cool.io 1.9.4 → 1.10.0

data/ext/libev/ev_wrap.h

@@ -98,6 +98,8 @@
 #define vec_ro ((loop)->vec_ro)
 #define vec_wi ((loop)->vec_wi)
 #define vec_wo ((loop)->vec_wo)
+#define win32_fs ((loop)->win32_fs)
+#define win32_fs_disabled ((loop)->win32_fs_disabled)
 #else
 #undef EV_WRAP_H
 #undef acquire_cb
@@ -197,4 +199,6 @@
 #undef vec_ro
 #undef vec_wi
 #undef vec_wo
+#undef win32_fs
+#undef win32_fs_disabled
 #endif

data/gems.rb

@@ -7,3 +7,7 @@ group :maintenance, optional: true do
   gem "bake-gem"
   gem "bake-modernize"
 end
+
+group :development, :test do
+  gem 'ruby_memcheck', '~> 3.0' if RUBY_PLATFORM.include?('linux')
+end

data/lib/cool.io/dns_resolver.rb

@@ -18,6 +18,8 @@
 #++
 
 require 'resolv'
+require 'securerandom'
+require 'socket'
 
 module Coolio
   # A non-blocking DNS resolver.  It provides interfaces for querying both
@@ -67,14 +69,22 @@ module Coolio
     # list of nameservers to query.  By default the resolver will
     # use nameservers listed in /etc/resolv.conf
     def initialize(hostname, *nameservers)
+      nameservers = reject_ipv6_nameservers(nameservers)
       if nameservers.empty?
-        nameservers = Resolv::DNS::Config.default_config_hash[:nameserver]
+        nameservers = reject_ipv6_nameservers(Resolv::DNS::Config.default_config_hash[:nameserver])
         raise RuntimeError, "no nameservers found" if nameservers.empty? # TODO just call resolve_failed, not raise [also handle Errno::ENOENT)]
       end
 
       @nameservers = nameservers.dup
       @question = request_question hostname
 
+      # A guessable ID would let an off-path attacker forge a response
+      @request_id = SecureRandom.random_number(1 << 16)
+
+      # Numeric addresses this query was sent to, and the lookups behind them
+      @queried_addresses = []
+      @numeric_addresses = {}
+
       @socket = UDPSocket.new
       @timer = Timeout.new(self)
 
@@ -113,27 +123,44 @@ module Coolio
 
     # Send a request to the DNS server
     def send_request
-      nameserver = @nameservers.shift
-      @nameservers << nameserver # rotate them
+      @nameservers.rotate!
+
+      # Send to the numeric address, so we know where a response must come from
+      address = numeric_address(@nameservers.first)
+      @queried_addresses << address unless @queried_addresses.include?(address)
+
       begin
-        @socket.send request_message, 0, @nameservers.first, DNS_PORT
+        @socket.send request_message, 0, address, DNS_PORT
       rescue Errno::EHOSTUNREACH # TODO figure out why it has to be wrapper here, when the other wrapper should be wrapping this one!
       end
     end
 
     # Called by the subclass when the DNS response is available
     def on_readable
-      datagram = nil
+      datagram = sender = nil
       begin
-        datagram = @socket.recvfrom_nonblock(DATAGRAM_SIZE).first
+        datagram, sender = @socket.recvfrom_nonblock(DATAGRAM_SIZE)
       rescue Errno::ECONNREFUSED
       end
 
+      # Ignore anything we didn't ask for, rather than resolving or failing on it.
+      # The query stays outstanding, so the retry timer still bounds us.
+      return if datagram and not solicited_response?(datagram, sender)
+
       address = response_address datagram rescue nil
       address ? on_success(address) : on_failure
       detach
     end
 
+    # Is this a reply to our query, from an address we sent it to?
+    # Retries rotate through @nameservers, so any address already queried counts.
+    def solicited_response?(datagram, sender)
+      return false unless datagram.size >= 12
+      return false unless sender and sender[1] == DNS_PORT and @queried_addresses.include?(sender[3])
+
+      datagram[0..1].unpack('n').first.to_i == @request_id
+    end
+
     def request_question(hostname)
       raise ArgumentError, "hostname cannot be nil" if hostname.nil?
 
@@ -151,7 +178,7 @@ module Coolio
 
     def request_message
       # Standard query header
-      message = [2, 1, 0].pack('nCC')
+      message = [@request_id, 1, 0].pack('nCC')
 
       # One entry
       qdcount = 1
@@ -166,7 +193,7 @@ module Coolio
     def response_address(message)
       # Confirm the ID field
       id = message[0..1].unpack('n').first.to_i
-      return unless id == 2
+      return unless id == @request_id
 
       # Check the QR value and confirm this message is a response
       qr = message[2..2].unpack('B1').first.to_i
@@ -191,6 +218,7 @@ module Coolio
       while not message.empty?
         type = message[2..3].unpack('n').first.to_i
         rdlength = message[10..11].unpack('n').first.to_i
+        return if message.bytesize < 12 + rdlength
         rdata = message[12..(12 + rdlength - 1)]
         message.slice!(0, 12 + rdlength)
 
@@ -204,6 +232,23 @@ module Coolio
       nil
     end
 
+    private
+
+    def reject_ipv6_nameservers(nameservers)
+      nameservers.reject { |ns| ns.include?(':') }
+    end
+
+    # The address of a nameserver, which may be given as a hostname.
+    # Only successful lookups are cached, so a transient failure is looked up again.
+    def numeric_address(nameserver)
+      @numeric_addresses[nameserver] ||= begin
+        addrinfo = Addrinfo.getaddrinfo(nameserver, nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM).first
+        raise SocketError, "getaddrinfo: no IPv4 address for #{nameserver}" if addrinfo.nil?
+
+        addrinfo.ip_address
+      end
+    end
+
     class Timeout < TimerWatcher
       def initialize(resolver)
         @resolver = resolver

data/lib/cool.io/loop.rb

@@ -38,6 +38,10 @@ module Coolio
     #     :kqueue (BSD/Mac OS X)
     #     :port   (Solaris 10)
     #
+    # Raises RuntimeError if none of the selected backends is usable.
+    # Unless :skip_environment is true, $LIBEV_FLAGS can override the
+    # backend selection and cause the same error.
+    #
     def initialize(options = {})
       @watchers = {}
       @active_watchers = 0
@@ -47,7 +51,7 @@ module Coolio
       options.each do |option, value|
         case option
         when :skip_environment
-          flags |= EVFLAG_NOEV if value
+          flags |= EVFLAG_NOENV if value
         when :fork_check
           flags |= EVFLAG_FORKCHECK if value
         when :backend

data/lib/cool.io/version.rb

@@ -1,6 +1,6 @@
 module Coolio
-  VERSION = "1.9.4"
-  
+  VERSION = "1.10.0"
+
   def self.version
     VERSION
   end

data/libev_win_select.diff

@@ -1,20 +1,26 @@
 diff --git a/ext/libev/ev.c b/ext/libev/ev.c
-index dae87f1..d15f6bd 100644
+index a59efb2..5c18fd6 100644
 --- a/ext/libev/ev.c
 +++ b/ext/libev/ev.c
-@@ -207,6 +207,7 @@
+@@ -210,6 +210,13 @@
  #else
  # include <io.h>
  # define WIN32_LEAN_AND_MEAN
-+# define FD_SETSIZE 1024
++/* ruby.h above already pulled in winsock2.h, so fd_set may be dimensioned
++ * already. Defining FD_SETSIZE unconditionally here would only move the bound
++ * used by EV_WIN_FD_SET, not the array it indexes. Take whatever is in effect
++ * and only supply a default when nothing has been decided yet. */
++# ifndef FD_SETSIZE
++#  define FD_SETSIZE 1024
++# endif
  # include <winsock2.h>
  # include <windows.h>
  # ifndef EV_SELECT_IS_WINSOCKET
 diff --git a/ext/libev/ev_select.c b/ext/libev/ev_select.c
-index f38d6ca..7050778 100644
+index ed1fc7a..eccff2b 100644
 --- a/ext/libev/ev_select.c
 +++ b/ext/libev/ev_select.c
-@@ -67,6 +67,54 @@
+@@ -67,6 +67,64 @@
  
  #include <string.h>
  
@@ -58,6 +64,16 @@ index f38d6ca..7050778 100644
 +#define EV_WIN_FD_ZERO(set) (((fd_set *)(set))->fd_count=0)
 +#define EV_WIN_FD_ISSET(fd, set) __WSAFDIsSet((SOCKET)(fd), (fd_set *)(set))
 +#define EV_WIN_FD_COUNT(set) (((fd_set *)(set))->fd_count)
++
++/*
++fd_set is dimensioned by whatever FD_SETSIZE was in effect when winsock2.h was
++first pulled in, but EV_WIN_FD_SET and select_modify bound-check against the
++FD_SETSIZE visible here. The two are decided by separate paths, so if the bound
++ever exceeds the declared array we would write past the end of the allocation in
++select_init. Catch that at build time instead.
++*/
++typedef char coolio_fd_setsize_matches_fd_set[
++	(sizeof (((fd_set *)0)->fd_array) / sizeof (SOCKET) >= (size_t)FD_SETSIZE) ? 1 : -1];
 +/* ######################################## */
 +#else
 +#define EV_WIN_FD_CLR FD_CLR
@@ -69,7 +85,7 @@ index f38d6ca..7050778 100644
  static void
  select_modify (EV_P_ int fd, int oev, int nev)
  {
-@@ -91,17 +139,17 @@ select_modify (EV_P_ int fd, int oev, int nev)
+@@ -91,17 +149,17 @@ select_modify (EV_P_ int fd, int oev, int nev)
      if ((oev ^ nev) & EV_READ)
      #endif
        if (nev & EV_READ)
@@ -91,7 +107,7 @@ index f38d6ca..7050778 100644
  
  #else
  
-@@ -197,8 +245,8 @@ select_poll (EV_P_ ev_tstamp timeout)
+@@ -197,8 +255,8 @@ select_poll (EV_P_ ev_tstamp timeout)
          {
            if (timeout)
              {
@@ -102,7 +118,7 @@ index f38d6ca..7050778 100644
              }
  
            return;
-@@ -230,10 +278,10 @@ select_poll (EV_P_ ev_tstamp timeout)
+@@ -230,10 +288,10 @@ select_poll (EV_P_ ev_tstamp timeout)
            int handle = fd;
            #endif
  
@@ -116,7 +132,7 @@ index f38d6ca..7050778 100644
            #endif
  
            if (expect_true (events))
-@@ -279,9 +327,9 @@ select_init (EV_P_ int flags)
+@@ -280,9 +338,9 @@ select_init (EV_P_ int flags)
    backend_poll    = select_poll;
  
  #if EV_SELECT_USE_FD_SET

data/spec/async_watcher_spec.rb

@@ -30,7 +30,9 @@ describe Cool.io::AsyncWatcher, :env => :exclude_win do
     end
 
     # ensure children are ready
-    nr_fork.times { expect(rd.sysread(1)).to eq('.') }
+    # rd may be O_NONBLOCK on macOS Ruby 3.2+ (IO.pipe sets O_NONBLOCK); use read
+    # instead of sysread so EAGAIN on an empty pipe is retried transparently.
+    nr_fork.times { expect(rd.read(1)).to eq('.') }
 
     # send our signals
     nr_signal.times { aw.signal }

data/spec/detach_race_condition_spec.rb

@@ -1,10 +1,13 @@
 require 'spec_helper'
 
 describe Cool.io::Loop do
+  # An IOWatcher that drains its socket and then runs a user-supplied block,
+  # receiving itself as the argument.
   class Victim < Cool.io::IOWatcher
-    def initialize(io)
-      super
+    def initialize(io, &on_readable)
+      super(io)
       @io = io
+      @on_readable = on_readable
     end
 
     def on_readable
@@ -12,40 +15,71 @@ describe Cool.io::Loop do
         @io.read_nonblock(1024)
       rescue IO::WaitReadable, EOFError
       end
+      @on_readable.call(self) if @on_readable
     end
   end
 
   # https://github.com/socketry/cool.io/issues/87
-  it "does not raise TypeError when a watcher is detached while an event is pending" do
-    loop = Cool.io::Loop.default
-
+  #
+  # Several watchers have an event pending in the same loop iteration.  When the
+  # first one dispatched detaches the others, the loop must skip their now-stale
+  # pending events instead of dispatching them to a detached watcher.  Before the
+  # fix that raised "TypeError: wrong argument type nil (expected Coolio::Loop)"
+  # and could crash the VM.
+  #
+  # This is exercised deterministically within a single thread (a preceding
+  # callback detaching another watcher in the same loop cycle).  The original
+  # reproduction detached from a separate thread while the loop was polling,
+  # which is an unsupported concurrent mutation of libev (not thread-safe) and
+  # crashed intermittently on macOS.
+  it "does not raise when a watcher with a pending event is detached during dispatch" do
     iterations = 200
+    # Winsock select monitors sockets, not IO.pipe handles. TCP connections
+    # exercise the same queued-event scenario on every supported platform.
+    listener = TCPServer.new('127.0.0.1', 0)
 
-    expect {
-      iterations.times do
-        r_victim, w_victim = IO.pipe
-        victim_watcher = Victim.new(r_victim)
-        victim_watcher.attach(loop)
+    iterations.times do
+      coolio_loop = Cool.io::Loop.new
+      connections = []
+      watchers = []
 
-        t1 = Thread.new do
-          sleep 0.01
-          w_victim.write("dummy\n")
+      begin
+        5.times do
+          w = TCPSocket.new('127.0.0.1', listener.addr[1])
+          connections << [nil, w]
+          r = listener.accept
+          connections.last[0] = r
+
+          watcher = Victim.new(r) do |fired|
+            # Detach every other watcher whose event is already queued for this
+            # same loop iteration.
+            watchers.each do |other|
+              other.detach if !other.equal?(fired) && other.attached?
+            end
+          end
+          watcher.attach(coolio_loop)
+          watchers << watcher
+
+          w.write("dummy\n") # make the read end readable so an event is pending
         end
 
-        t2 = Thread.new do
-          sleep 0.01
-          victim_watcher.detach
+        # TCP delivery is asynchronous. Ensure all five read ends are ready
+        # before libev collects the events, without consuming their data.
+        connections.each do |r, _|
+          expect(IO.select([r], nil, nil, 2)).not_to be_nil
         end
-
-        loop.run_once
-
-        t1.join
-        t2.join
-
-        r_victim.close
-        w_victim.close
+        coolio_loop.run_once
+
+        # Only the first dispatched watcher runs; it detaches the other four,
+        # whose pending events are then skipped.
+        expect(watchers.count(&:attached?)).to eq(1)
+      ensure
+        watchers.each { |watcher| watcher.detach if watcher.attached? }
+        connections.each { |r, w| r.close if r; w.close }
       end
-    }.not_to raise_error
+    end
+  ensure
+    listener.close if listener
   end
 
   class HttpHandler < Coolio::IO

data/spec/dns_spec.rb

@@ -1,4 +1,5 @@
 require File.expand_path('../spec_helper', __FILE__)
+require 'tempfile'
 
 VALID_DOMAIN = "google.com"
 INVALID_DOMAIN = "gibidigibigididibitidibigitibidigitidididi.com"
@@ -55,4 +56,200 @@ describe "DNS" do
       expect( Coolio::DNSResolver.hosts("localhost", file.path)).to eq @preferred_localhost_address
     end
   end
+
+  describe "IPv6 nameserver filtering" do
+    it "ignores IPv6 nameservers provided in arguments" do
+      resolver = Coolio::DNSResolver.new("example.com", "8.8.8.8", "2001:4860:4860::8888", "1.1.1.1")
+
+      nameservers = resolver.instance_variable_get(:@nameservers)
+      expect(nameservers).to eq(["8.8.8.8", "1.1.1.1"])
+    end
+
+    it "falls back to default IPv4 config if only IPv6 addresses are provided" do
+      allow(Resolv::DNS::Config).to receive(:default_config_hash).and_return({
+        nameserver: ["8.8.4.4", "2001:4860:4860::8844"]
+      })
+
+      resolver = Coolio::DNSResolver.new("example.com", "2001:4860:4860::8888")
+
+      nameservers = resolver.instance_variable_get(:@nameservers)
+      expect(nameservers).to eq(["8.8.4.4"])
+    end
+  end
+
+  describe "nameserver normalization" do
+    let(:localhost_address) do
+      Addrinfo.getaddrinfo("localhost", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM).first.ip_address
+    end
+
+    it "keeps the nameserver list as given" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+
+      expect(resolver.instance_variable_get(:@nameservers)).to eq(["localhost"])
+    end
+
+    it "queries the numeric address of a nameserver given as a hostname" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+      resolver.__send__(:send_request)
+
+      expect(resolver.instance_variable_get(:@queried_addresses)).to eq([localhost_address])
+    end
+
+    it "accepts responses from a nameserver which was given as a hostname" do
+      resolver = Coolio::DNSResolver.new("example.com", "localhost")
+      resolver.__send__(:send_request)
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 53, localhost_address, localhost_address])
+      ).to be true
+    end
+
+    it "looks a nameserver up once and reuses the result on retries" do
+      resolved = Addrinfo.getaddrinfo("127.0.0.1", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM)
+      resolver = Coolio::DNSResolver.new("example.com", "127.0.0.1")
+
+      expect(Addrinfo).to receive(:getaddrinfo).once.and_return(resolved)
+
+      3.times { resolver.__send__(:send_request) }
+    end
+
+    it "does not reject an unresolvable nameserver at construction" do
+      allow(Addrinfo).to receive(:getaddrinfo).and_raise(SocketError, "getaddrinfo: Name or service not known")
+
+      expect do
+        Coolio::DNSResolver.new("example.com", "no-such-nameserver.invalid")
+      end.to_not raise_error
+    end
+
+    it "surfaces an unresolvable nameserver as a SocketError from the request" do
+      allow(Addrinfo).to receive(:getaddrinfo).and_raise(SocketError, "getaddrinfo: Name or service not known")
+      resolver = Coolio::DNSResolver.new("example.com", "no-such-nameserver.invalid")
+
+      expect { resolver.attach(@loop) }.to raise_error(SocketError)
+      expect(@loop.watchers).to be_empty
+    end
+
+    it "recovers when a nameserver is only transiently unresolvable" do
+      resolved = Addrinfo.getaddrinfo("127.0.0.1", nil, ::Socket::AF_INET, ::Socket::SOCK_DGRAM)
+      resolver = Coolio::DNSResolver.new("example.com", "ns.example.test")
+
+      attempts = 0
+      allow(Addrinfo).to receive(:getaddrinfo) do
+        attempts += 1
+        raise SocketError, "getaddrinfo: Name or service not known" if attempts == 1
+
+        resolved
+      end
+
+      expect { resolver.__send__(:send_request) }.to raise_error(SocketError)
+      expect { resolver.__send__(:send_request) }.to_not raise_error
+      expect(resolver.instance_variable_get(:@queried_addresses)).to eq(["127.0.0.1"])
+    end
+  end
+
+  describe "response validation" do
+    let(:nameserver) { "127.0.0.1" }
+    let(:sender) { ["AF_INET", 53, nameserver, nameserver] }
+    let(:resolver) do
+      Coolio::DNSResolver.new("example.com", nameserver).tap { |r| r.__send__(:send_request) }
+    end
+
+    it "uses an unpredictable transaction ID for each query" do
+      ids = 10.times.map do
+        request_id_of(Coolio::DNSResolver.new("example.com", nameserver))
+      end
+
+      expect(ids.uniq.size).to be > 1
+    end
+
+    it "accepts a response carrying our transaction ID from the queried nameserver" do
+      expect(
+        resolver.__send__(:solicited_response?, dns_response_for(resolver), sender)
+      ).to be true
+    end
+
+    it "rejects a response carrying a different transaction ID" do
+      forged = dns_response_for(resolver, id: (request_id_of(resolver) + 1) % 65536)
+
+      expect(resolver.__send__(:solicited_response?, forged, sender)).to be false
+    end
+
+    it "rejects a response from a source address we did not query" do
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 53, "10.11.12.13", "10.11.12.13"])
+      ).to be false
+    end
+
+    it "rejects a response arriving before the request was sent" do
+      unsent = Coolio::DNSResolver.new("example.com", nameserver)
+
+      expect(unsent.__send__(:solicited_response?, dns_response_for(unsent), sender)).to be false
+    end
+
+    it "rejects a response from a source port other than the DNS port" do
+      response = dns_response_for(resolver)
+
+      expect(
+        resolver.__send__(:solicited_response?, response, ["AF_INET", 4444, nameserver, nameserver])
+      ).to be false
+    end
+
+    it "rejects a truncated datagram" do
+      expect(resolver.__send__(:solicited_response?, "\0\0", sender)).to be false
+    end
+
+    it "resolves from a response sent by the queried nameserver" do
+      response = dns_response_for(resolver, address: "1.2.3.4")
+      allow(resolver.instance_variable_get(:@socket)).to receive(:recvfrom_nonblock).and_return([response, sender])
+
+      expect(resolver).to receive(:on_success).with("1.2.3.4")
+      expect(resolver).to receive(:detach)
+
+      resolver.__send__(:on_readable)
+    end
+
+    it "fails a response whose A record is shorter than its RDLENGTH instead of resolving a bogus address" do
+      truncated = dns_response_for(resolver, address: "1.2.3.4")[0...-4]
+      allow(resolver.instance_variable_get(:@socket)).to receive(:recvfrom_nonblock).and_return([truncated, sender])
+
+      expect(resolver).to_not receive(:on_success)
+      expect(resolver).to receive(:on_failure)
+      expect(resolver).to receive(:detach)
+
+      resolver.__send__(:on_readable)
+    end
+
+    it "ignores a spoofed response instead of resolving or failing it" do
+      forged = dns_response_for(resolver, address: "6.6.6.6")
+      allow(resolver.instance_variable_get(:@socket)).to receive(:recvfrom_nonblock)
+        .and_return([forged, ["AF_INET", 53, "10.11.12.13", "10.11.12.13"]])
+
+      expect(resolver).to_not receive(:on_success)
+      expect(resolver).to_not receive(:on_failure)
+      expect(resolver).to_not receive(:detach)
+
+      resolver.__send__(:on_readable)
+    end
+  end
+
+  def request_id_of(resolver)
+    resolver.__send__(:request_message)[0..1].unpack('n').first
+  end
+
+  # A response to the resolver's own query: header plus the echoed question,
+  # and an A record when an address is given.
+  def dns_response_for(resolver, id: request_id_of(resolver), address: nil)
+    question = resolver.instance_variable_get(:@question)
+    answer = if address
+      # Compressed name pointer, type A, class IN, TTL, RDLENGTH, RDATA
+      [0xc00c, 1, 1, 60, 4].pack('nnnNn') + address.split('.').map(&:to_i).pack('CCCC')
+    else
+      ""
+    end
+
+    [id, 0x81, 0x80, 1, answer.empty? ? 0 : 1, 0, 0].pack('nCCnnnn') + question + answer
+  end
 end