Commit graph

2527 commits

Author SHA1 Message Date
Zhidao HONG
62894ae77b Var: Refactored nxt_var_ref_get() 2024-02-20 06:09:23 +08:00
Andrew Clayton
30b410e490 Avoid a segfault in nxt_conn_io_sendbuf()
This is a simple temporary fix (doesn't address the underlying problem)
for an issue reported by a user on GitHub whereby downloading of files
from a PHP application would cause the router process to crash.

This is actually a generic problem that will affect anything sending
data via nxt_unit_response_write().

This is just a simple fix for the 1.32 release, after which the full
correct fix will be worked out.

Link: <https://github.com/nginx/unit/issues/1125>
Reported-by: rustedsword <https://github.com/rustedsword>
Co-developed-by: rustedsword <https://github.com/rustedsword>
Tested-by: rustedsword <https://github.com/rustedsword>
Tested-by: Andrew Clayton <a.clayton@nginx.com>
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 22:02:49 +00:00
Andrew Clayton
0c98353091 Node.js: Build/install fix
A user on GitHub reported an issue when trying to build/install the
nodejs language module.

Doing a

  $ ./configure nodejs --node=/usr/bin/node --npm=/usr/bin/npm --node-gyp=/usr/bin/node-gyp
  $ make install

was throwing the following error

  mv build/src//usr/bin/node/unit-http-g/unit-http-1.31.1.tgz build//usr/bin/node-unit-http-g.tar.gz
  mv: cannot move 'build/src//usr/bin/node/unit-http-g/unit-http-1.31.1.tgz' to 'build//usr/bin/node-unit-http-g.tar.gz': No such file or directory
  make: *** [build/Makefile:2061: build//usr/bin/node-unit-http-g.tar.gz] Error 1

The fact that we're using the path given by --node= to then use as
directory locations seems erroneous.

But rather than risk breaking existing expectations the simple fix is to
just use build/src in the destination path above to match that of the
source.

These paths were added in some previous commits, and the missing 'src/'
component looks like an oversight.

After this commit both the following work

  $ ./configure nodejs --node-gyp=/usr/lib/node_modules/bin/node-gyp-bin/node-gyp --local=/opt/unit/node
  $ ./configure nodejs --node=/usr/bin/node --node-gyp=/usr/lib/node_modules/npm/bin/node-gyp-bin/node-gyp --local=/opt/unit/node

Reported-by: ruspaul013 <https://github.com/ruspaul013>
Tested-by: ruspaul013 <https://github.com/ruspaul013>
Fixes: 0ee8de554 ("Fixed Makefile target for NodeJS.")
Fixes: c84948386 ("Node.js: fixing module global installation.")
Reviewed-by: Timo Stark <t.stark@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 16:47:27 +00:00
Andrei Zeliankou
ea239635be Docker: Switch python3.12 to using github
Forgotten in
<c3af21e970>
2024-02-19 15:18:13 +00:00
Dan Callahan
756feafd54 Node.js: Use console.warn instead of stderr.write
Functionally identical, but marginally more idiomatic.

Refines: fbeb2065b1
2024-02-19 14:56:57 +00:00
Liam Crilly
1dca86028a Tools: disambiguate unitc control socket detection
Now that unitd has multiple --control* startup options, locating the
address of the control socket requires additional precision.

Signed-off-by: Liam Crilly <liam.crilly@nginx.com>
Acked-by: Andrew Clayton <a.clayton@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 13:00:26 +00:00
Andrew Clayton
2bd3b41876 Docs: Update man page for new --control-* options
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 13:00:16 +00:00
Andrew Clayton
b500c36d2e Allow to set the permissions of the Unix domain control socket
Several users in GitHub have asked for the ability to set the
permissions of the unitd UNIX Domain control socket.

This can of course be done externally, but can be done much cleaner by
Unit itself.

This commit adds three new options

  --control-mode	Set the mode of the socket, e.g 644

  --control-user	Set the user/owner of the socket, e.g unit

  --control-group	Set the group of the socket, e.g unit

Of course these only have an affect when using a UNIX Domain Socket for
the control socket.

Requested-by: michaelkosir <https://github.com/michaelkosir>
Requested-by: chopanovv <https://github.com/chopanovv>
Link: <https://github.com/nginx/unit/issues/254>
Link: <https://github.com/nginx/unit/issues/980>
Closes: https://github.com/nginx/unit/issues/840
Tested-by: Liam Crilly <liam.crilly@nginx.com>
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 12:59:58 +00:00
Andrew Clayton
34b3a812b1 Add nxt_file_chown()
This wraps chown(2) but takes the user/owner and group as strings.

It's a little long winded as it uses the thread safe versions of
getpwnam()/getgrname() which require a little more work.

This function will be used by the following commit that allows to set
the permissions of the Unix domain control socket.

We need to cast uid & gid to long in the call to nxt_thread_log_alert()
to appease clang-ast as it's adamant that uid/gid are unsigned ints, but
chown(2) takes -1 for these values to indicate don't change this item,
and it'd be nice to show them in the error message.

Note that getpwnam()/getgrname() don't define "not found" as an error as
per their man page

  The  formulation given above under "RETURN VALUE" is from POSIX.1-2001.
  It does not call "not found" an error, and hence does not specify  what
  value errno might have in this situation.  But that makes it impossible
  to  recognize  errors.   One  might argue that according to POSIX errno
  should be left unchanged if an entry is not found.  Experiments on var‐
  ious UNIX-like systems show that lots of different values occur in this
  situation: 0, ENOENT, EBADF, ESRCH, EWOULDBLOCK,  EPERM,  and  probably
  others.

Thus if we log an error from these functions we can end up with the
slightly humorous error message

  2024/02/12 15:15:12 [alert] 99404#99404 getpwnam_r("noddy", ...) failed (0: Success) (User not found) while creating listening socket on unix:/opt/unit/control.unit.sock

Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-02-19 12:59:29 +00:00
Konstantin Pavlov
baff936be1 Packages: Move dist target to git archive 2024-02-16 13:14:35 -08:00
Konstantin Pavlov
c3af21e970 Docker: Switch to github 2024-02-16 13:13:42 -08:00
Gabor Javorszky
fbeb2065b1
fix: Take options as well as requestListener (#1091)
* Take options as well as requestListener

Unit-http have not kept up with the signature of nodejs's http package
development. Nodejs allows an optional `options` object to be passed to
the `createServer` function, we didn't. This resulted in function
signature errors when user code that did make use of the options arg
tried to call unit's replaced function.

This change changes the signature to be more in line with how nodejs
does it discarding it and printing a message to stdout.

* Add test file to start node application with options

* Add changes to docs/changes.xml

Closes: https://github.com/nginx/unit/issues/1043
2024-02-14 18:16:01 +00:00
tclesius
2b0d93d1a7 Docker: Generated Dockerfile for Unit 1.31.1. 2024-02-13 17:53:43 -08:00
tclesius
661e918a70 Docker: added python3.12 to versions 2024-02-13 17:53:43 -08:00
Konstantin Pavlov
bad2c181e1 Packages: Added Fedora 39 support. 2024-02-09 14:31:36 -08:00
Konstantin Pavlov
ca1bc0625a contrib: updated njs to 0.8.2. 2024-02-09 14:31:36 -08:00
Konstantin Pavlov
8ebe04fd5d contrib: Bump libunit-wasm to 0.3.0. 2024-02-09 14:31:36 -08:00
Konstantin Pavlov
3a2687bb71 Packages: added Ubuntu 23.10 "mantic" support. 2024-02-09 14:31:36 -08:00
Alejandro Colomar
9e98670448
Configuration: Fix validation of "processes"
It's an integer, not a floating number.

Fixes: 68c6b67ffc ("Configuration: support for rational numbers.")
Closes: https://github.com/nginx/unit/issues/1115
Link: <https://github.com/nginx/unit/pull/1116>
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Cc: Dan Callahan <d.callahan@f5.com>
Cc: Valentin Bartenev <vbartenev@gmail.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-02-08 15:04:33 +01:00
Alejandro Colomar
46cef09f29
Configuration: Don't corrupt abstract socket names
The commit that added support for Unix sockets accepts abstract sockets
using '@' in the config, but we stored it internally using '\0'.

We want to support abstract sockets transparently to the user, so that
if the user configures unitd with '@', if we receive a query about the
current configuration, the user should see the same exact thing that was
configured.  So, this commit avoids the transformation in the internal
state file, storing user input pristine, and we only transform the '@'
in temporary strings.

This commit fixes another bug, where we try to connect to abstract
sockets with a trailing '\0' in their name due to calling twice
nxt_sockaddr_parse() on the same string.  By calling that function only
once with each copy of the string, we have fixed that bug.

The following code was responsible for this bug, which the second time
it was called, considered these sockets as file-backed (not abstract)
Unix socket, and so appended a '\0' to the socket name.

    $ grepc -tfd nxt_sockaddr_unix_parse . | grep -A10 @
        if (path[0] == '@') {
            path[0] = '\0';
            socklen--;
    #if !(NXT_LINUX)
            nxt_thread_log_error(NXT_LOG_ERR,
                                 "abstract unix domain sockets are not supported");
            return NULL;
    #endif
        }

        sa = nxt_sockaddr_alloc(mp, socklen, addr->length);

This bug was found thanks to some experiment about using 'const' for
some strings.

And here's some history:

-  9041d276fc ("nxt_sockaddr_parse() introducted.")

   This commit introduced support for abstract Unix sockets, but they
   only worked as "servers", and not as "listeners".  We corrupted the
   JSON config file, and stored a \u0000.  This also caused calling
   connect(2) with a bogus trailing null byte, which tried to connect to
   a different abstract socket.

-  d8e0768a5b ("Fixed support for abstract Unix sockets.")

   This commit (partially) fixed support for abstract Unix sockets, so
   they they worked also as listeners.  We still corrupted the JSON
   config file, and stored a \u0000.  This caused calling connect(2)
   (and now bind(2) too) with a bogus trailing null byte.

-  e2aec6686a ("Storing abstract sockets with @ internally.")

   This commit fixed the problem by which we were corrupting the config
   file, but only for "listeners", not for "servers".  (It also fixes
   the issue about the terminating '\0'.)  We completely forgot about
   "servers", and other callers of the same function.

To reproduce the problem, I used the following config:

```json
{
	"listeners": {
		"*:80": {
			"pass": "routes/u"
		},
		"unix:@abstract": {
			"pass": "routes/a"
		}
	},

	"routes": {
		"u": [{
			"action": {
				"pass": "upstreams/u"
			}
		}],
		"a": [{
			"action": {
				"return": 302,
				"location": "/i/am/not/at/home/"
			}
		}]
	},

	"upstreams": {
		"u": {
			"servers": {
				"unix:@abstract": {}
			}
		}
	}
}
```

And then check the state file:

    $ sudo cat /opt/local/nginx/unit/master/var/lib/unit/conf.json \
    | jq . \
    | grep unix;
        "unix:@abstract": {
            "unix:\u0000abstract": {}

After this patch, the state file has a '@' as expected:

    $ sudo cat /opt/local/nginx/unit/unix/var/lib/unit/conf.json \
    | jq . \
    | grep unix;
        "unix:@abstract": {
            "unix:@abstract": {}

Regarding the trailing null byte, here are some tests:

    $ sudo strace -f -e 'bind,connect' /opt/local/nginx/unit/d8e0/sbin/unitd \
    |& grep abstract;
    [pid 22406] bind(10, {sa_family=AF_UNIX, sun_path=@"abstract\0"}, 12) = 0
    [pid 22410] connect(134, {sa_family=AF_UNIX, sun_path=@"abstract\0"}, 12) = 0
    ^C
    $ sudo killall unitd
    $ sudo strace -f -e 'bind,connect' /opt/local/nginx/unit/master/sbin/unitd \
    |& grep abstract;
    [pid 22449] bind(10, {sa_family=AF_UNIX, sun_path=@"abstract"}, 11) = 0
    [pid 22453] connect(134, {sa_family=AF_UNIX, sun_path=@"abstract\0"}, 12) = -1 ECONNREFUSED (Connection refused)
    ^C
    $ sudo killall unitd
    $ sudo strace -f -e 'bind,connect' /opt/local/nginx/unit/unix/sbin/unitd \
    |& grep abstract;
    [pid 22488] bind(10, {sa_family=AF_UNIX, sun_path=@"abstract"}, 11) = 0
    [pid 22492] connect(134, {sa_family=AF_UNIX, sun_path=@"abstract"}, 11) = 0
    ^C

Fixes: 9041d276fc ("nxt_sockaddr_parse() introducted.")
Fixes: d8e0768a5b ("Fixed support for abstract Unix sockets.")
Fixes: e2aec6686a ("Storing abstract sockets with @ internally.")
Link: <https://github.com/nginx/unit/pull/1108>
Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Cc: Liam Crilly <liam.crilly@nginx.com>
Cc: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-02-05 18:37:37 +01:00
Alejandro Colomar
bb376c6838
Simplify, by calling nxt_conf_get_string_dup()
Refactor.

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Cc: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-02-05 18:37:32 +01:00
Alejandro Colomar
ecd573924f
Configuration: Add nxt_conf_get_string_dup()
This function is like nxt_conf_get_string(), but creates a new copy,
so that it can be modified without corrupting the configuration string.

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Cc: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-02-05 18:37:21 +01:00
Andrew Clayton
990fbe7010 Configuration: Remove procmap validation code
With the previous commit which introduced the use of the
NXT_CONF_VLDT_REQUIRED flag, we no longer need to do this separate
validation, it's only purpose was to check if the three uidmap/gidmap
settings had been provided.

Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-30 01:27:25 +00:00
Andrew Clayton
eba7378d4f Configuration: Use the NXT_CONF_VLDT_REQUIRED flag for procmap
Use the NXT_CONF_VLDT_REQUIRED flag on the app_procmap members. These
three settings are required.

These are for the uidmap & gidmap settings in the config.

Suggested-by: Zhidao HONG <z.hong@f5.com>
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-30 01:27:25 +00:00
Andrew Clayton
f7c9d3a8b3 Isolation: Use an appropriate type for storing uid/gids
Andrei reported an issue on arm64 where he was seeing the following
error message when running the tests

  2024/01/17 18:32:31.109 [error] 54904#54904 "gidmap" field has an entry with "size": 1, but for unprivileged unit it must be 1.

This error message is guarded by the following if statement

  if (nxt_slow_path(m.size > 1)

Turns out size was indeed > 1, in this case it was 289356276058554369,
m.size is defined as a nxt_int_t, which on arm64 is actually 8 bytes,
but was being printed as a signed int (4 bytes) and by chance/undefined
behaviour comes out as 1.

But why is size so big? In this case it should have just been 1 with a
config of

  'gidmap': [{'container': 0, 'host': os.getegid(), 'size': 1}],

This is due to nxt_int_t being 64bits on arm64 but using a conf type of
NXT_CONF_MAP_INT which means in nxt_conf_map_object() we would do (using
our m.size variable as an example)

  ptr = nxt_pointer_to(data, map[i].offset);
  ...
  ptr->i = num;

Where ptr is a union pointer and is now pointing at our m.size

Next we set m.size to the value of num (which is 1 in this case), via
ptr->i where i is a member of that union of type int.

So here we are setting a 64bit memory location (nxt_int_t on arm64)
through a 32bit (int) union alias, this means we are only setting the
lower half (4) of the bytes.

Whatever happens to be in the upper 4 bytes will remain, giving us our
exceptionally large value.

This is demonstrated by this program

  #include <stdio.h>
  #include <stdint.h>

  int main(void)
  {
          int64_t num = -1; /* All 1's in two's complement */
          union {
                  int32_t i32;
                  int64_t i64;
          } *ptr;

          ptr = (void *)&num;

          ptr->i32 = 1;
          printf("num : %lu / %ld\n", num, num);
          ptr->i64 = 1;
          printf("num : %ld\n", num);

          return 0;
  }
  $ make union-32-64-issue
  cc     union-32-64-issue.c   -o union-32-64-issue
  $ ./union-32-64-issue
  num : 18446744069414584321 / -4294967295
  num : 1

However that is not the only issue, because the members of
nxt_clone_map_entry_t were specified as nxt_int_t's on the likes of
x86_64 this would be a 32bit signed integer. However uid/gids on Linux
at least are defined as unsigned integers, so a nxt_int_t would not be
big enough to hold all potential values.

We could make the nxt_uint_t's but then we're back to the above union
aliasing problem.

We could just set the memory for these variables to 0 and that would
work, however that's really just papering over the problem.

The right thing is to use a large enough sized type to store these
things, hence the previously introduced nxt_cred_t. This is an int64_t
which is plenty large enough.

So we switch the nxt_clone_map_entry_t structure members over to
nxt_cred_t's and use NXT_CONF_MAP_INT64 as the conf type, which then
uses the right sized union member in nxt_conf_map_object() to set these
variables.

Reported-by: Andrei Zeliankou <zelenkov@nginx.com>
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-30 01:27:25 +00:00
Andrew Clayton
9919b50aec Isolation: Add a new nxt_cred_t type
This is a generic type to represent a uid_t/gid_t on Linux when user
namespaces are in use.

Technically this only needs to be an unsigned int, but we make it an
int64_t so we can make use of the existing NXT_CONF_MAP_INT64 type.

This will be used in subsequent commits.

Reviewed-by: Zhidao Hong <z.hong@f5.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-30 01:27:25 +00:00
Andrei Zeliankou
ad3645074e Tests: "if" option in access logging.
Conditional access logging was introduced here:
4c91bebb50
2024-01-29 17:54:26 +00:00
Zhidao HONG
dcbff27d9b Docs: Update changes.xml for conditional access logging 2024-01-29 21:10:31 +08:00
Zhidao HONG
4c91bebb50 HTTP: enhanced access log with conditional filtering.
This feature allows users to specify conditions to control if access log
should be recorded. The "if" option supports a string and JavaScript code.
If its value is empty, 0, false, null, or undefined, the logs will not be
recorded. And the '!' as a prefix inverses the condition.

Example 1: Only log requests that sent a session cookie.

    {
        "access_log": {
            "if": "$cookie_session",
            "path": "..."
        }
    }

Example 2: Do not log health check requests.

    {
        "access_log": {
            "if": "`${uri == '/health' ? false : true}`",
            "path": "..."
        }
    }

Example 3: Only log requests when the time is before 22:00.

    {
        "access_log": {
            "if": "`${new Date().getHours() < 22}`",
            "path": "..."
        }
    }

or

    {
        "access_log": {
            "if": "!`${new Date().getHours() >= 22}`",
            "path": "..."
        }
    }

Closes: https://github.com/nginx/unit/issues/594
2024-01-29 13:48:53 +08:00
Zhidao HONG
37abe2e463 HTTP: refactored out nxt_http_request_access_log().
This is in preparation for adding conditional access logging.
No functional changes.
2024-01-29 12:10:37 +08:00
Andrei Zeliankou
6452ca111c Node.js: fixed "httpVersion" variable format
According to the Node.js documenation this variable
should only include numbering scheme.

Thanks to @dbit-xia.

Closes: https://github.com/nginx/unit/issues/1085
2024-01-26 15:17:00 +00:00
Alejandro Colomar
ba56e50ee7
Tools: setup-unit: -hh: Add short-cut for the advanced help
I hate having to type so much just for the useful help.

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-01-23 18:16:02 +01:00
Alejandro Colomar
034b6394a4
Tools: setup-unit: -hh: The advanced commands aren't experimental
I've been using them for a long time, and they are quite useful and
stable.  Let's say they're advanced instead of experimental.

Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-01-23 18:15:53 +01:00
Alejandro Colomar
af6833a182
Tools: setup-unit: -hh: Add missing documentation for 'restart'
Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Signed-off-by: Alejandro Colomar <alx@kernel.org>
2024-01-23 18:15:26 +01:00
Andrew Clayton
02d1984c91 HTTP: Remove short read check in nxt_http_static_buf_completion()
On GH, @tonychuuy reported an issue when using Units 'share' action they
would get the following error in the unit log

  2024/01/15 17:53:41 [error] 49#52 *103 file "/var/www/html/public/vendor/telescope/app.css" has changed while sending response to a client

This would happen when trying to serve files over a certain size and the
requested file would not be sent.

This is due to a somewhat bogus check in
nxt_http_static_buf_completion()

I say bogus because it's not clear what the check is trying to
accomplish and the error message is not entirely accurate either.

The check in question goes like

    n = pread(file->fd, buf, size, offset);
    return n;
    ...
    if (n != size) {
        if (n >= 0) {
            /* log file changed error and finish */

            /* >> Problem is here << */
        }

       	/* log general error and finish */
    }

If the number of bytes read is not what we asked for and is > -1 (i.e
not an error) then it says the file has changed, but really it only
checks if the file has _shrunk_ (we can't get back _more_ bytes than we
asked for) since it was stat'd.

This is what happens

  recvfrom(22, "GET /tfile HTTP/1.1\r\nHost: local"..., 2048, 0, NULL, NULL) = 82
  openat(AT_FDCWD, "/mnt/9p/tfile", O_RDONLY|O_NONBLOCK) = 23
  newfstatat(23, "", {st_mode=S_IFREG|0644, st_size=149922, ...}, AT_EMPTY_PATH) = 0

We get a request from a client, open the requested file and stat(2) it to
get the file size.

We would then go into a pread/writev loop reading the file data and
sending it to the client until it's all been sent.

However what was happening in this case was this (showing a dummy file
of 149922 bytes)

  pread64(23, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072, 0) = 61440
  write(2, "2024/01/17 15:30:50 [error] 1849"..., 109) = 109

We wanted to read 131072 bytes but only read 61440 bytes, the above
check triggered and the file transfer was aborted and the above error
message logged.

Normally for a regular file you will only get less bytes than asked for
if the read call is interrupted by a signal or you're near the end of
file.

There is however at least another situation where this may happen, if
the file in question is being served from a network filesystem.

It turns out that was indeed the case here, the files where being served
over the 9P filesystem protocol. Unit was running in a docker container
in an Ubuntu VM under Windows/WSL2 and the files where being passed
through to the VM from Windows over 9P.

Whatever the intention of this check, it is clearly causing issues in
real world scenarios.

If it was really desired to check if the had changed since it was
opened/stat'd then it would require a different methodology and be a
patch for another day. But as it stands this current check does more
harm than good, so lets just remove it.

With it removed we now get for the above test file

  recvfrom(22, "GET /tfile HTTP/1.1\r\nHost: local"..., 2048, 0, NULL, NULL) = 82
  openat(AT_FDCWD, "/mnt/9p/tfile", O_RDONLY|O_NONBLOCK) = 23
  newfstatat(23, "", {st_mode=S_IFREG|0644, st_size=149922, ...}, AT_EMPTY_PATH) = 0
  mmap(NULL, 135168, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f367817b000
  pread64(23, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072, 0) = 61440
  pread64(23, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 18850, 61440) = 18850
  writev(22, [{iov_base="HTTP/1.1 200 OK\r\nLast-Modified: "..., iov_len=171}, {iov_base="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., iov_len=61440}, {iov_base="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., iov_len=18850}], 3) = 80461
  pread64(23, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 69632, 80290) = 61440
  pread64(23, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 8192, 141730) = 8192
  close(23)                   = 0
  writev(22, [{iov_base="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., iov_len=61440}, {iov_base="\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., iov_len=8192}], 2) = 69632

So we can see we do two pread(2)s's and a writev(2), then another two
pread(2)s and another writev(2) and all the file data has been read and
sent to the client.

Reported-by: tonychuuy <https://github.com/tonychuuy>
Link: <https://en.wikipedia.org/wiki/9P_(protocol)>
Fixes: 08a8d1510 ("Basic support for serving static files.")
Closes: https://github.com/nginx/unit/issues/1064
Reviewed-by: Zhidao Hong <z.hong@f5.com>
Reviewed-by: Andrei Zeliankou <zelenkov@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-20 03:39:57 +00:00
Andrei Zeliankou
4e08f49549 Tests: added Ruby tests with array in header values 2024-01-16 15:59:30 +00:00
Andrei Zeliankou
a1e00b4e28 White space formatting fixes
Closes: <https://github.com/nginx/unit/pull/1062>
2024-01-16 15:37:07 +00:00
Andrei Zeliankou
5a8337933d Tests: pathlib used where appropriate
Also fixed various pylint errors and style issues.
2024-01-15 15:48:58 +00:00
Andrew Clayton
e95a91cbfa .mailmap: Add a few more entries
Fix up a mixture of different names/email addresses people have used.

You can always see the original names/addresses used by passing
--no-mailmap to the various git commands.

See gitmailmap(5)

Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-12 18:33:27 +00:00
Konstantin Pavlov
b04455f6c1 Updated security.txt
Refs: https://github.com/nginx/unit-docs/pull/78
2024-01-11 11:45:20 -05:00
Andrew Clayton
6ee5d5553f .mailmap: Fix up Taryn's email address
Map her GitHub noreply address to her @f5 one.

You can always see the original address used by passing --no-mailmap to
the various git commands.

Note: We don't always need the name field, but we're keeping this file
consistent and alphabetically ordered on first name...

Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2024-01-11 01:18:57 +00:00
Danielle De Leo
7e03a6cc6b Go: Add missing +build and go:build comments
A RHEL 8 test was failing because it uses go1.16. The old style must
be retained for backwards compat.

Fixes: 9a36de84c ("Go: Use Homebrew include paths")
Reviewed-by: Andrew Clayton <a.clayton@nginx.com>
Reviewed-by: Dylan Arbour <d.arbour@f5.com>
Signed-off-by: Danielle De Leo <d.deleo@f5.com>
2024-01-10 11:15:48 -05:00
Taryn Musgrave
263460d930 Docs: replaced the slack community links with GitHub Discussions 2024-01-10 17:12:05 +01:00
Zhidao HONG
49aee6760a HTTP: added TSTR validation flag to the rewrite option.
This is to improve error messages for rewrite configuration.
Take the configuration as an example:

  {
      "rewrite": "`${a + "
  }

Previously, when applying it the user would see this error message:

  failed to apply previous configuration

After this change, the user will see this improved error message:

  the previous configuration is invalid: "SyntaxError: Unexpected end of input in default:1" in the "rewrite" value.
2023-12-14 16:38:24 +08:00
Andrew Clayton
88854cf146 Ruby: Prevent a possible integer underflow
Coverity picked up a potential issue with the previous commit d9f5f1fb7
("Ruby: Handle response field arrays") in that a size_t could wrap
around to SIZE_MAX - 1.

This would happen if we were given an empty array of header values.

Fixes: d9f5f1fb7 ("Ruby: Handle response field arrays")
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2023-12-13 03:20:25 +00:00
Andrew Clayton
d9f5f1fb74 Ruby: Handle response field arrays
@xeron on GitHub reported an issue whereby with a Rails 7.1 application
they were getting the following error

  2023/10/22 20:57:28 [error] 56#56 [unit] #8: Ruby: Wrong header entry 'value' from application
  2023/10/22 20:57:28 [error] 56#56 [unit] #8: Ruby: Failed to run ruby script

After some back and forth debugging it turns out rack was trying to send
back a header comprised of an array of values. E.g

  app = Proc.new do |env|
      ["200", {
          "Content-Type" => "text/plain",
          "X-Array-Header" => ["Item-1", "Item-2"],
      }, ["Hello World\n"]]
  end

  run app

It seems this became a possibility in rack v3.0[0]

So along with a header value type of T_STRING we need to also allow
T_ARRAY.

If we get a T_ARRAY we need to build up the header field using the given
values.

E.g

  "X-Array-Header" => ["Item-1", "", "Item-3", "Item-4"],

becomes

  X-Array-Header: Item-1; ; Item-3; Item-4

[0]: <https://github.com/rack/rack/blob/main/UPGRADE-GUIDE.md?plain=1#L26>

Reported-by: Ivan Larionov <xeron.oskom@gmail.com>
Closes: <https://github.com/nginx/unit/issues/974>
Link: <https://github.com/nginx/unit/pull/998>
Tested-by: Timo Stark <t.stark@nginx.com>
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2023-12-08 13:48:33 +00:00
Andrew Clayton
846a7f4836 .mailmap: Set correct address for Danielle
Due to GH making a mess of merge commits, it used Danielle's personal
email address for the merge, it also used a generic GH address for the
committer but we can't do anything about that. However we can fix the
'Author' email address.

If for some reason you want to see the original names/addresses used you
can generally pass --no-mailmap to git commands.

Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
2023-12-06 14:08:35 +00:00
Dani De Leo
f26bd644fe
Merge pull request #1017 from danielledeleo/ldflags-brew
Go: Use Homebrew include paths
2023-12-05 14:20:22 -05:00
Danielle De Leo
9a36de84c8
Go: Use Homebrew include paths
Fixes nginx/unit#967
2023-12-05 13:00:20 -05:00
Sergey A. Osokin
a922f9a6f0 Update third-party components for the Java module. 2023-11-29 10:28:44 -05:00