Hello All Mongrel Users, For the unintiated, Mongrel is a web server that runs Ruby web applications really fast. Read http://mongrel.rubyforge.org/ to get find out more about it. This is the Iron Mongrel release. It is the result of trying to trash Mongrel until it can''t move and then fixing anything that comes up. The work was done on EastMedia''s and VeriSign''s upcoming project in order to make sure it can handle heavy loads and potentially malformed requests. The project is a security and identity project so having a web server that is able to block bad requests is very important. The testing methods used were (are): 1. Unit testing what I can. Mongrel is a server so many tests have to be done "live". 2. Thrashing Mongrel''s HTTP parser internally with random or near-random data (called fuzzing). 3. Using "Peach Fuzz":http://peachfuzz.sourceforge.net/ to thrash several live apps with randomness. 4. Running several extensive little scripts to explore the edges of death for Mongrel. 5. Heavy code audits covering as much code as possible to find any possible loose ends. The end result is a lot of little fixes which make Mongrel more robust against badly behaving clients and possibly against many potential security risks in the future. In general Mongrel 0.3.12.1 behaves more consistently compared to past releases when given random data or maliciously formatted data. The main changes are related to how IO is processed and how the HTTP parser rejects "bad" input. What the parser now blocks is: * Any header over 112k. * Any query string over 10k. * Any header field value over 80k. * Any header field name over 256 bytes. * Any request URI (the file part, not the whole thing) greater than 512 bytes. As soon as these conditions are detected the client is disconnected immediately and a log message is printed out listing the IP address, the exact cause, and the data that caused it. I''ll remove the data dump later, but I want people to shoot me valid requests that cause parser errors. That''s not all though. I''ve started a "security":security.html page where I''ll publish the results of security threats, tests, and improvements as well as any advice for folks. This release also features a few little features here and there: * Initial support for a "config script". I''ll be documenting this more, but it basically lets you use the Mongrel::RailsConfigurator to augment your application''s config via a small script. Just pass "-S config/mongrel.rb" and put any Mongrel::RailsConfigurator statements that are reasonable. * Mongrel will report the correct REMOTE_ADDR variable, but it does a little trick where if there is an X-FORWARDED-FOR header then it sets REMOTE_ADDR to that. * Fixes for little bugs like double log messages, but not a lot of changes to the overall core. Go ahead and install the usual way: gem install mongrel *or* gem upgrade Zed A. Shaw http://www.zedshaw.com/ http://mongrel.rubyforge.org/ P.S. The snazzy Iron Mongrel logo is courtesy court3nay from http://caboo.se/
Michael Schoen
2006-Apr-08 04:53 UTC
[Mongrel] Mongrel Web Server 0.3.12.1 -- Iron Mongrel
Zed Shaw wrote:> This keeps Mongrel light and lets people extend it for their own needs. > There''s already people using GemPlugins to implement management commands > through Capistrano, security enhancements, and monitoring for Mongrel.Do you know if those folks would mind sharing the Capistrano and monitoring plugins? Also, are you planning on something like scgi_cluster, to make it easier to configure and manage clusters of Mongrels (eg, proxied behind lighttpd)?