serverengine 2.0.7 → 2.1.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
-SHA256:
-  metadata.gz: 849803d15dfe8e2b3e551b2849d8eb3d02deeffa271d4fa5f890ac4fb8db9a64
-  data.tar.gz: 703964e48ed203464b7d98eeaee0a161c88c4fc9597c2c1028e4cc3860b52476
+SHA1:
+  metadata.gz: 0fc6a5674589bf35670db4884c9d5b24ebc7c3ad
+  data.tar.gz: 2d90ee7be95869d687149d954d230462da3571c9
 SHA512:
-  metadata.gz: 7b372a236fbb4861d6a1143c35a17466483d5e43730e6e6ce3a6dbe9c8a85cd560fbf7cb8a73e84edf7f0a56cecf9a1ec0e596cceed552c174d61d83765f2d49
-  data.tar.gz: '092f8d447cab9895701e566fe5185f6043ca483ff2cc905c57ae653f5551b80f6b080b9f0b51fb1fc42b8466eae463a5809e0941a27e770323479cf99e5e1f92'
+  metadata.gz: fa77bfaee529a011584d2ca8791a65e99193b4e5d21ce1ccdb326aea1fdea6016d32e6ec481ebe1f2bc395cdec8fccfe592578327dffdec73a90a60308f29082
+  data.tar.gz: e3414b8d50c72c6c4a4eb82fafdfb4d2e9b3192c3390405b91b22db0b2929eba216a0544f1f377d80deafcd8fbae37bb01c7ea1d1c9f77e0597b92b54f196df2

data/.travis.yml

@@ -2,9 +2,10 @@ language: ruby
 
 rvm:
   - 2.1.10
-  - 2.2.6
-  - 2.3.3
-  - 2.4.0
+  - 2.2.9
+  - 2.3.8
+  - 2.4.5
+  - 2.5.3
   - ruby-head
 
 branches:

data/Changelog

@@ -1,3 +1,7 @@
+2018-11-14 version 2.1.0:
+
+* Improve socket manager security
+
 2018-07-09 version 2.0.7:
 
 * Add disable_sigdump option

data/lib/serverengine/process_manager.rb

@@ -16,6 +16,7 @@
 #    limitations under the License.
 #
 require 'fcntl'
+require 'serverengine/socket_manager'
 
 module ServerEngine
 
@@ -185,6 +186,7 @@ module ServerEngine
           @command_sender_pipe.binmode
           options[:in] = inpipe
         end
+        env['SERVERENGINE_SOCKETMANAGER_INTERNAL_TOKEN'] = SocketManager::INTERNAL_TOKEN
         pid = Process.spawn(env, *args, options)
         if @command_sender == "pipe"
           inpipe.close

data/lib/serverengine/socket_manager.rb

@@ -18,9 +18,18 @@
 require 'socket'
 require 'ipaddr'
 require 'time'
+require 'securerandom'
+require 'json'
+require 'base64'
 
 module ServerEngine
   module SocketManager
+    # This token is used for communication between peers. If token is mismatched, messages will be discarded
+    INTERNAL_TOKEN = if ENV.has_key?('SERVERENGINE_SOCKETMANAGER_INTERNAL_TOKEN')
+                       ENV['SERVERENGINE_SOCKETMANAGER_INTERNAL_TOKEN']
+                     else
+                       SecureRandom.hex
+                     end
 
     class Client
       def initialize(path)
@@ -154,7 +163,8 @@ module ServerEngine
     end
 
     def self.send_peer(peer, obj)
-      data = Marshal.dump(obj)
+      data = [SocketManager::INTERNAL_TOKEN, Base64.strict_encode64(Marshal.dump(obj))]
+      data = JSON.generate(data)
       peer.write [data.bytesize].pack('N')
       peer.write data
     end
@@ -165,7 +175,10 @@ module ServerEngine
 
       len = res.unpack('N').first
       data = peer.read(len)
-      Marshal.load(data)
+      data = JSON.parse(data)
+      return nil if SocketManager::INTERNAL_TOKEN != data.first
+
+      Marshal.load(Base64.strict_decode64(data.last))
     end
 
     if ServerEngine.windows?

data/lib/serverengine/socket_manager_unix.rb

@@ -70,7 +70,12 @@ module ServerEngine
         # when client changed working directory
         path = File.expand_path(path)
 
-        @server = UNIXServer.new(path)
+        begin
+          old_umask = File.umask(0077) # Protect unix socket from other users
+          @server = UNIXServer.new(path)
+        ensure
+          File.umask(old_umask)
+        end
 
         @thread = Thread.new do
           begin
@@ -96,7 +101,14 @@ module ServerEngine
       end
 
       def send_socket(peer, pid, method, bind, port)
-        sock = send(method, bind, port)  # calls listen_tcp or listen_udp
+        sock = case method
+               when :listen_tcp
+                 listen_tcp(bind, port)
+               when :listen_udp
+                 listen_udp(bind, port)
+               else
+                 raise ArgumentError, "Unknown method: #{method.inspect}"
+               end
 
         SocketManager.send_peer(peer, nil)
 

data/lib/serverengine/version.rb

@@ -1,3 +1,3 @@
 module ServerEngine
-  VERSION = "2.0.7"
+  VERSION = "2.1.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: serverengine
 version: !ruby/object:Gem::Version
-  version: 2.0.7
+  version: 2.1.0
 platform: ruby
 authors:
 - Sadayuki Furuhashi
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2018-07-10 00:00:00.000000000 Z
+date: 2018-11-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: sigdump
@@ -154,7 +154,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.7.6
+rubygems_version: 2.6.14.1
 signing_key: 
 specification_version: 4
 summary: ServerEngine - multiprocess server framework