Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github.com/vimeo/galaxycache
galaxycache is a caching and cache-filling library, adapted from groupcache, intended as a replacement for memcached in many cases.
For API docs and examples, see http://godoc.org/github.com/vimeo/galaxycache
// Generate the protocol for this peer to Fetch from others with (package includes HTTP and gRPC)
grpcProto := NewGRPCFetchProtocol(grpc.WithInsecure())
// HTTP protocol as an alternative (passing the nil argument ensures use of the default basepath
// and opencensus Transport as an http.RoundTripper)
httpProto := NewHTTPFetchProtocol(nil)
// Create a new Universe with the chosen peer connection protocol and the URL of this process
u := NewUniverse(grpcProto, "my-url")
// Set the Universe's list of peer addresses for the distributed cache
u.Set("peer1-url", "peer2-url", "peer3-url")
// Define a BackendGetter (here as a function) for retrieving data
getter := GetterFunc(func(ctx context.Context, key string, dest Codec) error {
// Define your method for retrieving non-cached data here, i.e. from a database
})
// Create a new Galaxy within the Universe with a name, the max capacity of cache space you would
// like to allocate, and your BackendGetter
g := u.NewGalaxy("galaxy-1", 1 << 20, getter)
// In order to receive Fetch requests from peers over HTTP or gRPC, we must register this universe
// to handle those requests
// gRPC Server registration (note: you must create the server with an ocgrpc.ServerHandler for
// opencensus metrics to propogate properly)
grpcServer := grpc.NewServer(grpc.StatsHandler(&ocgrpc.ServerHandler{}))
RegisterGRPCServer(u, grpcServer)
// HTTP Handler registration (passing nil for the second argument will ensure use of the default
// basepath, passing nil for the third argument will ensure use of the DefaultServeMux wrapped
// by opencensus)
RegisterHTTPHandler(u, nil, nil)
// Refer to the http/grpc godocs for information on how to serve using the registered HTTP handler
// or gRPC server, respectively:
// HTTP: https://golang.org/pkg/net/http/#Handler
// gRPC: https://godoc.org/google.golang.org/grpc#Server
// Create a Codec for unmarshaling data into your format of choice - the package includes
// implementations for []byte and string formats, and the protocodec subpackage includes the
// protobuf adapter
sCodec := StringCodec{}
// Call Get on the Galaxy to retrieve data and unmarshal it into your Codec
ctx := context.Background()
err := g.Get(ctx, "my-key", &sCodec)
if err != nil {
// handle if Get returns an error
}
// Shutdown all open connections between peers before killing the process
u.Shutdown()
A consistent hashing algorithm determines the sharding of keys across peers in galaxycache. Further reading can be found here and here.
To keep galaxycache instances non-global (i.e. for multithreaded testing), a Universe
object contains all of the moving parts of the cache, including the logic for connecting to peers, consistent hashing, and maintaining the set of galaxies.
A Galaxy
is a grouping of keys based on a category determined by the user. For example, you might have a galaxy for Users and a galaxy for Video Metadata; those data types may require different fetching protocols on the backend -- separating them into different Galaxies
allows for this flexibility.
Each Galaxy
contains its own cache space. The cache is immutable; all cache population and eviction is handled by internal logic.
The cache within each galaxy is divided into a "maincache" and a "hotcache".
The "maincache" contains data that the local process is authoritative over. The maincache is always populated whenever data is fetched from the backend (with a LRU eviction policy).
In order to eliminate network hops, a portion of the cache space in each process is reserved for especially popular keys that the local process is not authoritative over. By default, this "hotcache" is populated by a key and its associated data by means of a requests-per-second metric. The logic for hotcache promotion can be configured by implementing a custom solution with the ShouldPromote.Interface
.
When Get
is called for a key in a Galaxy
in some process called Process_A:
PeerPicker
object delegates to the peer authoritative over the requested keyBackendGetter
to get the data, and populates its local maincacheFetch
on the authoritative remote peer, Process_B (method determined by FetchProtocol
)Get
to either find the data from its own local cache or use the specified BackendGetter
to get the data from elsewhere, such as by querying a databaseOur changes include the following:
Promoter.Interface
for choosing which keys get hotcachedSink
object with a Codec
marshaler interface, removed Byteview
)Group
type to Galaxy
, Getter
to BackendGetter
, Get
to Fetch
(for newly named RemoteFetcher
interface, previously called ProtoGetter
)PeerPicker
interface into a struct; contains a FetchProtocol
and RemoteFetchers
(generalizing for HTTP and GRPC fetching implementations), a hash map of other peer addresses, and a self URLUniverse
container that holds the [Galaxies
] (previously a global groups
map) and PeerPicker
(part of what used to be HTTPPool
)Universe
to allow for simpler handling of most galaxycache operations (setting Peers, instantiating a Picker, etc)HTTPHandler
and associated registration function for serving HTTP requests by reaching into an associated Universe
(deals with the other function of the deprecated HTTPPool
)ShouldPromote.Interface
for creating your own method to determine whether a key should be added to the hotcacheGalaxy
construction to override default promotion logic (with your promoter, max number of candidates, and relative hotcache size to maincache)See: https://github.com/golang/groupcache/blob/master/README.md
Use the golang-nuts mailing list for any discussion or questions.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.