Date | Commit message (Collapse) |
|
This release fixes a denial-of-service vector for deployments
exposed directly to untrusted clients.
The HTTP parser in Unicorn <= 0.97.0 would trip an assertion
(killing the associated worker process) on invalid
Content-Length headers instead of raising an exception. Since
Rainbows! and Zbatery supports multiple clients per worker
process, all clients connected to the worker process that hit
the assertion would be aborted.
Deployments behind nginx are _not_ affected by this bug, as
nginx will reject clients that send invalid Content-Length
headers.
The status of deployments behind other HTTP-aware proxies is
unknown. Deployments behind a non-HTTP-aware proxy (or no proxy
at all) are certainly affected by this DoS.
Users are strongly encouraged to upgrade as soon as possible,
there are no other changes besides this bug fix from Rainbows!
0.91.0 nor Unicorn 0.97.0
This bug affects all previously released versions of Rainbows!
and Zbatery.
|
|
Although advertised as being Thin-only, the rack-fiber_pool gem
works with our EventMachine concurrency model as well.
Note that it's impossible to expose the streaming "rack.input"
behavior of the native FiberSpawn/FiberPool models via
middleware, but most people don't need streaming a "rack.input"
See http://github.com/mperham/rack-fiber_pool for more details
on the rack-fiber_pool gem.
|
|
It should make life easier when dealing with and testing
complex dependencies, especially ones like Cramp which
depend on prerelease versions of gems.
|
|
We can use the new HttpResponse.header_string method now
instead of writing an empty body.
|
|
This should be faster for serving static files and proxying IO
objects such as sockets/pipes. Unfortunately we cannot use this
reliably with non-blocking frameworks since IO.copy_stream will
release the GVL to block on I/O (rather than yielding a fiber
or returning from a callback).
Can't do HTTP/1.1 Range support, though :/
|
|
This will make it easier to use body#to_path if possible since
some concurrency models like EventMachine have optimized code
paths for serving static files.
|
|
http_response and http_server are never NOT loaded when
"rainbows" is required.
|
|
This gives us the option to use non-TCPSocket-derived
IO-ish objects in the future, whatever that may be...
|
|
Every concurrency model does this the same way.
This removes the Rainbows::Const::LOCALHOST constant and
may break some existing apps that rely on it.
|
|
It's generally dangerous to do so regardless of language and
Ruby 1.9.2dev is stricter about this sort of behaviour.
|
|
It continues to work with the old espace version from GitHub
repos, too.
|
|
Unicorn stopped reading all config.ru files as binary
starting with 0.97.0 for compatibility with rackup(1),
so systems that defaulted to US-ASCII encoding would
have trouble running this.
|
|
Unicorn 0.97.0 has a bunch of internal cleanups and small fixes
and this is mainly to resync with those changes.
keepalive_timeout now defaults to 5 seconds (from 2 seconds
previous). This should help out clients on slower connections.
Some small fixes and cleanups:
* Rainbows::Fiber::IO objects may leak if a rare app uses them
explicitly with FiberSpawn/FiberPool-only (not RevFiberSpawn)
* quiet down ENOTCONN handling, there's nothing we can do about
this error so we won't fill our logs with it.
|
|
|
|
Less code for us is better
|
|
The previous 2 second default was not enough for folks on slow
connections where our OS socket buffers would've masked the time
it took to write out larger responses.
ref: <20100219220904.GA11377@dcvr.yhbt.net>
|
|
Just create an empty string instead and let Unicorn::HttpParser
allocate it internally to whatever size is needed.
|
|
No point in having extra code around for platforms we
don't care about.
|
|
instance_variable_{set,get} are faster, but equally ugly
|
|
|
|
Since we deal with untrusted/non-local clients, those clients
may disconnect at inopportune times and leave us with ENOTCONN
when we try to call getpeername(2)
|
|
For the very rare apps out there using Rainbows::Fiber::IO, the
FiberSpawn and FiberPool (but not RevFiberSpawn) models could
leak memory if the app-created Rainbows::Fiber::IO objects
were dereferenced without being removed from the RD/WR hashes.
|
|
commit a5f4d11cdb9465b1ffa2892b3d84ee53b8962930 in unicorn.git
switched all ivars to struct members for ease-of-hacking and
object size.
|
|
The Unicorn.builder helper will help us avoid namespace
conflicts inside config.ru, allowing us to pass tests.
While we're at it, port some tests over from the latest
unicorn.git for dealing with bad configs.
|
|
enabling ready_pipe in Unicorn 0.96.0 breaks this.
|
|
too dangerous with the ready_pipe feature in Unicorn 0.96+
|
|
The HTTP parser in Unicorn <= 0.96.0 did not use the Ruby API
correctly. While this bug did not affect Unicorn itself,
Rainbows! allocates a new Unicorn::HttpParser object for every
client connection and Unicorn did not properly setup the parser
object to be freed.
|
|
When available (Ruby 1.9), we can use Hash#compare_by_identity
to improve performance.
|
|
Ruby 1.9 will complain otherwise
|
|
easier to manage for cases where rake isn't a gem itself
|
|
Tested with cramp-0.7 and eventmachine 0.12.10
|
|
* rack-1.1:
http_response: disallow blank, multi-value headers
|
|
|
|
Rev 0.3.2 makes performance with Threads* under Ruby 1.8
tolerable.
|
|
Do not identify ourselves as "Unicorn", especially not
for -v. Also "ENVIRONMENT" should be "RACK_ENV".
|
|
The HeaderHash optimizations in Rack 1.1 interact badly with
Rails 2.3.5 (and possibly other frameworks/apps) which set
multi-value "Set-Cookie" headers without relying on the proper
methods provided by Rack::Utils.
While this is an issue with Rails not using properly, there
may be similar apps that make this mistake and Rack::Lint
does not guard against it.
Rack-ML-Ref: <20100105235845.GB3377@dcvr.yhbt.net>
|
|
This release contains minor bugfixes/compatibility improvements
for ThreadSpawn, ThreadPool and EventMachine users.
Excessive error messages from spurious wakeups using
ThreadSpawn/ThreadPool under most platforms are silenced. Only
Ruby 1.9 users under Linux were unaffected by this bug.
EventMachine users may now use EM::Deferrable objects in
responses, vastly improving compatibility with existing
async_sinatra apps.
|
|
EM::Deferrables done, NeverBlock updates...
|
|
Some async apps rely on more than just "async.callback" and
make full use of Deferrables provided by the EM::Deferrable
module. Thanks to James Tucker for bringing this to our
attention.
|
|
We may be making some changes to Unicorn 0.97.0
and allow us to share more code.
|
|
Under all MRI 1.8, a blocking Socket#accept Ruby method (needs
to[1]) translate to a non-blocking accept(2) system call that may
wake up threads/processes unnecessarily. Unfortunately, we
failed to trap and ignore EAGAIN in those cases.
This issue did not affect Ruby 1.9 running under modern Linux
kernels where a _blocking_ accept(2) system call is not (easily,
at least) susceptible to spurious wakeups. Non-Linux systems
running Ruby 1.9 may be affected.
[1] - using a blocking accept(2) on a shared socket with
green threads is dangerous, as noted in
commit ee7fe220ccbc991e1e7cbe982caf48e3303274c7
(and commit 451ca6997b4f298b436605b7f0af75f369320425)
|
|
working_directory and Worker#user got added over time, so
recommending Dir.chdir and Process::UID.change_privilege
is bad.
|
|
Unicorn 0.96.x should be released once Rack 1.1 is out.
|
|
This release should fix ThreadSpawn green thread blocking issues
under MRI 1.8. Excessive socket closing is avoided when using
Thread* models with Sunshowers (or clients disconnecting
during uploads).
There is a new RevFiberSpawn concurrency model which combines
Rev with the traditional FiberSpawn model.
|
|
No point in becoming the straw that causes a rehash
since hardly anybody uses it.
|
|
|
|
|
|
We'll export this across the board to all Rack applications
to sleep with. This provides the optimum method of sleeping
regardless of the concurrency model you choose. This method
is still highly not recommended for pure event-driven models
like Rev or EventMachine (but the threaded/fiber/actor-based
variants are fine).
|
|
|
|
|