Commit Graph

141 Commits

Author SHA1 Message Date
Zhidao HONG
53279af5d4 Static: support for openat2() features.
Support for chrooting, rejecting symlinks, and rejecting crossing mounting
points on a per-request basis during static file serving.
2021-04-29 22:04:34 +08:00
Andrey Suvorov
d2b0882d89 Added ability to configure multiple certificates on a listener.
The certificate is selected by matching the arriving SNI to the common name and
the alternatives names.  If no certificate matches the name, the first bundle in
the array is chosen.
2021-03-24 13:19:36 -07:00
Max Romanov
fddde539c9 Fixing NetBSD compatibility.
Instead of PTHREAD_STACK_MIN define, NetBSD requires to get minimum stack
size using sysctl(_SC_THREAD_STACK_MIN).

This change originally proposed by Juraj Lutter <juraj@lutter.sk>.
2021-03-02 18:30:34 +03:00
Valentin Bartenev
cac762ab7e Python: multiple values in the "path" option. 2020-12-22 17:53:41 +03:00
Axel Duch
e3af18834d Router: matching regular expressions support. 2020-11-17 15:03:30 +00:00
Valentin Bartenev
fb80502513 HTTP parser: allowed more characters in header field names.
Previously, all requests that contained in header field names characters other
than alphanumeric, or "-", or "_" were rejected with a 400 "Bad Request" error
response.

Now, the parser allows the same set of characters as specified in RFC 7230,
including: "!", "#", "$", "%", "&", "'", "*", "+", ".", "^", "`", "|", and "~".
Header field names that contain only these characters are considered valid.

Also, there's a new option introduced: "discard_unsafe_fields".  It accepts
boolean value and it is set to "true" by default.

When this option is "true", all header field names that contain characters
in valid range, but other than alphanumeric or "-" are skipped during parsing.
When the option is "false", these header fields aren't skipped.

Requests with non-valid characters in header field names according to
RFC 7230 are rejected regardless of "discard_unsafe_fields" setting.

This closes #422 issue on GitHub.
2020-11-17 16:50:06 +03:00
Tiago Natel de Moura
e7d66acda7 Isolation: added option to disable "procfs" mount.
Now users can disable the default procfs mount point
in the rootfs.

 {
     "isolation": {
         "automount": {
             "procfs": false
         }
     }
 }
2020-11-16 17:56:12 +00:00
Tiago Natel de Moura
3837d28f9b Isolation: added option to disable tmpfs mount.
Now users can disable the default tmpfs mount point
in the rootfs.

  {
      "isolation": {
          "automount": {
              "tmpfs": false
          }
      }
  }
2020-11-13 10:48:32 +00:00
Max Romanov
5fd2933d2e Python: supporting ASGI legacy protocol.
Introducing manual protocol selection for 'universal' apps and frameworks.
2020-11-10 22:27:08 +03:00
Max Romanov
d321d454f9 Perl: request processing in multiple threads.
This closes #486 issue on GitHub.
2020-11-05 16:10:59 +03:00
Max Romanov
b6475df79c Ruby: request processing in multiple threads.
This closes #482 issue on GitHub.
2020-11-05 12:45:10 +03:00
Max Romanov
29db46c52b Java: request processing in multiple threads.
This closes #458 issue on GitHub.
2020-11-05 00:06:10 +03:00
Max Romanov
8dcb0b9987 Python: request processing in multiple threads.
This closes #459 issue on GitHub.
2020-11-05 00:04:59 +03:00
Igor Sysoev
90b2c9f7d6 Using union instead of "void *". 2020-10-13 12:56:56 +03:00
Igor Sysoev
f541cbcce4 Using C99 style declaration. 2020-10-13 12:56:56 +03:00
Igor Sysoev
edafa954d4 Reordering declarations. 2020-10-13 12:56:56 +03:00
Max Romanov
f16ae01b12 Python: app module callable name configuration.
Now it is possible to specify the name of the application callable using
optional parameter 'callable'.  Default value is 'application'.

This closes #290 issue on GitHub.
2020-09-18 13:41:58 +03:00
Tiago Natel de Moura
b65a8636bb Isolation: added "automount" option.
Now it's possible to disable default bind mounts of
languages by setting:

  {
      "isolation": {
           "automount": {
               "language_deps": false
           }
     }
  }

In this case, the user is responsible to provide a "rootfs"
containing the language libraries and required files for
the application.
2020-08-25 15:25:51 +01:00
Valentin Bartenev
dcfa92c161 Configuration: removed "reschedule_timeout" option.
It's not used since cbcd76704c90.

This option is a leftover from previous IPC between router and applications
processes.  It was never documented, though.

Thanks to 洪志道 (Hong Zhi Dao).
2020-08-21 20:50:04 +03:00
Valentin Bartenev
9bf6efc55a Configuration: improved error message of invalid listener address.
Thanks to 洪志道 (Hong Zhi Dao).
This closes #466 issue on GitHub.
2020-08-19 15:36:57 +03:00
Valentin Bartenev
93146616cf Basic variables support. 2020-08-13 02:46:54 +03:00
Axel Duch
c3e6901f53 Configuration: fixed buffer over-read in pattern validation.
There was an undefined behavior in the validation function, caused by testing
one character after the string if a wildcard was at the end.
2020-07-28 14:51:33 +01:00
Valentin Bartenev
10f90f0d48 Configuration: added checking for presence of mandatory fields. 2020-07-24 20:25:20 +03:00
Valentin Bartenev
2a71a8a9f4 Added missing ending indicator in object members validation lists.
This fixes undefined behaviour due to array over-read if an unknown parameter
is specified in an uidmap, a gidmap, or a php target object.
2020-07-24 20:25:15 +03:00
Axel Duch
29cf3cc6c1 Configuration: removing redundant check.
Thanks to 洪志道 (Hong Zhi Dao).
2020-07-24 17:10:26 +01:00
Axel Duch
a9a21f6fe4 Router: route patterns multi wildcards support. 2020-07-04 03:24:07 +01:00
Tiago Natel de Moura
e2b53e16c6 Added "rootfs" feature. 2020-05-28 14:57:41 +01:00
Axel Duch
ee1e248f4b Router: decode uri and args. 2020-05-14 12:29:06 +02:00
Valentin Bartenev
376d758dd7 PHP: implemented "targets" option.
This allows to specify multiple subsequent targets inside PHP applications.
For example:

  {
      "listeners": {
          "*:80": {
              "pass": "routes"
          }
      },

      "routes": [
          {
              "match": {
                  "uri": "/info"
              },

              "action": {
                  "pass": "applications/my_app/phpinfo"
              }
          },
          {
              "match": {
                  "uri": "/hello"
              },

              "action": {
                  "pass": "applications/my_app/hello"
              }
          },
          {
              "action": {
                  "pass": "applications/my_app/rest"
              }
          }
      ],

      "applications": {
          "my_app": {
              "type": "php",
              "targets": {
                  "phpinfo": {
                      "script": "phpinfo.php",
                      "root": "/www/data/admin",
                  },

                  "hello": {
                      "script": "hello.php",
                      "root": "/www/data/test",
                  },

                  "rest": {
                      "root": "/www/data/example.com",
                      "index": "index.php"
                  },
              }
          }
      }
  }
2020-05-14 13:15:01 +03:00
Valentin Bartenev
0174c971b5 Configuration: URI encoding in the "pass" option.
This is useful to escape "/" in path fragments.  For example, in order
to reference the application named "foo/bar":

  {
      "pass": "applications/foo%2Fbar"
  }
2020-05-14 13:15:00 +03:00
Igor Sysoev
01e957ef64 Rational number support in upstream server weight. 2020-03-30 19:47:01 +03:00
Valentin Bartenev
68c6b67ffc Configuration: support for rational numbers. 2020-03-30 19:37:58 +03:00
Valentin Bartenev
c63b498f94 Implemented "location" option for "return" action.
This allows to specify redirects:

  {
      "action": {
          "return": 301,
          "location": "https://www.example.com/"
      }
  }
2020-03-21 01:39:00 +03:00
Valentin Bartenev
8d727774e3 Implemented "return" action.
The "return" action can be used to immediately generate a simple HTTP response
with an arbitrary status:

  {
      "action": {
          "return": 404
      }
  }

This is especially useful for denying access to specific resources.
2020-03-27 17:22:52 +03:00
Max Romanov
5296be0b82 Using disk file to store large request body.
This closes #386 on GitHub.
2020-03-12 17:54:29 +03:00
Igor Sysoev
7935ea4543 Round robin upstream added. 2020-03-06 18:28:54 +03:00
Valentin Bartenev
a98de7f705 Added a "fallback" option to be used with the "share" action.
It allows proceeding to another action if a file isn't available.

An example:

    {
        "share": "/data/www/",

        "fallback": {
            "pass": "applications/php"
        }
    }

In the example above, an attempt is made first to serve a request with
a file from the "/data/www/" directory.  If there's no such file, the
request is passed to the "php" application.

Fallback actions may be nested:

    {
        "share": "/data/www/",

        "fallback": {
            "share": "/data/cache/",

            "fallback": {
                "proxy": "http://127.0.0.1:9000"
            }
        }
    }
2020-03-03 20:37:47 +03:00
Valentin Bartenev
a60f856ce2 Improved validation of the "action" object.
Now it enforces the mutual exclusivity of "pass", "proxy", and "share" options.
2020-03-03 20:37:47 +03:00
Axel Duch
1a76371499 Router: introducing routing on listener address. 2019-12-24 13:59:58 +00:00
Axel Duch
8677bf8d41 Router: introducing routing on client address. 2019-12-24 13:58:10 +00:00
Max Romanov
64f649f990 Adding "limits/shm" configuration validation and parsing. 2019-12-24 18:04:09 +03:00
Igor Sysoev
ddde9c23cf Initial proxy support. 2019-11-14 16:39:54 +03:00
Igor Sysoev
09e7357b08 Style fixes. 2019-10-10 19:42:41 +03:00
Valentin Bartenev
75453479f3 Configuration: added check for mandatory options of "action". 2019-10-09 15:26:59 +03:00
Valentin Bartenev
08a8d1510d Basic support for serving static files. 2019-09-19 02:47:09 +03:00
Tiago de Bem Natel de Moura
c554941b4f Initial applications isolation support using Linux namespaces. 2019-09-19 15:25:23 +03:00
Max Romanov
e501c74ddc Introducing websocket support in router and libunit. 2019-08-20 16:31:53 +03:00
Axel Duch
7785c96c1a Added routing based on request scheme.
Scheme matches exact string “http” or “https”.
2019-07-24 13:47:35 +03:00
Igor Sysoev
0ba7cfce75 Added routing based on header fields. 2019-05-30 15:33:51 +03:00
Valentin Bartenev
5e1cf14565 Controller: rejecting double wildcards. 2019-04-12 17:44:55 +03:00