Repository navigation
v1.28.0: Wuk Lamat #2014
Xe
announced in
Announcements
v1.28.0: Wuk Lamat
#2014
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
This release adds WebAssembly based proof of work checks to Anubis. They are documented in the Proof of Work (WebAssembly) page. This uses Rust code compiled to WebAssembly to run proof of work code. When browsers support SIMD, the WASM will use hardware acceleration.
When clients are configured to disable WebAssembly, Anubis falls back to a pure JavaScript implementation of the WebAssembly-based check logic. As clients that disable WebAssembly usually disable the JavaScript JIT (the thing that makes JavaScript fast), this makes checks slower.
Additionally due to complicated facts and circumstances involving it being complicated to pass the messages from the wasm2js world back to JavaScript, the progress bar will not update while a wasm2js check is running. This is a known issue and will be fixed in a later release.
The difficulty values for the WebAssembly based checks are going to be much greater than the equivalent difficulty values for the JavaScript based checks. Generally these count the number of leading bits that much match instead of the number of leading nibbles that must match. Here's a rough translation table:
fastdifficultyargon2iddifficultysha256difficultyhashxdifficulty4416152287662420As I'm not certain this will work fine out of the box for a few edge cases, I have disabled these new challenge methods by default. I will enable the new methods by default in a future version after they have been sufficiently tested.
geoipblock.THOTH_URL,THOTH_TOKEN, andTHOTH_INSECUREare now deprecated environment variables that will log a warning upon startup.anubisgroup and assign all Anubis instances permissions to/var/lib/anubis.COOKIE_PREFIXsetting (#1977)USE_SIMPLIFIED_EXPLANATIONis now deprecated.pt-PT) localization.wasm2jsin order to make the WebAssembly proof of work checks run in non-wasm environments.wasm2js/wasm-optWebAssembly modules build reproducibly and fix the build on arm64.npm run test:integrationso the Playwright suite can connect to browsers and Firefox can reach the test server again.pass-challengejust issued (#1314).Hostheader asX-Forwarded-Hostin Open Graph requests so backends can dispatch based on host.X-Anubis-*header spoofingnpm run test:integrationand the Playwright CI step, which were pinned toplaywright@1.61.1whilego.mod'smxschmitt/playwright-gohad already been bumped to a client expecting protocol 1.62.x, causing every Playwright-driven test to fail with a version mismatch.Refererheader on the request forwarded to the target after a challenge is passed, so server-side logs and analytics no longer see the internal challenge page as the referrer. Add an opt-in--preserve-referer-query-paramflag that also appendsutm_source/utm_mediumquery parameters to the post-challenge redirect for client-side analytics tools (e.g. Plausible) that read query parameters instead ofdocument.referrer, which cannot be corrected from the server side (#1596).DENYstatus code instead of HTTP 500 when a challenged client is rejected for not advertising gzip support, and log that rejection atINFOinstead ofERROR. The rejection is deliberate, so it no longer shows up in 5xx rates or as a server fault. The log message text is unchanged, but fail2ban filters that match on theERRORlevel need updating (#1009).What's Changed
X-Anubis-*header spoofing vector by @JasonLovesDoggo in fix: remove client-suppliedX-Anubis-*header spoofing vector #1919New Contributors
Full Changelog: v1.27.0...v1.28.0
This discussion was created from the release v1.28.0: Wuk Lamat.
All reactions