Revision tags: 1.25.0 |
|
#
1945:0cb39c311234 |
| 19-Aug-2021 |
Valentin Bartenev |
Added version 1.25.0 CHANGES.
|
#
1944:6d8f035f0718 |
| 19-Aug-2021 |
Valentin Bartenev |
Reordered changes for 1.25.0 by significance (subjective).
|
#
1943:747cb5eda189 |
| 19-Aug-2021 |
Artem Konev |
Edited changes.xml for the 1.25.0 release.
|
#
1942:296628096d6c |
| 17-Aug-2021 |
Andrey Suvorov |
Added TLS session tickets support.
|
#
1936:953434450ea9 |
| 12-Aug-2021 |
Oisin Canty |
Router: client IP address replacement.
This commit introduces the replacement of the client address based on the value of a specified HTTP header. This is intended for use when Unit is placed behin
Router: client IP address replacement.
This commit introduces the replacement of the client address based on the value of a specified HTTP header. This is intended for use when Unit is placed behind a reverse proxy like nginx or a CDN.
You must specify the source addresses of the trusted proxies. This can be accomplished with any valid IP pattern supported by Unit's match block:
["10.0.0.1", "10.4.0.0/16", "!192.168.1.1"]
The feature is configured per listener.
The client address replacement functionality only operates when there is a source IP match and the specified header is present. Typically this would be an 'X-Forwarded-For' header.
{ "listeners": { "127.0.0.1:8080": { "client_ip": { "header": "X-Forwarded-For", "source": [ "10.0.0.0/8" ] }, "pass": "applications/my_app" }, } }
If a request occurs and Unit receives a header like below:
"X-Forwarded-For: 84.123.23.23"
By default, Unit trusts the last rightmost IP in the header, so REMOTE_ADDR will be set to 84.123.23.23 if the connection originated from 10.0.0.0/8.
If Unit runs behind consecutive reverse proxies and receives a header similar to the following:
"X-Forwarded-For: 84.123.23.23, 10.0.0.254"
You will need to enable "recursive" checking, which walks the header from last address to first and chooses the first non-trusted address it finds.
{ "listeners": { "127.0.0.1:8080": { "client_ip": { "header": "X-Forwarded-For", "source": [ "10.0.0.0/8" ] "recursive": true, }, "pass": "applications/my_app" }, } }
If a connection from 10.0.0.0/8 occurs, the chain is walked. Here, 10.0.0.254 is also a trusted address so the client address will be replaced with 84.123.23.23.
If all IP addresses in the header are trusted, the client address is set to the first address in the header:
If 10.0.0.0/8 is trusted and "X-Forwarded-For: 10.0.0.3, 10.0.0.2, 10.0.0.1", the client address will be replaced with 10.0.0.3.
show more ...
|
#
1930:fb8b29aac7a1 |
| 05-Aug-2021 |
Oisin Canty |
Router: fixed crash when matching an empty address pattern array.
A crash would occur when the router tried to match an against an empty address pattern array.
The following configuration was used
Router: fixed crash when matching an empty address pattern array.
A crash would occur when the router tried to match an against an empty address pattern array.
The following configuration was used to reproduce the issue:
{ "listeners": { "127.0.0.1:8082": { "pass": "routes" } }, "routes": [ { "match": { "source": [] }, "action": { "return": 200 } } ] }
show more ...
|
#
1929:92353aff2df3 |
| 04-Aug-2021 |
Zhidao HONG |
Added a changelog for ae4f067a9ea4.
|
#
1926:6e85d6c0b8bb |
| 29-Jul-2021 |
Max Romanov |
Application restart introduced.
When processing a restart request, the router sends a QUIT message to all existing processes of the application. Then, a new shared application port is created to en
Application restart introduced.
When processing a restart request, the router sends a QUIT message to all existing processes of the application. Then, a new shared application port is created to ensure that new requests won't be handled by the old processes of the application.
show more ...
|
#
1921:b0deb6fa9219 |
| 22-Jul-2021 |
Andrey Suvorov |
Changing SNI callback return code if a client sends no SNI.
When a client sends no SNI is a common situation. But currently the server processes it as an error and returns SSL_TLSEXT_ERR_ALERT_FATA
Changing SNI callback return code if a client sends no SNI.
When a client sends no SNI is a common situation. But currently the server processes it as an error and returns SSL_TLSEXT_ERR_ALERT_FATAL causing termination of a current TLS session. The problem occurs if configuration has more than one certificate bundle in a listener.
This fix changes the return code to SSL_TLSEXT_ERR_OK and the log level of a message.
show more ...
|
#
1920:7c19530e2502 |
| 21-Jul-2021 |
Andrey Suvorov |
Enabling configure TLS sessions.
To support TLS sessions, Unit uses the OpenSSL built-in session cache; the cache_size option defines the number sessions to store. To disable the feather, the optio
Enabling configure TLS sessions.
To support TLS sessions, Unit uses the OpenSSL built-in session cache; the cache_size option defines the number sessions to store. To disable the feather, the option must be zero.
show more ...
|
#
1916:2d7e54265010 |
| 20-Jul-2021 |
Max Romanov |
Python: fixing ASGI receive() issues.
The receive() call never blocks for a GET request and always returns the same empty body message. The Starlette framework creates a separate task when receive(
Python: fixing ASGI receive() issues.
The receive() call never blocks for a GET request and always returns the same empty body message. The Starlette framework creates a separate task when receive() is called in a loop until an 'http.disconnect' message is received.
The 'http.disconnect' message was previously issued after the response header had been sent. However, the correct behavior is to respond with 'http.disconnect' after sending the response is complete.
This closes #564 issue on GitHub.
show more ...
|
#
1915:48167dd83aa5 |
| 19-Jul-2021 |
Max Romanov |
Router: fixing assertion on app thread port handle.
A new application thread port message can be processed in the router after the application is removed from the router. Assertion for this case is
Router: fixing assertion on app thread port handle.
A new application thread port message can be processed in the router after the application is removed from the router. Assertion for this case is replaced by a condition to store the new thread port until receiving the stop notification from the application process.
show more ...
|
#
1910:b9e844d85f21 |
| 02-Jul-2021 |
Oisin Canty |
Ruby: process and thread lifecycle hooks.
This feature allows one to specify blocks of code that are called when certain lifecycle events occur. A user configures a "hooks" property on the app conf
Ruby: process and thread lifecycle hooks.
This feature allows one to specify blocks of code that are called when certain lifecycle events occur. A user configures a "hooks" property on the app configuration that points to a script. This script will be evaluated on boot and should contain blocks of code that will be called on specific events.
An example of configuration:
{ "type": "ruby", "processes": 2, "threads": 2, "user": "vagrant", "group": "vagrant", "script": "config.ru", "hooks": "hooks.rb", "working_directory": "/home/vagrant/unit/rbhooks", "environment": { "GEM_HOME": "/home/vagrant/.ruby" } }
An example of a valid "hooks.rb" file follows:
File.write("./hooks.#{Process.pid}", "hooks evaluated")
on_worker_boot do File.write("./worker_boot.#{Process.pid}", "worker booted") end
on_thread_boot do File.write("./thread_boot.#{Process.pid}.#{Thread.current.object_id}", "thread booted") end
on_thread_shutdown do File.write("./thread_shutdown.#{Process.pid}.#{Thread.current.object_id}", "thread shutdown") end
on_worker_shutdown do File.write("./worker_shutdown.#{Process.pid}", "worker shutdown") end
This closes issue #535 on GitHub.
show more ...
|
#
1909:d6a5090da2ea |
| 02-Jul-2021 |
Oisin Canty |
Fixing crash during IPv6 text address generation.
When the textual representation of an IPv6 nxt_sockaddr_t was being generated, a crash would occur if the address had a full IPv6 form:
f607:7403:1
Fixing crash during IPv6 text address generation.
When the textual representation of an IPv6 nxt_sockaddr_t was being generated, a crash would occur if the address had a full IPv6 form:
f607:7403:1e4b:6c66:33b2:843f:2517:da27
This was caused by a variable that tracks the location of a collapsed group ("::") that was not set to a sane default. When the address was generated, a group would be inserted when it was not necessary, thus causing an overflow.
This closes #481 issue on GitHub.
show more ...
|
#
1907:75ddb2d89b42 |
| 01-Jul-2021 |
Max Romanov |
Fixing memory and descriptor leakage in case of port send failure.
In rare cases, when the destination process had finished running but no notification of this was received yet, send could fail with
Fixing memory and descriptor leakage in case of port send failure.
In rare cases, when the destination process had finished running but no notification of this was received yet, send could fail with an error, and the send message structure with file descriptors could leak.
The leakage was periodically reproduced by respawn tests on FreeBSD 12.
show more ...
|
#
1904:da7a4754f8bd |
| 01-Jul-2021 |
Max Romanov |
Fixing multiple TLS-enabled listeners initialization.
Because of the incorrect 'last' field assignment, multiple listeners with a TLS certificate did not initialize properly, which caused a router c
Fixing multiple TLS-enabled listeners initialization.
Because of the incorrect 'last' field assignment, multiple listeners with a TLS certificate did not initialize properly, which caused a router crash while establishing a connection.
Test with multiple TLS listeners added.
The issue was introduced in the c548e46fe516 commit.
This closes #561 issue on GitHub.
show more ...
|
#
1896:19eee884bd0b |
| 28-May-2021 |
Valentin Bartenev |
Version bump.
|
Revision tags: 1.24.0-1 |
|
#
1894:5c7ce0da580e |
| 27-May-2021 |
Andrei Belov |
Merged with the default branch.
|
Revision tags: 1.24.0 |
|
#
1891:5ae5e6619af9 |
| 27-May-2021 |
Valentin Bartenev |
Added version 1.24.0 CHANGES.
|
#
1890:b55d63dc55f9 |
| 27-May-2021 |
Valentin Bartenev |
Reordered changes for 1.24.0 by significance (subjective).
|
#
1889:04126d0d9d59 |
| 27-May-2021 |
Artem Konev |
Grammar fixes and improvements in changes.xml.
|
#
1887:0a32914bf7bf |
| 27-May-2021 |
Andrei Belov |
Packages: added Ubuntu 21.04 "hirsute" support.
|
#
1885:09b857a2cca9 |
| 26-May-2021 |
Andrey Suvorov |
Enabling SSL_CTX configuration by using SSL_CONF_cmd().
To perform various configuration operations on SSL_CTX, OpenSSL provides SSL_CONF_cmd(). Specifically, to configure ciphers for a listener, "
Enabling SSL_CTX configuration by using SSL_CONF_cmd().
To perform various configuration operations on SSL_CTX, OpenSSL provides SSL_CONF_cmd(). Specifically, to configure ciphers for a listener, "CipherString" and "Ciphersuites" file commands are used: https://www.openssl.org/docs/man1.1.1/man3/SSL_CONF_cmd.html
This feature can be configured in the "tls/conf_commands" section.
show more ...
|
#
1884:4645a43bc248 |
| 26-May-2021 |
Andrey Suvorov |
Fixing crash during TLS connection shutdown.
A crash was caused by an incorrect timer handler nxt_h1p_idle_timeout() if SSL_shutdown() returned SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
The flag SS
Fixing crash during TLS connection shutdown.
A crash was caused by an incorrect timer handler nxt_h1p_idle_timeout() if SSL_shutdown() returned SSL_ERROR_WANT_READ/SSL_ERROR_WANT_WRITE.
The flag SSL_RECEIVED_SHUTDOWN is used to avoid getting SSL_ERROR_WANT_READ, so the server won't wait for a close notification from a client.
For SSL_ERROR_WANT_WRITE, a correct timer handler is set up.
show more ...
|
#
1882:65e7dcdd7be4 |
| 26-May-2021 |
Oisin Canty |
MIME: added PHP.
|