about summary refs log tree commit homepage
DateCommit message (Collapse)
2010-04-19Rainbows! 0.91.1 - use a less-broken parser from Unicorn v0.91.1
This release fixes a denial-of-service vector for deployments exposed directly to untrusted clients. The HTTP parser in Unicorn <= 0.97.0 would trip an assertion (killing the associated worker process) on invalid Content-Length headers instead of raising an exception. Since Rainbows! and Zbatery supports multiple clients per worker process, all clients connected to the worker process that hit the assertion would be aborted. Deployments behind nginx are _not_ affected by this bug, as nginx will reject clients that send invalid Content-Length headers. The status of deployments behind other HTTP-aware proxies is unknown. Deployments behind a non-HTTP-aware proxy (or no proxy at all) are certainly affected by this DoS. Users are strongly encouraged to upgrade as soon as possible, there are no other changes besides this bug fix from Rainbows! 0.91.0 nor Unicorn 0.97.0 This bug affects all previously released versions of Rainbows! and Zbatery.
2010-04-19add test for the rack-fiber_pool gem with EventMachine
Although advertised as being Thin-only, the rack-fiber_pool gem works with our EventMachine concurrency model as well. Note that it's impossible to expose the streaming "rack.input" behavior of the native FiberSpawn/FiberPool models via middleware, but most people don't need streaming a "rack.input" See http://github.com/mperham/rack-fiber_pool for more details on the rack-fiber_pool gem.
2010-04-19use the excellent `isolate' gem for dev
It should make life easier when dealing with and testing complex dependencies, especially ones like Cramp which depend on prerelease versions of gems.
2010-04-19rev/deferred_response: cleanup and simplification
We can use the new HttpResponse.header_string method now instead of writing an empty body.
2010-04-19use IO.copy_stream for Thread{Spawn,Pool} under 1.9
This should be faster for serving static files and proxying IO objects such as sockets/pipes. Unfortunately we cannot use this reliably with non-blocking frameworks since IO.copy_stream will release the GVL to block on I/O (rather than yielding a fiber or returning from a callback). Can't do HTTP/1.1 Range support, though :/
2010-04-19http_response: split out header stringification code
This will make it easier to use body#to_path if possible since some concurrency models like EventMachine have optimized code paths for serving static files.
2010-04-02rainbows/http_*: remove unnecessary circular requires
http_response and http_server are never NOT loaded when "rainbows" is required.
2010-04-02use duck typing for REMOTE_ADDR detection
This gives us the option to use non-TCPSocket-derived IO-ish objects in the future, whatever that may be...
2010-03-28cleanup: avoid redundant REMOTE_ADDR logic
Every concurrency model does this the same way. This removes the Rainbows::Const::LOCALHOST constant and may break some existing apps that rely on it.
2010-03-28fiber/base: do not modify hash during iteration (1.9.2dev)
It's generally dangerous to do so regardless of language and Ruby 1.9.2dev is stricter about this sort of behaviour.
2010-03-28local.mk.sample: bump neverblock test dep to 0.1.6.2
It continues to work with the old espace version from GitHub repos, too.
2010-03-26async_examples/async_app: avoid needless UTF-8
Unicorn stopped reading all config.ru files as binary starting with 0.97.0 for compatibility with rackup(1), so systems that defaulted to US-ASCII encoding would have trouble running this.
2010-03-01Rainbows! 0.91.0 - Unicorn resync v0.91.0
Unicorn 0.97.0 has a bunch of internal cleanups and small fixes and this is mainly to resync with those changes. keepalive_timeout now defaults to 5 seconds (from 2 seconds previous). This should help out clients on slower connections. Some small fixes and cleanups: * Rainbows::Fiber::IO objects may leak if a rare app uses them explicitly with FiberSpawn/FiberPool-only (not RevFiberSpawn) * quiet down ENOTCONN handling, there's nothing we can do about this error so we won't fill our logs with it.
2010-02-28rainbows: remove redundant check for $DEBUG
2010-02-28let Unicorn.builder parse switches in config.ru
Less code for us is better
2010-02-27keepalive_timeout defaults to 5 seconds
The previous 2 second default was not enough for folks on slow connections where our OS socket buffers would've masked the time it took to write out larger responses. ref: <20100219220904.GA11377@dcvr.yhbt.net>
2010-02-27ev_core: avoid needless String#dup
Just create an empty string instead and let Unicorn::HttpParser allocate it internally to whatever size is needed.
2010-02-27don't bother supporting platforms without FD_CLOEXEC
No point in having extra code around for platforms we don't care about.
2010-02-27revactor: cleanups to avoid instance_eval
instance_variable_{set,get} are faster, but equally ugly
2010-02-27revactor: document our EMFILE handling strategy
2010-02-27TCPSocket#peeraddr may raise ENOTCONN
Since we deal with untrusted/non-local clients, those clients may disconnect at inopportune times and leave us with ENOTCONN when we try to call getpeername(2)
2010-02-26avoid leaks if app uses Rainbows::Fiber::IO
For the very rare apps out there using Rainbows::Fiber::IO, the FiberSpawn and FiberPool (but not RevFiberSpawn) models could leak memory if the app-created Rainbows::Fiber::IO objects were dereferenced without being removed from the RD/WR hashes.
2010-02-26revactor/tee_input: sync w/ Unicorn::TeeInput struct-ification
commit a5f4d11cdb9465b1ffa2892b3d84ee53b8962930 in unicorn.git switched all ivars to struct members for ease-of-hacking and object size.
2010-02-24switch to Unicorn.builder, depend on Unicorn 0.97.0+
The Unicorn.builder helper will help us avoid namespace conflicts inside config.ru, allowing us to pass tests. While we're at it, port some tests over from the latest unicorn.git for dealing with bad configs.
2010-02-20test-lib: make FIFO start check an after_fork hook
enabling ready_pipe in Unicorn 0.96.0 breaks this.
2010-02-20test-lib: remove needless fd closing
too dangerous with the ready_pipe feature in Unicorn 0.96+
2010-02-13gemspec: bump dependency on Unicorn to avoid leak
The HTTP parser in Unicorn <= 0.96.0 did not use the Ruby API correctly. While this bug did not affect Unicorn itself, Rainbows! allocates a new Unicorn::HttpParser object for every client connection and Unicorn did not properly setup the parser object to be freed.
2010-02-11use Hash#compare_by_identity for performance
When available (Ruby 1.9), we can use Hash#compare_by_identity to improve performance.
2010-02-08t/bin/*: encoding should be the first line after shebang
Ruby 1.9 will complain otherwise
2010-02-01Rakefile: autoload Gem
easier to manage for cases where rake isn't a gem itself
2010-01-08add Cramp integration tests
Tested with cramp-0.7 and eventmachine 0.12.10
2010-01-08Merge branch 'rack-1.1'
* rack-1.1: http_response: disallow blank, multi-value headers
2010-01-08local.mk.sample: bump Rack dependency
2010-01-07Update docs + tests to reflect Rev 0.3.2 release
Rev 0.3.2 makes performance with Threads* under Ruby 1.8 tolerable.
2010-01-06Fix "rainbows -h" and "rainbows -v"
Do not identify ourselves as "Unicorn", especially not for -v. Also "ENVIRONMENT" should be "RACK_ENV".
2010-01-05http_response: disallow blank, multi-value headers
The HeaderHash optimizations in Rack 1.1 interact badly with Rails 2.3.5 (and possibly other frameworks/apps) which set multi-value "Set-Cookie" headers without relying on the proper methods provided by Rack::Utils. While this is an issue with Rails not using properly, there may be similar apps that make this mistake and Rack::Lint does not guard against it. Rack-ML-Ref: <20100105235845.GB3377@dcvr.yhbt.net>
2009-12-30Rainbows! 0.90.1 v0.90.1
This release contains minor bugfixes/compatibility improvements for ThreadSpawn, ThreadPool and EventMachine users. Excessive error messages from spurious wakeups using ThreadSpawn/ThreadPool under most platforms are silenced. Only Ruby 1.9 users under Linux were unaffected by this bug. EventMachine users may now use EM::Deferrable objects in responses, vastly improving compatibility with existing async_sinatra apps.
2009-12-30update TODO
EM::Deferrables done, NeverBlock updates...
2009-12-30EventMachine: support deferrables in responses
Some async apps rely on more than just "async.callback" and make full use of Deferrables provided by the EM::Deferrable module. Thanks to James Tucker for bringing this to our attention.
2009-12-29gemspec: clamp down unicorn dependency to < 0.97.0
We may be making some changes to Unicorn 0.97.0 and allow us to share more code.
2009-12-29quiet spurious wakeups for accept() in Thread* models
Under all MRI 1.8, a blocking Socket#accept Ruby method (needs to[1]) translate to a non-blocking accept(2) system call that may wake up threads/processes unnecessarily. Unfortunately, we failed to trap and ignore EAGAIN in those cases. This issue did not affect Ruby 1.9 running under modern Linux kernels where a _blocking_ accept(2) system call is not (easily, at least) susceptible to spurious wakeups. Non-Linux systems running Ruby 1.9 may be affected. [1] - using a blocking accept(2) on a shared socket with green threads is dangerous, as noted in commit ee7fe220ccbc991e1e7cbe982caf48e3303274c7 (and commit 451ca6997b4f298b436605b7f0af75f369320425)
2009-12-24doc: update manpage since Unicorn got new features
working_directory and Worker#user got added over time, so recommending Dir.chdir and Process::UID.change_privilege is bad.
2009-12-22gemspec: loosen Unicorn dependency
Unicorn 0.96.x should be released once Rack 1.1 is out.
2009-12-22Rainbows! 0.90.0 v0.90.0
This release should fix ThreadSpawn green thread blocking issues under MRI 1.8. Excessive socket closing is avoided when using Thread* models with Sunshowers (or clients disconnecting during uploads). There is a new RevFiberSpawn concurrency model which combines Rev with the traditional FiberSpawn model.
2009-12-22avoid setting "rainbows.autochunk" by default
No point in becoming the straw that causes a rehash since hardly anybody uses it.
2009-12-22base: fix constant resolution under 1.8 for 1.8 bugfix
2009-12-22update TODO
2009-12-22common Rainbows.sleep(nr) method
We'll export this across the board to all Rack applications to sleep with. This provides the optimum method of sleeping regardless of the concurrency model you choose. This method is still highly not recommended for pure event-driven models like Rev or EventMachine (but the threaded/fiber/actor-based variants are fine).
2009-12-22cleanup in Rainbows.accept definition
2009-12-22fix README speling fail