-hpke-compact v0.0.0-20210930135406-0763750339f0 h1:RHAwzltAHFehEX1xUamZQtmWYflYReGY7jvmRZ3v7QU=
+github.com/jedisct1/go-hpke-compact v0.0.0-20230211184420-51d4440017ce h1:RvDulxEuYjqIWSphi54mQGXWDAp0yjeCJQKhBj6Qkmc=
-github.com/jedisct1/go-hpke-compact v0.0.0-20210930135406-0763750339f0/go.mod h1:wDWQCpgsVR2M5u//vKIwqBZdbsS/f/rZiOuJPaFSkmk=
+github.com/jedisct1/go-hpke-compact v0.0.0-20230211184420-51d4440017ce/go.mod h1:T9nvXa0PqmoSt9JhtW0rv9iXg5xoxW/ZfVhdm9Y4QJw=
-github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b h1:ZGiXF8sz7PDk6RgkP+A/SFfUD0ZR/AgG6SpRNEDKZy8=
+github.com/jedisct1/go-minisign v0.0.0-20230211184525-1f273d8dc776 h1:WXhZ7psl6HhDDW58rDWIJE6oB0ETjaQA4U6d8U7lMyg=
-github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b/go.mod h1:hQmNrgofl+IY/8L+n20H6E6PWBBTokdsv+q49j0QhsU=
+github.com/jedisct1/go-minisign v0.0.0-20230211184525-1f273d8dc776/go.mod h1:09CTTv5TZgz94QHts03Xnuzy5LmxCE8BNqQRFigO5gA=
-github.com/jedisct1/xsecretbox v0.0.0-20210927135450-ebe41aef7bef h1:1Jom8JnCkrgivikTdt0lg5lHpZRvpP98hn8H1bIjFLk=
+github.com/jedisct1/xsecretbox v0.0.0-20230211185120-2025cdbb9f0f h1:1qPoL+ur1rCouHMB737ujJGXVFoXGafDY+kmgXjpicA=
-github.com/jedisct1/xsecretbox v0.0.0-20210927135450-ebe41aef7bef/go.mod h1:dmX1e+PPjjbMjNI/wJk8EgjXmqAMZ5tgOzD1wxCgzhs=
+github.com/jedisct1/xsecretbox v0.0.0-20230211185120-2025cdbb9f0f/go.mod h1:39HtRgNq2rdKzzeqfPNFLY000t4ktVThX3ncyK58lsA=
 github.com/jgautheron/goconst v1.5.1 h1:HxVbL1MhydKs8R8n/HE5NPvzfaYmQJA3o879lE4+WcM=
 github.com/jgautheron/goconst v1.5.1/go.mod h1:aAosetZ5zaeC/2EfMeRswtxUFBpe2Hr7HzkgX4fanO4=
 github.com/jhump/protoreflect v1.6.1/go.mod h1:RZQ/lnuN+zqeRVpQigTwO6o0AJUkxbnSnpuG7toUTG4=
@@ -823,8 +823,8 @@ golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
 golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/net v0.6.0 h1:L4ZwwTvKW9gr0ZMS1yrHD9GZhIuVjOBBnaKH+SPQK0Q=
+golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
-golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
+golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=

vendor/github.com/jedisct1/dlog/LICENSE

@@ -1,6 +1,6 @@
 BSD 2-Clause License
 
-Copyright (c) 2018-2021, Frank Denis
+Copyright (c) 2018-2023, Frank Denis
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

vendor/github.com/jedisct1/dlog/dlog.go

@@ -28,15 +28,13 @@ type globals struct {
 	occurrences     uint64
 }
 
-var (
+var _globals = globals{
-	_globals = globals{
 	logLevel:       SeverityLast,
 	appName:        "-",
 	lastMessage:    "",
 	lastOccurrence: time.Now(),
 	occurrences:    0,
-	}
+}
-)
 
 const (
 	SeverityDebug Severity = iota
@@ -209,7 +207,7 @@ func createFileDescriptor() {
 		} else {
 			mode |= os.O_APPEND
 		}
-		outFd, err := os.OpenFile(*_globals.fileName, mode, 0644)
+		outFd, err := os.OpenFile(*_globals.fileName, mode, 0o644)
 		if err == nil {
 			_globals.outFd = outFd
 		}

vendor/github.com/jedisct1/dlog/sysdeps_others.go

@@ -1,3 +1,4 @@
+//go:build !windows
 // +build !windows
 
 package dlog

vendor/github.com/jedisct1/go-clocksmith/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018-2021 Frank Denis
+Copyright (c) 2018-2023 Frank Denis
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

vendor/github.com/jedisct1/go-dnsstamps/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018-2021 Frank Denis
+Copyright (c) 2018-2023 Frank Denis
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

vendor/github.com/jedisct1/go-hpke-compact/LICENSE

@@ -1,7 +1,7 @@
 /*
  * ISC License
  *
- * Copyright (c) 2020-2021
+ * Copyright (c) 2020-2023
  * Frank Denis <j at pureftpd dot org>
  *
  * Permission to use, copy, modify, and/or distribute this software for any

vendor/github.com/jedisct1/go-minisign/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018-2021 Frank Denis
+Copyright (c) 2018-2023 Frank Denis
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

vendor/github.com/jedisct1/xsecretbox/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2018-2021 Frank Denis
+Copyright (c) 2018-2023 Frank Denis
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

vendor/github.com/jedisct1/xsecretbox/sharedkey.go

@@ -7,7 +7,7 @@ import (
 	"golang.org/x/crypto/curve25519"
 )
 
-// SharedKey computes a shared secret compatible with the one used by `crypto_box_xchacha20poly1305``
+// SharedKey computes a shared secret compatible with the one used by `crypto_box_xchacha20poly1305`
 func SharedKey(secretKey [32]byte, publicKey [32]byte) ([32]byte, error) {
 	dhKey, err := curve25519.X25519(secretKey[:], publicKey[:])
 	var subKey []byte

vendor/golang.org/x/net/http2/frame.go

@@ -662,6 +662,15 @@ func (f *Framer) WriteData(streamID uint32, endStream bool, data []byte) error {
 // It is the caller's responsibility not to violate the maximum frame size
 // and to not call other Write methods concurrently.
 func (f *Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
+	if err := f.startWriteDataPadded(streamID, endStream, data, pad); err != nil {
+		return err
+	}
+	return f.endWrite()
+}
+
+// startWriteDataPadded is WriteDataPadded, but only writes the frame to the Framer's internal buffer.
+// The caller should call endWrite to flush the frame to the underlying writer.
+func (f *Framer) startWriteDataPadded(streamID uint32, endStream bool, data, pad []byte) error {
 	if !validStreamID(streamID) && !f.AllowIllegalWrites {
 		return errStreamID
 	}
@@ -691,7 +700,7 @@ func (f *Framer) WriteDataPadded(streamID uint32, endStream bool, data, pad []by
 	}
 	f.wbuf = append(f.wbuf, data...)
 	f.wbuf = append(f.wbuf, pad...)
-	return f.endWrite()
+	return nil
 }
 
 // A SettingsFrame conveys configuration parameters that affect how

vendor/golang.org/x/net/http2/hpack/hpack.go

@@ -359,6 +359,7 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
 
 	var hf HeaderField
 	wantStr := d.emitEnabled || it.indexed()
+	var undecodedName undecodedString
 	if nameIdx > 0 {
 		ihf, ok := d.at(nameIdx)
 		if !ok {
@@ -366,15 +367,27 @@ func (d *Decoder) parseFieldLiteral(n uint8, it indexType) error {
 		}
 		hf.Name = ihf.Name
 	} else {
-		hf.Name, buf, err = d.readString(buf, wantStr)
+		undecodedName, buf, err = d.readString(buf)
 		if err != nil {
 			return err
 		}
 	}
-	hf.Value, buf, err = d.readString(buf, wantStr)
+	undecodedValue, buf, err := d.readString(buf)
 	if err != nil {
 		return err
 	}
+	if wantStr {
+		if nameIdx <= 0 {
+			hf.Name, err = d.decodeString(undecodedName)
+			if err != nil {
+				return err
+			}
+		}
+		hf.Value, err = d.decodeString(undecodedValue)
+		if err != nil {
+			return err
+		}
+	}
 	d.buf = buf
 	if it.indexed() {
 		d.dynTab.add(hf)
@@ -459,46 +472,52 @@ func readVarInt(n byte, p []byte) (i uint64, remain []byte, err error) {
 	return 0, origP, errNeedMore
 }
 
-// readString decodes an hpack string from p.
+// readString reads an hpack string from p.
 //
-// wantStr is whether s will be used. If false, decompression and
+// It returns a reference to the encoded string data to permit deferring decode costs
-// []byte->string garbage are skipped if s will be ignored
+// until after the caller verifies all data is present.
-// anyway. This does mean that huffman decoding errors for non-indexed
+func (d *Decoder) readString(p []byte) (u undecodedString, remain []byte, err error) {
-// strings past the MAX_HEADER_LIST_SIZE are ignored, but the server
-// is returning an error anyway, and because they're not indexed, the error
-// won't affect the decoding state.
-func (d *Decoder) readString(p []byte, wantStr bool) (s string, remain []byte, err error) {
 	if len(p) == 0 {
-		return "", p, errNeedMore
+		return u, p, errNeedMore
 	}
 	isHuff := p[0]&128 != 0
 	strLen, p, err := readVarInt(7, p)
 	if err != nil {
-		return "", p, err
+		return u, p, err
 	}
 	if d.maxStrLen != 0 && strLen > uint64(d.maxStrLen) {
-		return "", nil, ErrStringLength
+		// Returning an error here means Huffman decoding errors
+		// for non-indexed strings past the maximum string length
+		// are ignored, but the server is returning an error anyway
+		// and because the string is not indexed the error will not
+		// affect the decoding state.
+		return u, nil, ErrStringLength
 	}
 	if uint64(len(p)) < strLen {
-		return "", p, errNeedMore
+		return u, p, errNeedMore
-	}
-	if !isHuff {
-		if wantStr {
-			s = string(p[:strLen])
-		}
-		return s, p[strLen:], nil
 	}
+	u.isHuff = isHuff
+	u.b = p[:strLen]
+	return u, p[strLen:], nil
+}
 
-	if wantStr {
+type undecodedString struct {
+	isHuff bool
+	b      []byte
+}
+
+func (d *Decoder) decodeString(u undecodedString) (string, error) {
+	if !u.isHuff {
+		return string(u.b), nil
+	}
 	buf := bufPool.Get().(*bytes.Buffer)
 	buf.Reset() // don't trust others
-		defer bufPool.Put(buf)
+	var s string
-		if err := huffmanDecode(buf, d.maxStrLen, p[:strLen]); err != nil {
+	err := huffmanDecode(buf, d.maxStrLen, u.b)
-			buf.Reset()
+	if err == nil {
-			return "", nil, err
-		}
 		s = buf.String()
-		buf.Reset() // be nice to GC
 	}
-	return s, p[strLen:], nil
+	buf.Reset() // be nice to GC
+	bufPool.Put(buf)
+	return s, err
 }

vendor/golang.org/x/net/http2/server.go

@@ -843,8 +843,13 @@ type frameWriteResult struct {
 // and then reports when it's done.
 // At most one goroutine can be running writeFrameAsync at a time per
 // serverConn.
-func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest) {
+func (sc *serverConn) writeFrameAsync(wr FrameWriteRequest, wd *writeData) {
-	err := wr.write.writeFrame(sc)
+	var err error
+	if wd == nil {
+		err = wr.write.writeFrame(sc)
+	} else {
+		err = sc.framer.endWrite()
+	}
 	sc.wroteFrameCh <- frameWriteResult{wr: wr, err: err}
 }
 
@@ -1251,9 +1256,16 @@ func (sc *serverConn) startFrameWrite(wr FrameWriteRequest) {
 		sc.writingFrameAsync = false
 		err := wr.write.writeFrame(sc)
 		sc.wroteFrame(frameWriteResult{wr: wr, err: err})
+	} else if wd, ok := wr.write.(*writeData); ok {
+		// Encode the frame in the serve goroutine, to ensure we don't have
+		// any lingering asynchronous references to data passed to Write.
+		// See https://go.dev/issue/58446.
+		sc.framer.startWriteDataPadded(wd.streamID, wd.endStream, wd.p, nil)
+		sc.writingFrameAsync = true
+		go sc.writeFrameAsync(wr, wd)
 	} else {
 		sc.writingFrameAsync = true
-		go sc.writeFrameAsync(wr)
+		go sc.writeFrameAsync(wr, nil)
 	}
 }
 

vendor/modules.txt

@@ -258,23 +258,23 @@ github.com/hectane/go-acl/api
 # github.com/inconshreveable/mousetrap v1.0.0
 ## explicit
 github.com/inconshreveable/mousetrap
-# github.com/jedisct1/dlog v0.0.0-20210927135244-3381aa132e7f
+# github.com/jedisct1/dlog v0.0.0-20230211133026-0338add8743f
 ## explicit; go 1.17
 github.com/jedisct1/dlog
-# github.com/jedisct1/go-clocksmith v0.0.0-20210101121932-da382b963868
+# github.com/jedisct1/go-clocksmith v0.0.0-20230211133011-392c1afea73e
 ## explicit
 github.com/jedisct1/go-clocksmith
-# github.com/jedisct1/go-dnsstamps v0.0.0-20220328103132-6fb2da762370
+# github.com/jedisct1/go-dnsstamps v0.0.0-20230211133001-124a632de565
 ## explicit; go 1.18
 github.com/jedisct1/go-dnsstamps
-# github.com/jedisct1/go-hpke-compact v0.0.0-20210930135406-0763750339f0
+# github.com/jedisct1/go-hpke-compact v0.0.0-20230211184420-51d4440017ce
-## explicit; go 1.17
+## explicit; go 1.19
 github.com/jedisct1/go-hpke-compact
-# github.com/jedisct1/go-minisign v0.0.0-20211028175153-1c139d1cc84b
+# github.com/jedisct1/go-minisign v0.0.0-20230211184525-1f273d8dc776
-## explicit; go 1.17
+## explicit; go 1.19
 github.com/jedisct1/go-minisign
-# github.com/jedisct1/xsecretbox v0.0.0-20210927135450-ebe41aef7bef
+# github.com/jedisct1/xsecretbox v0.0.0-20230211185120-2025cdbb9f0f
-## explicit; go 1.17
+## explicit; go 1.19
 github.com/jedisct1/xsecretbox
 # github.com/jgautheron/goconst v1.5.1
 ## explicit; go 1.13
@@ -607,7 +607,7 @@ golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
-# golang.org/x/net v0.6.0
+# golang.org/x/net v0.7.0
 ## explicit; go 1.17
 golang.org/x/net/bpf
 golang.org/x/net/http/httpguts