Commit Graph
2 Commits
Author SHA1 Message Date
qing e92ef05ed0 fix(libmsg): 修复安全审计发现的三个漏洞
- CWE-362: _remove_client() 关闭 fd 前获取 per-connection send_lock,
  防止 broadcast/reply 向 OS 复用的 fd 发送数据到错误客户端
- CWE-400: workers>0 模式下消息接收移至 worker 线程,
  事件循环不再阻塞 pmsg_recv,防 Slowloris DoS
- CWE-209: 扩展 _sanitize_error 路径正则为 /\S+,
  覆盖含空格/括号/@/~ 等特殊字符的内部路径,防信息泄露
2026-08-06 17:16:33 +00:00
qing 1d44e0dcb8 feat(libmsg): add pymsg C++ library with AsyncQueue, MsgServer, and JSON RPC layer
- Add libmsg module: pymsg protocol implementation (4-byte BE length prefix + UTF-8)
- Add AsyncQueue<T>: generic async batch queue with backpressure (aligned with Python AsyncRpcQueue)
- Add MsgServer: select-based multi-client TCP server with optional thread pool
- Add RpcClient/RpcServer: JSON RPC convention layer with automatic route injection
- Refactor gateway/LogC.hpp to use AsyncQueue for async batch log delivery
- Update gateway/DbC.hpp to add call_msg() using pymsg TCP protocol
- Remove duplicated gateway/inc/Msg.hpp (now provided by libmsg)
- Update gateway/Makefile and _inst.sh build order

Fixes included:
- pmsg_send size check uses kMaxMsgSize (64MiB) instead of 4GiB
- MsgClient._running uses std::atomic<bool> for thread safety
- Deadline-based recv timeout to prevent Slowloris (header+payload shared deadline)
2026-08-06 23:48:06 +08:00