Code Monkey home page Code Monkey logo

daemon_lib's Introduction

daemon_lib

Build Status

daemon_lib is a Java library that makes it easy to write parallelized task processors. The primary motivation is to make it easy to orchestrate multiple independent instances of a single program operating on different inputs. The core library has no infrastructure dependencies beyond access to a working directory on disk.

Adding the dependency

In Maven, make your project section look like this:

<project>
<!-- All the other stuff -->

  <dependencies>
    <!-- All your other dependencies -->
    <dependency>
      <groupId>com.liveramp</groupId>
      <artifactId>daemon_lib</artifactId>
      <version>1.0-SNAPSHOT</version>
    </dependency>
  </dependencies>

  <repositories>
    <repository>
      <id>maven-snapshots</id>
      <url>http://oss.sonatype.org/content/repositories/snapshots</url>
      <layout>default</layout>
        <releases>
          <enabled>false</enabled>
        </releases>
      <snapshots>
        <enabled>true</enabled>
        <updatePolicy>always</updatePolicy>
      </snapshots>
    </repository>
  </repositories>
</project>

The repository section is necessary because this project hasn't been published to Maven Central yet.

Background

We often find ourselves building systems that are essentially many instances of a single “workflow” operating on different inputs, commonly as the backend for an asynchronous service. These instances run in parallel, either as threads within the main application process for tasks that are short-lived, or as separate background processes on the same machine for tasks that need to survive application restarts.

daemon_lib handles all the boilerplate involved with building such a system, exposing control through a combination of configuration parameters and injectable callbacks to handle life cycle events.

Primary Constructs

  • Daemon: A highly-injectable, long-running process that delegates to user-provided classes to fetch new inputs, kick off workflows based on these inputs, and handle life cycle events. It is the runtime entry-point to the framework.

User-defined:

  • Joblet: A script that performs a single unit of work. It acts on a JobletConfig.
  • JobletConfig: A serializable object that encapsulates the inputs to a Joblet.
  • JobletConfigProducer: A class that returns the next unit of work. It is invoked by the main Daemon process when it is ready to do more work.
  • Callbacks: All callbacks receive the relevant JobletConfig as an argument.
    • onNewConfig: Fired just before a config is executed. Primarily used to update state so that the same config is not returned the next time the JobletConfigProducer is invoked.
    • onSuccess: Fired when the joblet terminates successfully. The definition of success depends on the JobletExecutor.
    • onFailure: Fired when the onSuccess is not.

User-configured:

  • JobletExecutor: Defines how a joblet should be executed. The core library ships with a couple of implementations:
    • Threading: Joblets are run within Callables submitted to a fixed size thread pool.
    • Forking: Forks a background process for each Joblet. It handles tracking this process and calling the relevant callbacks when the Joblet is done. It stores state on disk and is able to track a Joblet even after the main daemon process is restarted.

daemon_lib's People

Contributors

andreea-g avatar armaansarkar avatar girarda avatar johnnphillips avatar joshk0 avatar lancehc avatar levyforchh avatar mend-for-github-com[bot] avatar pwestling avatar rfaugeroux avatar roshan avatar shreyaskumar avatar tenzing-shaw avatar tuliren avatar

Watchers

 avatar

daemon_lib's Issues

CVE-2018-10237 (Medium) detected in guava-13.0.1.jar

CVE-2018-10237 - Medium Severity Vulnerability

Vulnerable Library - guava-13.0.1.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: http://code.google.com/p/guava-libraries

Path to dependency file: daemon_lib/pom.xml

Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211214/guava-13.0.1.jar

Dependency Hierarchy:

  • guava-13.0.1.jar (Vulnerable Library)

Found in HEAD commit: f84e8a93ceb9a7160579dc45eb608b462d863b9c

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1-jre, 24.1.1-android


  • Check this box to open an automated fix PR

CVE-2019-17571 (High) detected in log4j-1.2.16.jar

CVE-2019-17571 - High Severity Vulnerability

Vulnerable Library - log4j-1.2.16.jar

Apache Log4j 1.2

Path to dependency file: daemon_lib/pom.xml

Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211215/log4j-1.2.16.jar

Dependency Hierarchy:

  • log4j-1.2.16.jar (Vulnerable Library)

Found in HEAD commit: f84e8a93ceb9a7160579dc45eb608b462d863b9c

Vulnerability Details

Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log data. This affects Log4j versions up to 1.2 up to 1.2.17.

Publish Date: 2019-12-20

URL: CVE-2019-17571

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17571

Release Date: 2019-12-20

Fix Resolution: org.apache.logging.log4j:log4j-core:2.0-alpha1


  • Check this box to open an automated fix PR

CVE-2020-9488 (Low) detected in log4j-1.2.16.jar

CVE-2020-9488 - Low Severity Vulnerability

Vulnerable Library - log4j-1.2.16.jar

Apache Log4j 1.2

Path to dependency file: /tmp/ws-scm/daemon_lib/pom.xml

Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211215/log4j-1.2.16.jar

Dependency Hierarchy:

  • log4j-1.2.16.jar (Vulnerable Library)

Vulnerability Details

Improper validation of certificate with host mismatch in Apache Log4j SMTP appender. This could allow an SMTPS connection to be intercepted by a man-in-the-middle attack which could leak any log messages sent through that appender.

Publish Date: 2020-04-27

URL: CVE-2020-9488

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/LOG4J2-2819

Release Date: 2020-04-27

Fix Resolution: org.apache.logging.log4j:log4j-core:2.13.2


  • Check this box to open an automated fix PR

CVE-2020-8908 (Medium) detected in guava-13.0.1.jar

CVE-2020-8908 - Medium Severity Vulnerability

Vulnerable Library - guava-13.0.1.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: http://code.google.com/p/guava-libraries

Path to dependency file: daemon_lib/pom.xml

Path to vulnerable library: 20200424210531/downloadResource_331c3b2c-fe8a-4960-b2fa-029c406ee470/20200424211214/guava-13.0.1.jar

Dependency Hierarchy:

  • guava-13.0.1.jar (Vulnerable Library)

Vulnerability Details

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0


  • Check this box to open an automated fix PR

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.