qing
b2ecb8e12b
fix(libmsg): close fd-reuse race silently killing short-lived connections
...
worker 收 EOF 失败后过早清除 busy 标记，事件循环对同一 fd 重复投递任务，
迟到的失败标记经 fd 复用落在新连接上被 _reap_failed 误杀（客户端收到空 EOF）。
失败路径改由 _reap_failed 统一清除 busy 并关闭；_handle_client 增加防重复投递守卫。
memdb 短连接压力测试错误率从 5-9% 降至 0。
2026-08-17 14:29:37 +00:00
qing
685c5c1754
refactor(libmsg): 将审计结论合入代码注释并精简审计报告
...
- 在 libmsg 各头文件修复位置补充 [libmsg-audit <编号>] 标签（27 处），
覆盖 16 条安全审计发现（P0-1/P0-2/P1-1~3/P2-1~8/P3-1~3），
将已完成修复锚定到源码
- 从审计文档删除 335 行逐条详细发现（问题描述/修复方案/触发场景/代码块），
替换为 16 行「已解决发现」紧凑台账 + 源码定位指针
- 文档保留：严重等级表、修复进度汇总、已有安全机制、已知限制 L-1~L-12、
变更记录、审计结论
2026-08-10 01:26:10 +08:00
qing
e2f05f9a43
fix(libmsg): security audit round 4 - eliminate residual race + atomic server_fd
...
- P1-3: introduce ConnectionLock (mutex + atomic active) to close the residual
CWE-362 race where _remove_client closes fd before reply/broadcast acquires
the lock; senders now check active after locking and abort if fd was closed
- P2-7: make _server_fd std::atomic<int> to remove the data-race UB between
stop() and _event_loop
- P2-8: validate on_message is non-null in MsgServer::start()
- P3-2: distinguish missing _route vs wrong-typed _route in RpcServer
- P3-3: set TCP_NODELAY/SO_SNDTIMEO before registering fd in _clients
- doc: add SO_SNDTIMEO precondition note to pmsg_send
2026-08-07 21:27:05 +08:00
qing
63c22a3d60
fix(libmsg): security audit round 3 - add server send timeout + harden RPC validation
2026-08-07 21:13:14 +08:00
qing
3c50a862d3
fix(libmsg): complete security audit round 2 - fix P0 race + harden input validation
...
- P0: fix _close_all_clients() race condition (CWE-362) - hold per-connection send_lock
before close() to prevent messages being sent to wrong client after fd reuse
- P2: add comprehensive input validation for all public APIs
(timeout/port/workers/max_connections/batch_size etc. bounds checking)
- P2: add UTF-8 payload validation (isValidUtf8) aligning with Python pymsg behavior,
rejecting overlong encodings, surrogate pairs, truncated/invalid sequences
- P2: document pmsg_recv(int) precondition and recommend deadline mode
- add constructor validation for MsgClient/MsgServer/AsyncQueue/RpcClient/RpcServer
- add add_route() validation for empty route name and null handler
- update security audit report with round 2 findings and fixes (8 issues total, 100% fixed)
2026-08-07 21:01:34 +08:00
qing
e92ef05ed0
fix(libmsg): 修复安全审计发现的三个漏洞
...
- CWE-362: _remove_client() 关闭 fd 前获取 per-connection send_lock，
防止 broadcast/reply 向 OS 复用的 fd 发送数据到错误客户端
- CWE-400: workers>0 模式下消息接收移至 worker 线程，
事件循环不再阻塞 pmsg_recv，防 Slowloris DoS
- CWE-209: 扩展 _sanitize_error 路径正则为 /\S+，
覆盖含空格/括号/@/~ 等特殊字符的内部路径，防信息泄露
2026-08-06 17:16:33 +00:00
qing
1d44e0dcb8
feat(libmsg): add pymsg C++ library with AsyncQueue, MsgServer, and JSON RPC layer
...
- Add libmsg module: pymsg protocol implementation (4-byte BE length prefix + UTF-8)
- Add AsyncQueue<T>: generic async batch queue with backpressure (aligned with Python AsyncRpcQueue)
- Add MsgServer: select-based multi-client TCP server with optional thread pool
- Add RpcClient/RpcServer: JSON RPC convention layer with automatic route injection
- Refactor gateway/LogC.hpp to use AsyncQueue for async batch log delivery
- Update gateway/DbC.hpp to add call_msg() using pymsg TCP protocol
- Remove duplicated gateway/inc/Msg.hpp (now provided by libmsg)
- Update gateway/Makefile and _inst.sh build order
Fixes included:
- pmsg_send size check uses kMaxMsgSize (64MiB) instead of 4GiB
- MsgClient._running uses std::atomic<bool> for thread safety
- Deadline-based recv timeout to prevent Slowloris (header+payload shared deadline)
2026-08-06 23:48:06 +08:00
qing