History log of /unit/docs/changes.xml (Results 151 – 175 of 288)
Revision (<<< Hide revision tags) (Show revision tags >>>) Date Author Comments
Revision tags: 1.25.0
# 1945:0cb39c311234 19-Aug-2021 Valentin Bartenev

Added version 1.25.0 CHANGES.


# 1944:6d8f035f0718 19-Aug-2021 Valentin Bartenev

Reordered changes for 1.25.0 by significance (subjective).


# 1943:747cb5eda189 19-Aug-2021 Artem Konev

Edited changes.xml for the 1.25.0 release.


# 1942:296628096d6c 17-Aug-2021 Andrey Suvorov

Added TLS session tickets support.


# 1936:953434450ea9 12-Aug-2021 Oisin Canty

Router: client IP address replacement.

This commit introduces the replacement of the client address based on the value
of a specified HTTP header. This is intended for use when Unit is placed
behin

Router: client IP address replacement.

This commit introduces the replacement of the client address based on the value
of a specified HTTP header. This is intended for use when Unit is placed
behind a reverse proxy like nginx or a CDN.

You must specify the source addresses of the trusted proxies. This can be
accomplished with any valid IP pattern supported by Unit's match block:

["10.0.0.1", "10.4.0.0/16", "!192.168.1.1"]

The feature is configured per listener.

The client address replacement functionality only operates when there is a
source IP match and the specified header is present. Typically this would be
an 'X-Forwarded-For' header.

{
"listeners": {
"127.0.0.1:8080": {
"client_ip": {
"header": "X-Forwarded-For",
"source": [
"10.0.0.0/8"
]
},
"pass": "applications/my_app"
},
}
}

If a request occurs and Unit receives a header like below:

"X-Forwarded-For: 84.123.23.23"

By default, Unit trusts the last rightmost IP in the header, so REMOTE_ADDR
will be set to 84.123.23.23 if the connection originated from 10.0.0.0/8.

If Unit runs behind consecutive reverse proxies and receives a header similar
to the following:

"X-Forwarded-For: 84.123.23.23, 10.0.0.254"

You will need to enable "recursive" checking, which walks the header from
last address to first and chooses the first non-trusted address it finds.

{
"listeners": {
"127.0.0.1:8080": {
"client_ip": {
"header": "X-Forwarded-For",
"source": [
"10.0.0.0/8"
]
"recursive": true,
},
"pass": "applications/my_app"
},
}
}

If a connection from 10.0.0.0/8 occurs, the chain is walked. Here, 10.0.0.254
is also a trusted address so the client address will be replaced with
84.123.23.23.

If all IP addresses in the header are trusted, the client address is set to
the first address in the header:

If 10.0.0.0/8 is trusted and "X-Forwarded-For: 10.0.0.3, 10.0.0.2, 10.0.0.1",
the client address will be replaced with 10.0.0.3.

show more ...


# 1930:fb8b29aac7a1 05-Aug-2021 Oisin Canty

Router: fixed crash when matching an empty address pattern array.

A crash would occur when the router tried to match an
against an empty address pattern array.

The following configuration was used

Router: fixed crash when matching an empty address pattern array.

A crash would occur when the router tried to match an
against an empty address pattern array.

The following configuration was used to reproduce the
issue:

{
"listeners": {
"127.0.0.1:8082": {
"pass": "routes"
}
},
"routes": [
{
"match": {
"source": []
},
"action": {
"return": 200
}
}
]
}

show more ...


# 1929:92353aff2df3 04-Aug-2021 Zhidao HONG

Added a changelog for ae4f067a9ea4.


# 1926:6e85d6c0b8bb 29-Jul-2021 Max Romanov

Application restart introduced.

When processing a restart request, the router sends a QUIT message to all
existing processes of the application. Then, a new shared application port is
created to en

Application restart introduced.

When processing a restart request, the router sends a QUIT message to all
existing processes of the application. Then, a new shared application port is
created to ensure that new requests won't be handled by the old processes of
the application.

show more ...


# 1921:b0deb6fa9219 22-Jul-2021 Andrey Suvorov

Changing SNI callback return code if a client sends no SNI.

When a client sends no SNI is a common situation. But currently the server
processes it as an error and returns SSL_TLSEXT_ERR_ALERT_FATA

Changing SNI callback return code if a client sends no SNI.

When a client sends no SNI is a common situation. But currently the server
processes it as an error and returns SSL_TLSEXT_ERR_ALERT_FATAL causing
termination of a current TLS session. The problem occurs if configuration has
more than one certificate bundle in a listener.

This fix changes the return code to SSL_TLSEXT_ERR_OK and the log level of a
message.

show more ...


# 1920:7c19530e2502 21-Jul-2021 Andrey Suvorov

Enabling configure TLS sessions.

To support TLS sessions, Unit uses the OpenSSL built-in session cache; the
cache_size option defines the number sessions to store. To disable the feather,
the optio

Enabling configure TLS sessions.

To support TLS sessions, Unit uses the OpenSSL built-in session cache; the
cache_size option defines the number sessions to store. To disable the feather,
the option must be zero.

show more ...


# 1916:2d7e54265010 20-Jul-2021 Max Romanov

Python: fixing ASGI receive() issues.

The receive() call never blocks for a GET request and always returns the same
empty body message. The Starlette framework creates a separate task when
receive(

Python: fixing ASGI receive() issues.

The receive() call never blocks for a GET request and always returns the same
empty body message. The Starlette framework creates a separate task when
receive() is called in a loop until an 'http.disconnect' message is received.

The 'http.disconnect' message was previously issued after the response header
had been sent. However, the correct behavior is to respond with
'http.disconnect' after sending the response is complete.

This closes #564 issue on GitHub.

show more ...


# 1915:48167dd83aa5 19-Jul-2021 Max Romanov

Router: fixing assertion on app thread port handle.

A new application thread port message can be processed in the router after the
application is removed from the router. Assertion for this case is

Router: fixing assertion on app thread port handle.

A new application thread port message can be processed in the router after the
application is removed from the router. Assertion for this case is replaced by
a condition to store the new thread port until receiving the stop notification
from the application process.

show more ...


# 1910:b9e844d85f21 02-Jul-2021 Oisin Canty

Ruby: process and thread lifecycle hooks.

This feature allows one to specify blocks of code that are called when certain
lifecycle events occur. A user configures a "hooks" property on the app
conf

Ruby: process and thread lifecycle hooks.

This feature allows one to specify blocks of code that are called when certain
lifecycle events occur. A user configures a "hooks" property on the app
configuration that points to a script. This script will be evaluated on boot
and should contain blocks of code that will be called on specific events.

An example of configuration:

{
"type": "ruby",
"processes": 2,
"threads": 2,
"user": "vagrant",
"group": "vagrant",
"script": "config.ru",
"hooks": "hooks.rb",
"working_directory": "/home/vagrant/unit/rbhooks",
"environment": {
"GEM_HOME": "/home/vagrant/.ruby"
}
}

An example of a valid "hooks.rb" file follows:

File.write("./hooks.#{Process.pid}", "hooks evaluated")

on_worker_boot do
File.write("./worker_boot.#{Process.pid}", "worker booted")
end

on_thread_boot do
File.write("./thread_boot.#{Process.pid}.#{Thread.current.object_id}",
"thread booted")
end

on_thread_shutdown do
File.write("./thread_shutdown.#{Process.pid}.#{Thread.current.object_id}",
"thread shutdown")
end

on_worker_shutdown do
File.write("./worker_shutdown.#{Process.pid}", "worker shutdown")
end

This closes issue #535 on GitHub.

show more ...


# 1909:d6a5090da2ea 02-Jul-2021 Oisin Canty

Fixing crash during IPv6 text address generation.

When the textual representation of an IPv6 nxt_sockaddr_t was being
generated, a crash would occur if the address had a full IPv6 form:

f607:7403:1

Fixing crash during IPv6 text address generation.

When the textual representation of an IPv6 nxt_sockaddr_t was being
generated, a crash would occur if the address had a full IPv6 form:

f607:7403:1e4b:6c66:33b2:843f:2517:da27

This was caused by a variable that tracks the location of a
collapsed group ("::") that was not set to a sane default. When
the address was generated, a group would be inserted when
it was not necessary, thus causing an overflow.

This closes #481 issue on GitHub.

show more ...


# 1907:75ddb2d89b42 01-Jul-2021 Max Romanov

Fixing memory and descriptor leakage in case of port send failure.

In rare cases, when the destination process had finished running but no
notification of this was received yet, send could fail with

Fixing memory and descriptor leakage in case of port send failure.

In rare cases, when the destination process had finished running but no
notification of this was received yet, send could fail with an error, and the
send message structure with file descriptors could leak.

The leakage was periodically reproduced by respawn tests on FreeBSD 12.

show more ...


# 1904:da7a4754f8bd 01-Jul-2021 Max Romanov

Fixing multiple TLS-enabled listeners initialization.

Because of the incorrect 'last' field assignment, multiple listeners with
a TLS certificate did not initialize properly, which caused a router c

Fixing multiple TLS-enabled listeners initialization.

Because of the incorrect 'last' field assignment, multiple listeners with
a TLS certificate did not initialize properly, which caused a router crash
while establishing a connection.

Test with multiple TLS listeners added.

The issue was introduced in the c548e46fe516 commit.

This closes #561 issue on GitHub.

show more ...


# 1896:19eee884bd0b 28-May-2021 Valentin Bartenev

Version bump.


Revision tags: 1.24.0-1
# 1894:5c7ce0da580e 27-May-2021 Andrei Belov

Merged with the default branch.


Revision tags: 1.24.0
# 1891:5ae5e6619af9 27-May-2021 Valentin Bartenev

Added version 1.24.0 CHANGES.


# 1890:b55d63dc55f9 27-May-2021 Valentin Bartenev

Reordered changes for 1.24.0 by significance (subjective).


# 1889:04126d0d9d59 27-May-2021 Artem Konev

Grammar fixes and improvements in changes.xml.


# 1887:0a32914bf7bf 27-May-2021 Andrei Belov

Packages: added Ubuntu 21.04 "hirsute" support.


# 1885:09b857a2cca9 26-May-2021 Andrey Suvorov

Enabling SSL_CTX configuration by using SSL_CONF_cmd().

To perform various configuration operations on SSL_CTX, OpenSSL provides
SSL_CONF_cmd(). Specifically, to configure ciphers for a listener,
"

Enabling SSL_CTX configuration by using SSL_CONF_cmd().

To perform various configuration operations on SSL_CTX, OpenSSL provides
SSL_CONF_cmd(). Specifically, to configure ciphers for a listener,
"CipherString" and "Ciphersuites" file commands are used:
https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html


This feature can be configured in the "tls/conf_commands" section.

show more ...


# 1884:4645a43bc248 26-May-2021 Andrey Suvorov

Fixing crash during TLS connection shutdown.

A crash was caused by an incorrect timer handler nxt_h1p_idle_timeout() if
SSL_shutdown() returned SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.

The flag SS

Fixing crash during TLS connection shutdown.

A crash was caused by an incorrect timer handler nxt_h1p_idle_timeout() if
SSL_shutdown() returned SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.

The flag SSL_RECEIVED_SHUTDOWN is used to avoid getting SSL_ERROR_WANT_READ, so
the server won't wait for a close notification from a client.

For SSL_ERROR_WANT_WRITE, a correct timer handler is set up.

show more ...


# 1882:65e7dcdd7be4 26-May-2021 Oisin Canty

MIME: added PHP.


12345678910>>...12