2441:4d73bc809457 | 26-Apr-2023 |
Alejandro Colomar |
Docs: not using shouty caps in unitd.8.
There was a recent unanimous agreement by maintainers of groff, mandoc, the Linux man-pages, and other relevant programmers, that manual pages should not use
Docs: not using shouty caps in unitd.8.
There was a recent unanimous agreement by maintainers of groff, mandoc, the Linux man-pages, and other relevant programmers, that manual pages should not use uppercase unnecessarily. Use of uppercase in the title and in the section's titles dates from before one could use bold, italics, and other such formatting, so that it was the way of giving more importance to certain parts of a page. Nowadays, we use bold, so uppercase is unnecessary.
Moreover, using uppercase in the title is bad, since it removes information. If we keep the exact casing used in the program (or function) name, we provide more information. And anyway, if users want to read in uppercase, they can program certain mdoc(7) or man(7) macros to transform their arguments into uppercase. This could be done via </etc/groff/mdoc.local> and </etc/groff/man.local>.
There's a plan of transforming OpenBSD pages and the Linux man-pages to stop using uppercase. Other projects may join. That will likely happen in the following months. Let's align with this.
Reviewed-by: Artem Konev <a.konev@f5.com> Signed-off-by: Alejandro Colomar <alx@nginx.com>
show more ...
|
2440:446c6763c8f8 | 26-Apr-2023 |
Alejandro Colomar |
Docs: removed '-v' from unitd.8.
This short option is not really supported. Probably it was just a typo.
Reviewed-by: Artem Konev <a.konev@f5.com> Signed-off-by: Alejandro Colomar <alx@nginx.com> |
2439:4cabfc9895f4 | 24-Apr-2023 |
Alejandro Colomar |
Docs: moved uintd.8 to man8/ subdirectory.
Reviewed-by: Artem Konev <a.konev@f5.com> Signed-off-by: Alejandro Colomar <alx@nginx.com> |
2438:216e2a374742 | 12-Apr-2023 |
Konstantin Pavlov |
Docker: made curl fail with non-zero exit code on server errors. |
2437:8973f763920b | 18-Mar-2023 |
Andrew Clayton |
Allow to remove the version string in HTTP responses.
Normally Unit responds to HTTP requests by including a header like
Server: Unit/1.30.0
however it can sometimes be beneficial to withhold th
Allow to remove the version string in HTTP responses.
Normally Unit responds to HTTP requests by including a header like
Server: Unit/1.30.0
however it can sometimes be beneficial to withhold the version information and in this case just respond with
Server: Unit
This patch adds a new "settings.http" boolean option called server_version, which defaults to true, in which case the full version information is sent. However this can be set to false, e.g
"settings": { "http": { "server_version": false } },
in which case Unit responds without the version information as the latter example above shows.
Link: <https://www.ietf.org/rfc/rfc9110.html#section-10.2.4> Closes: <https://github.com/nginx/unit/issues/158> Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2436:c4fa1c3b9284 | 21-Mar-2023 |
Andrew Clayton |
Decouple "Unit" from NXT_SERVER.
Split out the "Unit" name from the NXT_SERVER #define into its own NXT_NAME #define, then make NXT_SERVER a combination of that and NXT_VERSION.
This is required fo
Decouple "Unit" from NXT_SERVER.
Split out the "Unit" name from the NXT_SERVER #define into its own NXT_NAME #define, then make NXT_SERVER a combination of that and NXT_VERSION.
This is required for a subsequent commit where we may want the server name on its own.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2435:f9193e8bc181 | 23-Mar-2023 |
Andrew Clayton |
Remove an erroneous semi-colon.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com> |
2434:198735f535b5 | 24-Mar-2023 |
Andrew Clayton |
Don't conflate the error variable in nxt_kqueue_poll().
In nxt_kqueue_poll() error is declared as a nxt_bool_t aka unsigned int (on x86-64 anyway).
It is used both as a boolean and as the return st
Don't conflate the error variable in nxt_kqueue_poll().
In nxt_kqueue_poll() error is declared as a nxt_bool_t aka unsigned int (on x86-64 anyway).
It is used both as a boolean and as the return storage for a bitwise AND operation.
This has potential to go awry.
If nxt_bool_t was changed to be a u8 then we would have the following issue
gcc12 -c -pipe -fPIC -fvisibility=hidden -O -W -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wmissing-prototypes -Werror -g -O2 -I src -I build -I/usr/local/include -o build/src/nxt_kqueue_engine.o -MMD -MF build/src/nxt_kqueue_engine.dep -MT build/src/nxt_kqueue_engine.o src/nxt_kqueue_engine.c src/nxt_kqueue_engine.c: In function 'nxt_kqueue_poll': src/nxt_kqueue_engine.c:728:17: error: overflow in conversion from 'int' to 'nxt_bool_t' {aka 'unsigned char'} changes value from '(int)kev->flags & 16384' to '0' [-Werror=overflow] 728 | error = (kev->flags & EV_ERROR); | ^ cc1: all warnings being treated as errors
EV_ERROR has the value 16384, after the AND operation error holds 16384, however this overflows and wraps around (64 times) exactly to 0.
With nxt_bool_t defined as a u32, we would have a similar issue if EV_ERROR ever became UINT_MAX + 1 (or a multiple thereof)...
Rather than conflating the use of error, keep error as a boolean (it is used further down the function) but do the AND operation inside the if ().
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2433:56bf272df01d | 27-Mar-2023 |
Andrew Clayton |
Remove a bunch of dead code.
This removes a bunch of unused files that would have been touched by subsequent commits that switch to using nxt_bool_t (AKA unit6_t) in structures.
In auto/sources we
Remove a bunch of dead code.
This removes a bunch of unused files that would have been touched by subsequent commits that switch to using nxt_bool_t (AKA unit6_t) in structures.
In auto/sources we have
NXT_LIB_SRC0=" \ src/nxt_buf_filter.c \ src/nxt_job_file.c \ src/nxt_stream_module.c \ src/nxt_stream_source.c \ src/nxt_upstream_source.c \ src/nxt_http_source.c \ src/nxt_fastcgi_source.c \ src/nxt_fastcgi_record_parse.c \ \ src/nxt_mem_pool_cleanup.h \ src/nxt_mem_pool_cleanup.c \ "
None of these seem to actually be used anywhere (other than within themselves). That variable is _not_ referenced anywhere else.
Also remove the unused related header files: src/nxt_buf_filter.h, src/nxt_fastcgi_source.h, src/nxt_http_source.h, src/nxt_job_file.h, src/nxt_stream_source.h and src/nxt_upstream_source.h
Also, these files do not seem to be used, no mention under auto/ or build/
src/nxt_file_cache.c src/nxt_cache.c src/nxt_job_file_cache.c
src/nxt_cache.h is #included in src/nxt_main.h, but AFAICT is not actually used.
With all the above removed
$ ./configure --openssl --debug --tests && make -j && make -j tests && make libnxt
all builds.
Buildbot passes.
NOTE: You may need to do a 'make clean' before the next build attempt.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2432:6df870c978e6 | 03-Apr-2023 |
Alejandro Colomar |
Tools: setup-unit: unified repeated code.
Instead of doing the same operation in each subcommand, do it once in the parent.
Reviewed-by: Andrew Clayton <a.clayton@nginx.com> Signed-off-by: Alejandr
Tools: setup-unit: unified repeated code.
Instead of doing the same operation in each subcommand, do it once in the parent.
Reviewed-by: Andrew Clayton <a.clayton@nginx.com> Signed-off-by: Alejandro Colomar <alx@nginx.com>
show more ...
|
2431:4867740e5282 | 11-Apr-2023 |
Konstantin Pavlov |
contrib: updated njs to 0.7.12. |
2430:50ce7e6977b6 | 31-Mar-2023 |
Alejandro Colomar |
HTTP: optimizing $request_line.
Don't reconstruct a new string for the $request_line from the parsed method, target, and HTTP version, but rather keep a pointer to the original memory where the requ
HTTP: optimizing $request_line.
Don't reconstruct a new string for the $request_line from the parsed method, target, and HTTP version, but rather keep a pointer to the original memory where the request line was received.
This will be necessary for implementing URI rewrites, since we want to log the original request line, and not one constructed from the rewritten target.
This implementation changes behavior (only for invalid requests) in the following way:
Previous behavior was to log as many tokens from the request line as were parsed validly, thus:
Request -> access log ; error log
"GET / HTTP/1.1" -> "GET / HTTP/1.1" OK ; = "GET / HTTP/1.1" -> "GET / HTTP/1.1" [1] ; = "GET / HTTP/2.1" -> "GET / HTTP/2.1" OK ; = "GET / HTTP/1." -> "GET / HTTP/1." [2] ; "GET / HTTP/1. [null]" "GET / food" -> "GET / food" [2] ; "GET / food [null]" "GET / / HTTP/1.1" -> "GET / / HTTP/1.1" [2] ; = "GET / / HTTP/1.1" -> "GET / / HTTP/1.1" [2] ; = "GET food HTTP/1.1" -> "GET" ; "GET [null] [null]" "OPTIONS * HTTP/1.1" -> "OPTIONS" [3] ; "OPTIONS [null] [null]" "FOOBAR baz HTTP/1.1"-> "FOOBAR" ; "FOOBAR [null] [null]" "FOOBAR / HTTP/1.1" -> "FOOBAR / HTTP/1.1" ; = "get / HTTP/1.1" -> "-" ; " [null] [null]" "" -> "-" ; " [null] [null]"
This behavior was rather inconsistent. We have several options to go forward with this patch:
- NGINX behavior.
Log the entire request line, up to '\r' | '\n', even if it was invalid.
This is the most informative alternative. However, RFC-complying requests will probably not send invalid requests.
This information would be interesting to users where debugging requests constructed manually via netcat(1) or a similar tool, or maybe for debugging a client, are important. It might be interesting to support this in the future if our users are interested; for now, since this approach requires looping over invalid requests twice, that's an overhead that we better avoid.
- Previous Unit behavior
This is relatively fast (almost as fast as the next alternative, the one we chose), but the implementation is ugly, in that we need to perform the same operation in many places around the code.
If we want performance, probably the next alternative is better; if we want to be informative, then the first one is better (maybe in combination with the third one too).
- Chosen behavior
Only logging request lines when the request is valid. For any invalid request, or even unsupported ones, the request line will be logged as "-". Thus:
Request -> access log [4]
"GET / HTTP/1.1" -> "GET / HTTP/1.1" OK "GET / HTTP/1.1" -> "GET / HTTP/1.1" [1] "GET / HTTP/2.1" -> "-" [3] "GET / HTTP/1." -> "-" "GET / food" -> "-" "GET / / HTTP/1.1" -> "GET / / HTTP/1.1" [2] "GET / / HTTP/1.1" -> "GET / / HTTP/1.1" [2] "GET food HTTP/1.1" -> "-" "OPTIONS * HTTP/1.1" -> "-" "FOOBAR baz HTTP/1.1"-> "-" "FOOBAR / HTTP/1.1" -> "FOOBAR / HTTP/1.1" "get / HTTP/1.1" -> "-" "" -> "-"
This is less informative than previous behavior, but considering how inconsistent it was, and that RFC-complying agents will probably not send us such requests, we're ready to lose that information in the log. This is of course the fastest and simplest implementation we can get.
We've chosen to implement this alternative in this patch. Since we modified the behavior, this patch also changes the affected tests.
[1]: Multiple successive spaces as a token delimiter is allowed by the RFC, but it is discouraged, and considered a security risk. It is currently supported by Unit, but we will probably drop support for it in the future.
[2]: Unit currently supports spaces in the request-target. This is a violation of the relevant RFC (linked below), and will be fixed in the future, and consider those targets as invalid, returning a 400 (Bad Request), and thus the log lines with the previous inconsistent behavior would be changed.
[3]: Not yet supported.
[4]: In the error log, regarding the "log_routes" conditional logging of the request line, we only need to log the request line if it was valid. It doesn't make sense to log "" or "-" in case that the request was invalid, since this is only useful for understanding decisions of the router. In this case, the access log is more appropriate, which shows that the request was invalid, and a 400 was returned. When the request line is valid, it is printed in the error log exactly as in the access log.
Link: <https://datatracker.ietf.org/doc/html/rfc9112#section-3> Suggested-by: Liam Crilly <liam@nginx.com> Reviewed-by: Zhidao Hong <z.hong@f5.com> Cc: Timo Stark <t.stark@nginx.com> Cc: Andrei Zeliankou <zelenkov@nginx.com> Cc: Andrew Clayton <a.clayton@nginx.com> Cc: Artem Konev <a.konev@f5.com> Signed-off-by: Alejandro Colomar <alx@nginx.com>
show more ...
|
2429:81260e6f18de | 11-Apr-2023 |
Konstantin Pavlov |
Regenerated Dockerfiles. |
2428:6a833a8873e9 | 11-Apr-2023 |
Konstantin Pavlov |
Docker: fixed a typo. |
2427:3e84e83d1648 | 11-Apr-2023 |
Konstantin Pavlov |
Docker: fixed a typo. |
2426:d5e936f09dc0 | 30-Mar-2023 |
Andrew Clayton |
Add per-application logging.
Currently when running in the foreground, unit application processes will send stdout to the current TTY and stderr to the unit log file.
That behaviour won't change.
Add per-application logging.
Currently when running in the foreground, unit application processes will send stdout to the current TTY and stderr to the unit log file.
That behaviour won't change.
When running as a daemon, unit application processes will send stdout to /dev/null and stderr to the unit log file.
This commit allows to alter the latter case of unit running as a daemon, by allowing applications to redirect stdout and/or stderr to specific log files. This is done via two new application options, 'stdout' & 'stderr', e.g
"applications": { "myapp": { ... "stdout": "/path/to/log/unit/app/stdout.log", "stderr": "/path/to/log/unit/app/stderr.log" } }
These log files are created by the application processes themselves and thus the log directories need to be writable by the user (and or group) of the application processes.
E.g
$ sudo mkdir -p /path/to/log/unit/app $ sudo chown APP_USER /path/to/log/unit/app
These need to be setup before starting unit with the above config.
Currently these log files do not participate in log-file rotation (SIGUSR1), that may change in a future commit. In the meantime these logs can be rotated using the traditional copy/truncate method.
NOTE:
You may or may not see stuff printed to stdout as stdout was traditionally used by CGI applications to communicate with the webserver.
Closes: <https://github.com/nginx/unit/issues/197> Closes: <https://github.com/nginx/unit/issues/846> Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2425:a94d0c252c09 | 30-Mar-2023 |
Andrew Clayton |
Add nxt_file_stdout().
This is analogous to the nxt_file_stderr() function and will be used in a subsequent commit.
This function redirects stdout to a given file descriptor.
Reviewed-by: Alejandr
Add nxt_file_stdout().
This is analogous to the nxt_file_stderr() function and will be used in a subsequent commit.
This function redirects stdout to a given file descriptor.
Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2424:70afa8cb85d4 | 31-Mar-2023 |
Andrew Clayton |
PHP: Make the filter_input() function work.
On GitHub, @jamesRUS52 reported that the PHP filter_input()[0] function would just return NULL.
To enable this function we need to run the variables thro
PHP: Make the filter_input() function work.
On GitHub, @jamesRUS52 reported that the PHP filter_input()[0] function would just return NULL.
To enable this function we need to run the variables through the sapi_module.input_filter() function when we call php_register_variable_safe().
In PHP versions prior to 7.0.0, input_filter() takes 'len' as an unsigned int, while later versions take it as a size_t.
Now, with this commit and the following PHP
<?php
var_dump(filter_input(INPUT_SERVER, 'REMOTE_ADDR')); var_dump(filter_input(INPUT_SERVER, 'REQUEST_URI')); var_dump(filter_input(INPUT_GET, 'get', FILTER_SANITIZE_SPECIAL_CHARS));
?>
you get
$ curl 'http://localhost:8080/854.php?get=foo<>' string(3) "::1" string(18) "/854.php?get=foo<>" string(13) "foo<>"
[0]: <https://www.php.net/manual/en/function.filter-input.php>
Tested-by: <https://github.com/jamesRUS52> Closes: <https://github.com/nginx/unit/issues/854> Reviewed-by: Alejandro Colomar <alx@nginx.com> Signed-off-by: Andrew Clayton <a.clayton@nginx.com>
show more ...
|
2423:ccf9f61930cb | 11-Apr-2023 |
Konstantin Pavlov |
Regenerated Dockerfiles. |
2422:7b60576e68fb | 07-Apr-2023 |
Konstantin Pavlov |
Docker: drop apt-get clean usage. It's automatic in the Debian and Ubuntu containers: https://github.com/debuerreotype/debuerreotype/blob/5cf7949ecf1cec1afece267688bda64cd34a6817/scripts/debuerreotyp
Docker: drop apt-get clean usage. It's automatic in the Debian and Ubuntu containers: https://github.com/debuerreotype/debuerreotype/blob/5cf7949ecf1cec1afece267688bda64cd34a6817/scripts/debuerreotype-minimizing-config#L85-L109
show more ...
|
2421:025140430bd2 | 07-Apr-2023 |
Konstantin Pavlov |
Docker: explicitely set uid/gid to 999 for unit user. This allows us to be consistent through possible updates of default settings used in distributions. Previous behaviour was uid/gid were chosen a
Docker: explicitely set uid/gid to 999 for unit user. This allows us to be consistent through possible updates of default settings used in distributions. Previous behaviour was uid/gid were chosen automatically based on what uids/gids are already taken on the system.
show more ...
|
2420:514770ebdcba | 07-Apr-2023 |
Konstantin Pavlov |
Packages: use groupadd/useradd on Debian-based operating systems.
addgroup/adduser will no longer be installed by default in the "minbase". Also, moving to lower-level utilities saves us one runtim
Packages: use groupadd/useradd on Debian-based operating systems.
addgroup/adduser will no longer be installed by default in the "minbase". Also, moving to lower-level utilities saves us one runtime dependency.
show more ...
|
2419:c78219b9ad82 | 07-Apr-2023 |
Konstantin Pavlov |
Docker: added OCI image-spec labels. |
2418:86492e68bf6b | 07-Apr-2023 |
Konstantin Pavlov |
Docker: specified explicit variants of images to use. This allows us to decide when to move to a newer underlying distribution version with our pace instead of relying on Docker Hub cadence. |
2417:148da1a18675 | 07-Apr-2023 |
Konstantin Pavlov |
Docker: dropped a leftover from a multi-stage build. |