Brad Arant
c3e8d70774
Thread/EPoll lifecycle: - Thread::~Thread() now actually joins/frees its worker thread (was empty - the OS thread kept running against already-freed EPoll/Socket objects on any early teardown, a confirmed "double free" crash) - EPoll::~EPoll() calls stop() if never explicitly stopped, for the same reason - epoll_wait() now uses a 1s timeout instead of blocking forever, so a worker thread can actually notice isStopping() and let itself be joined - EPoll::processCommand() iterated threads by value, silently double-freeing the real vector's Thread the moment each copy went out of scope - ThreadScope gained onThreadStart()/onThreadEnd() hooks (actually wired up now - the constructor that was supposed to store the scope discarded it) for per-thread C-library init (e.g. MySQL client) Socket/TCPSocket/TLS: - Socket::writeSocket(): give up and shut down a connection after 50 consecutive zero-progress sends instead of retrying forever - SSL_ERROR_WANT_READ on a write needs a READ to make progress, but resetSocket() re-arms EPOLLWRNORM regardless, which an already-writable TCP socket satisfies immediately - a real stuck connection generated 55GB, then 12.9GB of debug log this way before being caught - Socket::writeSocket() now honors sendData()'s actual return value (previously discarded, entry popped unconditionally after one call) - a large response could get silently truncated past what fit in one write()/SSL_write() call - TLS::registerSocket()/sendData()/receiveData(): `initialized` now only goes true once SSL_set_fd() has actually succeeded, and sendData()/receiveData() check it first - fixes a real SIGSEGV where a new session's own queued greeting could reach SSL_write() on a different epoll thread before this session's handshake setup had run - TCPServer::connectionRequest() now performs the TLS handshake ON THE ACCEPTED SESSION, not the listening server itself (was building SSL state on the wrong object, leaving every session's own `ssl` uninitialized) - TCPServer::receiveData() always uses the plain (non-TLS) read path - the listening socket is never itself a TLS peer - TCPSocket's block-mode literal reading used an unset `blockLength` field instead of `blockSize`, and could busy-spin forever on a multi-packet literal - TCPSocket line scanning replaced an unbounded strcspn() (assumes a NUL-terminated buffer; read past a non-NUL-terminated receive buffer into adjacent heap memory) with a bounds-checked memchr() scan Protocol/session handling: - CommandList::processRequest() now case-folds the command keyword before lookup - SMTP/POP3/IMAP commands are spec-required to be case-insensitive; a client sending "Mail From:" instead of "MAIL FROM:" previously failed to dispatch at all - TCPSession::protocol() no longer drops blank lines while a handler has grabbed input (e.g. __SMTP_DATA reading a message body, an IMAP APPEND literal) - those handlers depend on seeing blank lines as real content, not commands; this silently corrupted any message body containing a blank line - TCPSession's uuid alias fixed: streaming a raw uuid_t via operator<< triggered libstdc++'s unsigned-char* overload (strlen() on 16 binary bytes, a real stack-buffer-overflow read), and `alias` pointed at a stack-local that was already destroyed by the time the constructor returned - INotify::processEvent() only treats event->name as a NUL-terminated string when event->len > 0 (per inotify(7)) instead of unconditional strlen() on a field the kernel doesn't guarantee is even present - a confirmed heap-buffer-overflow read that had been misdiagnosed as a MySQL thread-safety issue
82 lines
2.7 KiB
C++
82 lines
2.7 KiB
C++
#include "INotify.h"
|
|
#include "Log.h"
|
|
#include "ZString.h"
|
|
#include <sys/inotify.h>
|
|
|
|
namespace core {
|
|
|
|
INotify::INotify(EPoll &ePoll) : Socket(ePoll, "INotify") {
|
|
setDescriptor(inotify_init());
|
|
}
|
|
|
|
INotify::~INotify() {
|
|
shutdown();
|
|
}
|
|
|
|
int INotify::addWatch(coreutils::ZString &watch) {
|
|
return inotify_add_watch(getDescriptor(), watch.c_str(), IN_ALL_EVENTS);
|
|
}
|
|
|
|
void INotify::removeWatch(int wd) {
|
|
inotify_rm_watch(getDescriptor(), wd);
|
|
}
|
|
|
|
void INotify::onDataReceived(coreutils::ZString &buffer) {
|
|
const struct inotify_event *event;
|
|
char *ptr;
|
|
for (ptr = buffer.getData();
|
|
ptr < buffer.getData() + buffer.getLength();
|
|
ptr += sizeof(struct inotify_event) + event->len) {
|
|
event = (const struct inotify_event *) ptr;
|
|
|
|
// event->name only exists - and is only NUL-terminated - when
|
|
// event->len > 0 (inotify(7): "This field is present only when
|
|
// the event relates to a file inside a watched directory ...
|
|
// otherwise ... this field is absent."). For events with
|
|
// len == 0 (e.g. IN_UNMOUNT, IN_Q_OVERFLOW, IN_IGNORED, or
|
|
// self-watch events), event->name is not a valid C-string at
|
|
// all - calling strlen() on it (as the old ZString(const char*)
|
|
// one-arg constructor did unconditionally here) reads past
|
|
// whatever garbage follows in the socket's 4096-byte receive
|
|
// buffer looking for a NUL, a real heap-buffer-overflow read
|
|
// confirmed via AddressSanitizer under concurrent load (the
|
|
// eventual heap corruption this caused was previously
|
|
// misdiagnosed as a MySQL client thread-safety issue, since it
|
|
// surfaces on whichever EPoll worker thread happens to service
|
|
// this watcher's socket and corrupts unrelated heap state).
|
|
// strnlen() bounded by event->len (rather than the one-arg
|
|
// ZString ctor's unbounded strlen) matches the kernel's actual
|
|
// guarantee: name is NUL-padded to exactly event->len bytes.
|
|
coreutils::ZString name = event->len > 0
|
|
? coreutils::ZString(event->name, strnlen(event->name, event->len))
|
|
: coreutils::ZString("");
|
|
|
|
if(event->mask & IN_ACCESS)
|
|
inAccess(name);
|
|
if(event->mask & IN_ATTRIB)
|
|
inAttrib(name.str());
|
|
if(event->mask & IN_CLOSE_WRITE)
|
|
inCloseWrite(name.str());
|
|
if(event->mask & IN_CLOSE_NOWRITE)
|
|
inCloseNoWrite(name.str());
|
|
if(event->mask & IN_CREATE)
|
|
inCreate(name);
|
|
if(event->mask & IN_DELETE)
|
|
inDelete(name.str());
|
|
if(event->mask & IN_DELETE_SELF)
|
|
inDeleteSelf(name.str());
|
|
if(event->mask & IN_MODIFY)
|
|
inModify(name.str());
|
|
if(event->mask & IN_MOVE_SELF)
|
|
inMoveSelf(name.str());
|
|
if(event->mask & IN_MOVED_FROM)
|
|
inMovedFrom(name.str());
|
|
if(event->mask & IN_MOVED_TO)
|
|
inMovedTo(name.str());
|
|
if(event->mask & IN_OPEN)
|
|
inOpen(name.str());
|
|
}
|
|
}
|
|
|
|
}
|