passenger 5.3.7 → 6.0.0

data/src/cxx_supportlib/AppLocalConfigFileUtils.h

@@ -0,0 +1,148 @@
+/*
+ *  Phusion Passenger - https://www.phusionpassenger.com/
+ *  Copyright (c) 2018 Phusion Holding B.V.
+ *
+ *  "Passenger", "Phusion Passenger" and "Union Station" are registered
+ *  trademarks of Phusion Holding B.V.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy
+ *  of this software and associated documentation files (the "Software"), to deal
+ *  in the Software without restriction, including without limitation the rights
+ *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ *  copies of the Software, and to permit persons to whom the Software is
+ *  furnished to do so, subject to the following conditions:
+ *
+ *  The above copyright notice and this permission notice shall be included in
+ *  all copies or substantial portions of the Software.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ *  THE SOFTWARE.
+ */
+#ifndef _PASSENGER_APP_LOCAL_CONFIG_FILE_UTILS_H_
+#define _PASSENGER_APP_LOCAL_CONFIG_FILE_UTILS_H_
+
+#include <oxt/system_calls.hpp>
+#include <oxt/backtrace.hpp>
+
+#include <cerrno>
+#include <fcntl.h>
+
+#include <jsoncpp/json.h>
+
+#include <StaticString.h>
+#include <Constants.h>
+#include <Exceptions.h>
+#include <IOTools/IOUtils.h>
+#include <Utils/ScopeGuard.h>
+
+namespace Passenger {
+
+using namespace std;
+
+
+struct AppLocalConfig {
+	string appStartCommand;
+	bool appSupportsKuriaProtocol;
+
+	AppLocalConfig()
+		: appSupportsKuriaProtocol(false)
+		{ }
+};
+
+
+inline AppLocalConfig
+parseAppLocalConfigFile(const StaticString appRoot) {
+	TRACE_POINT();
+	string path = appRoot + "/Passengerfile.json";
+
+	// Reading from Passengerfile.json from a root process is unsafe
+	// because of symlink attacks and other kinds of attacks. See the
+	// comments for safeReadFile().
+	//
+	// We are unable to use safeReadFile() here because we do not
+	// control the safety of the directories leading up to appRoot.
+	//
+	// What we can do is preventing the contents of an arbitrary
+	// file read from leaking out. Therefore, our result struct
+	// only contains a limited number of fields, that are known
+	// not to contain sensitive information. We also don't propagate
+	// JSON parsing error messages, which may contain the content.
+
+	int fd = syscalls::open(path.c_str(), O_RDONLY | O_NONBLOCK);
+	if (fd == -1) {
+		if (errno == ENOENT) {
+			return AppLocalConfig();
+		} else {
+			int e = errno;
+			throw FileSystemException("Error opening '" + path
+				+ "' for reading", e, path);
+		}
+	}
+
+	UPDATE_TRACE_POINT();
+	FdGuard fdGuard(fd, __FILE__, __LINE__);
+	pair<string, bool> content;
+	try {
+		content = readAll(fd, 1024 * 512);
+	} catch (const SystemException &e) {
+		throw FileSystemException("Error reading from '" + path + "'",
+			e.code(), path);
+	}
+	if (!content.second) {
+		throw SecurityException("Error parsing " + path
+			+ ": file exceeds size limit of 512 KB");
+	}
+	fdGuard.runNow();
+
+	UPDATE_TRACE_POINT();
+	Json::Reader reader;
+	Json::Value config;
+	if (!reader.parse(content.first, config)) {
+		if (geteuid() == 0) {
+			throw RuntimeException("Error parsing " + path
+				+ " (error messages suppressed for security reasons)");
+		} else {
+			throw RuntimeException("Error parsing " + path + ": "
+				+ reader.getFormattedErrorMessages());
+		}
+	}
+	// We no longer need the raw data so free the memory.
+	content.first.resize(0);
+
+
+	UPDATE_TRACE_POINT();
+	AppLocalConfig result;
+
+	if (!config.isObject()) {
+		throw RuntimeException("Config file " + path
+			+ " is not valid: top-level JSON object expected");
+	}
+	if (config.isMember("app_start_command")) {
+		if (config["app_start_command"].isString()) {
+			result.appStartCommand = config["app_start_command"].asString();
+		} else {
+			throw RuntimeException("Config file " + path
+				+ " is not valid: key 'app_start_command' must be a boolean");
+		}
+	}
+	if (config.isMember("app_supports_kuria_protocol")) {
+		if (config["app_supports_kuria_protocol"].isBool()) {
+			result.appSupportsKuriaProtocol = config["app_supports_kuria_protocol"].asBool();
+		} else {
+			throw RuntimeException("Config file " + path
+				+ " is not valid: key 'app_supports_kuria_protocol' must be a boolean");
+		}
+	}
+
+	return result;
+}
+
+
+} // namespace Passenger
+
+#endif /* _PASSENGER_APP_LOCAL_CONFIG_FILE_UTILS_H_ */

data/src/cxx_supportlib/AppTypeDetector/CBindings.cpp

@@ -74,6 +74,17 @@ psg_app_type_detector_result_set_wrapper_registry_entry(PsgAppTypeDetectorResult
 	cxxResult->wrapperRegistryEntry = static_cast<const WrapperRegistry::Entry *>(entry);
 }
 
+const char *
+psg_app_type_detector_result_get_app_start_command(const PsgAppTypeDetectorResult *result,
+	size_t *len)
+{
+	const Detector::Result *cxxResult = static_cast<const Detector::Result *>(result);
+	if (len != NULL) {
+		*len = cxxResult->appStartCommand.size();
+	}
+	return cxxResult->appStartCommand.data();
+}
+
 
 PsgAppTypeDetector *
 psg_app_type_detector_new(const PsgWrapperRegistry *registry,
@@ -81,7 +92,7 @@ psg_app_type_detector_new(const PsgWrapperRegistry *registry,
 {
 	const Registry *cxxRegistry = static_cast<const Registry *>(registry);
 	try {
-		Detector *detector = new Detector(*cxxRegistry, NULL, NULL, throttleRate);
+		Detector *detector = new Detector(*cxxRegistry, NULL, NULL, throttleRate, NULL);
 		return static_cast<PsgAppTypeDetector *>(detector);
 	} catch (const std::bad_alloc &) {
 		return NULL;

data/src/cxx_supportlib/AppTypeDetector/CBindings.h

@@ -46,6 +46,8 @@ const PsgWrapperRegistryEntry *psg_app_type_detector_result_get_wrapper_registry
 	const PsgAppTypeDetectorResult *result);
 void psg_app_type_detector_result_set_wrapper_registry_entry(PsgAppTypeDetectorResult *result,
 	const PsgWrapperRegistryEntry *entry);
+const char *psg_app_type_detector_result_get_app_start_command(const PsgAppTypeDetectorResult *result,
+	size_t *len);
 
 
 typedef void PsgAppTypeDetector;

data/src/cxx_supportlib/AppTypeDetector/Detector.h

@@ -38,30 +38,35 @@
 #include <string>
 
 #include <Exceptions.h>
+#include <AppLocalConfigFileUtils.h>
 #include <WrapperRegistry/Registry.h>
 #include <FileTools/PathManip.h>
 #include <FileTools/FileManip.h>
+#include <StrIntTools/StrIntUtils.h>
+#include <DataStructures/StringKeyTable.h>
 #include <Utils.h>
 #include <Utils/CachedFileStat.hpp>
-#include <StrIntTools/StrIntUtils.h>
 
 namespace Passenger {
 namespace AppTypeDetector {
 
 using namespace std;
 
+typedef AppLocalConfig* AppLocalConfigPtr;
+typedef StringKeyTable<AppLocalConfig> AppLocalConfigMap;
 
 class Detector {
 public:
 	struct Result {
 		const WrapperRegistry::Entry *wrapperRegistryEntry;
+		string appStartCommand;
 
 		Result()
 			: wrapperRegistryEntry(NULL)
 			{ }
 
 		bool isNull() const {
-			return wrapperRegistryEntry == NULL;
+			return wrapperRegistryEntry == NULL && appStartCommand.empty();
 		}
 	};
 
@@ -71,6 +76,9 @@ private:
 	boost::mutex *cstatMutex;
 	unsigned int throttleRate;
 	bool ownsCstat;
+	AppLocalConfigMap appLocalConfigCache;
+	boost::mutex *configMutex;
+	StringKeyTable<time_t> appRootCheckTimes;
 
 	bool check(char *buf, const char *end, const StaticString &appRoot,
 		const StaticString &name)
@@ -88,15 +96,33 @@ private:
 			cstat, cstatMutex, throttleRate) != FT_NONEXISTANT;
 	}
 
+	AppLocalConfigPtr getAppLocalConfigFromCache(const StaticString &appRoot) {
+		boost::unique_lock<boost::mutex> l;
+		time_t currentTime = SystemTime::get();
+		if (configMutex != NULL) {
+			l = boost::unique_lock<boost::mutex>(*configMutex);
+		}
+		if (!appLocalConfigCache.contains(appRoot)
+			|| currentTime >= (appRootCheckTimes.lookupCopy(appRoot) + throttleRate)) {
+			AppLocalConfig config = parseAppLocalConfigFile(appRoot);
+			appLocalConfigCache.insert(appRoot, config);
+			appRootCheckTimes.insert(appRoot, currentTime);
+		}
+		AppLocalConfigPtr appLocalConfig;
+		appLocalConfigCache.lookup(appRoot, &appLocalConfig);
+		return appLocalConfig;
+	}
+
 public:
 	Detector(const WrapperRegistry::Registry &_registry,
 		CachedFileStat *_cstat = NULL, boost::mutex *_cstatMutex = NULL,
-		unsigned int _throttleRate = 1)
+		unsigned int _throttleRate = 1, boost::mutex *_configMutex = NULL)
 		: registry(_registry),
 		  cstat(_cstat),
 		  cstatMutex(_cstatMutex),
 		  throttleRate(_throttleRate),
-		  ownsCstat(false)
+		  ownsCstat(false),
+		  configMutex(_configMutex)
 	{
 		assert(_registry.isFinalized());
 		if (_cstat == NULL) {
@@ -176,6 +202,14 @@ public:
 		char buf[PATH_MAX + 32];
 		const char *end = buf + sizeof(buf) - 1;
 
+		AppLocalConfigPtr appLocalConfig = getAppLocalConfigFromCache(appRoot);
+
+		if (!appLocalConfig->appStartCommand.empty()) {
+			Result result;
+			result.appStartCommand = appLocalConfig->appStartCommand;
+			return result;
+		}
+
 		WrapperRegistry::Registry::ConstIterator it(registry.getIterator());
 		while (*it != NULL) {
 			const WrapperRegistry::Entry &entry = it.getValue();

data/src/cxx_supportlib/Constants.h

@@ -81,7 +81,7 @@
 #define PASSENGER_API_VERSION_MAJOR 0
 #define PASSENGER_API_VERSION_MINOR 3
 #define PASSENGER_DEFAULT_USER "nobody"
-#define PASSENGER_VERSION "5.3.7"
+#define PASSENGER_VERSION "6.0.0"
 #define POOL_HELPER_THREAD_STACK_SIZE 262144
 #define PROCESS_SHUTDOWN_TIMEOUT 60
 #define PROCESS_SHUTDOWN_TIMEOUT_DISPLAY "1 minute"

data/src/nginx_module/ConfigGeneral/AutoGeneratedDefinitions.c

@@ -462,6 +462,14 @@
     offsetof(passenger_loc_conf_t, autogenerated.startup_file),
     NULL
 },
+{
+    ngx_string("passenger_app_start_command"),
+    NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LIF_CONF | NGX_CONF_TAKE1,
+    passenger_conf_set_app_start_command,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(passenger_loc_conf_t, autogenerated.app_start_command),
+    NULL
+},
 {
     ngx_string("passenger_restart_dir"),
     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LIF_CONF | NGX_CONF_TAKE1,
@@ -606,6 +614,14 @@
     offsetof(passenger_loc_conf_t, upstream_config.busy_buffers_size_conf),
     NULL
 },
+{
+    ngx_string("passenger_request_buffering"),
+    NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LIF_CONF | NGX_CONF_FLAG,
+    passenger_conf_set_request_buffering,
+    NGX_HTTP_LOC_CONF_OFFSET,
+    offsetof(passenger_loc_conf_t, upstream_config.request_buffering),
+    NULL
+},
 {
     ngx_string("passenger_intercept_errors"),
     NGX_HTTP_MAIN_CONF | NGX_HTTP_SRV_CONF | NGX_HTTP_LOC_CONF | NGX_HTTP_LIF_CONF | NGX_CONF_FLAG,

data/src/nginx_module/ConfigGeneral/AutoGeneratedManifestDefaultsInitialization.c

@@ -380,6 +380,12 @@ set_manifest_autogenerated_loc_conf_defaults(manifest_gen_ctx_t *ctx, PsgJsonVal
         "8k|16k",
         sizeof("8k|16k") - 1);
 
+    add_manifest_options_container_static_default_bool(ctx,
+        options_container,
+        "passenger_request_buffering",
+        sizeof("passenger_request_buffering") - 1,
+        1);
+
     add_manifest_options_container_static_default_bool(ctx,
         options_container,
         "passenger_intercept_errors",

data/src/nginx_module/ConfigGeneral/AutoGeneratedSetterFuncs.c

@@ -709,6 +709,18 @@ passenger_conf_set_startup_file(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     return ngx_conf_set_str_slot(cf, cmd, conf);
 }
 
+static char *
+passenger_conf_set_app_start_command(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+    passenger_loc_conf_t *passenger_conf = conf;
+
+    passenger_conf->autogenerated.app_start_command_explicitly_set = 1;
+    record_loc_conf_source_location(cf, passenger_conf,
+        &passenger_conf->autogenerated.app_start_command_source_file,
+        &passenger_conf->autogenerated.app_start_command_source_line);
+
+    return ngx_conf_set_str_slot(cf, cmd, conf);
+}
+
 static char *
 passenger_conf_set_restart_dir(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
     passenger_loc_conf_t *passenger_conf = conf;

data/src/nginx_module/Configuration.c

@@ -207,6 +207,7 @@ passenger_create_loc_conf(ngx_conf_t *cf)
         conf->upstream_config.next_upstream_tries = NGX_CONF_UNSET_UINT;
     #endif
     conf->upstream_config.buffering = NGX_CONF_UNSET;
+    conf->upstream_config.request_buffering = NGX_CONF_UNSET;
     conf->upstream_config.ignore_client_abort = NGX_CONF_UNSET;
     #if NGINX_VERSION_NUM >= 1007007
         conf->upstream_config.force_ranges = NGX_CONF_UNSET;
@@ -429,6 +430,9 @@ passenger_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
     ngx_conf_merge_value(conf->upstream_config.buffering,
                          prev->upstream_config.buffering, 0);
 
+    ngx_conf_merge_value(conf->upstream_config.request_buffering,
+                         prev->upstream_config.request_buffering, 1);
+
     ngx_conf_merge_value(conf->upstream_config.ignore_client_abort,
                          prev->upstream_config.ignore_client_abort, 0);
 
@@ -1141,6 +1145,22 @@ passenger_enabled(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
     return NGX_CONF_OK;
 }
 
+static char *
+passenger_conf_set_request_buffering(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) {
+    #ifdef NGINX_NO_SEND_REQUEST_BODY_INFINITE_LOOP_BUG
+        passenger_loc_conf_t *passenger_conf = conf;
+
+        passenger_conf->autogenerated.upstream_config_request_buffering_explicitly_set = 1;
+        record_loc_conf_source_location(cf, passenger_conf,
+            &passenger_conf->autogenerated.upstream_config_request_buffering_source_file,
+            &passenger_conf->autogenerated.upstream_config_request_buffering_source_line);
+
+        return ngx_conf_set_flag_slot(cf, cmd, conf);
+    #else
+        return "config cannot be set in Nginx < 1.15.3 due to this bug: https://trac.nginx.org/nginx/ticket/1618";
+    #endif /* NGINX_NO_SEND_REQUEST_BODY_INFINITE_LOOP_BUG */
+}
+
 static char *
 rails_framework_spawner_idle_time(ngx_conf_t *cf, ngx_command_t *cmd, void *conf)
 {

data/src/nginx_module/ContentHandler.c

@@ -1,7 +1,7 @@
 /*
  * Copyright (C) Igor Sysoev
  * Copyright (C) 2007 Manlio Perillo (manlio.perillo@gmail.com)
- * Copyright (c) 2010-2017 Phusion Holding B.V.
+ * Copyright (c) 2010-2018 Phusion Holding B.V.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -331,6 +331,179 @@ header_is_transfer_encoding(ngx_str_t *key)
         ngx_strncasecmp(key->data + 1, (u_char *) "ransfer-encodin", sizeof("ransfer-encodin") - 1) == 0;
 }
 
+/* Given an ngx_chain_t head and tail position, appends a new chain element at the end,
+ * updates the head (if necessary) and returns the new element.
+ *
+ *  - The element is allocated from a freelist.
+ *  - Ensures that the element contains a buffer of at least `size` bytes.
+ *  - Sets the given tag on the buffer in the chain element.
+ *
+ * On error, returns NULL without modifying the given chain.
+ */
+static ngx_chain_t *
+append_ngx_chain_element(ngx_pool_t *p, ngx_chain_t **head,
+    ngx_chain_t *tail, ngx_chain_t **freelist, ngx_buf_tag_t tag, size_t size)
+{
+    ngx_chain_t *elem;
+    ngx_buf_t *buf;
+
+    elem = ngx_chain_get_free_buf(p, freelist);
+    if (elem == NULL) {
+        return NULL;
+    }
+
+    buf = elem->buf;
+    buf->tag = tag;
+
+    if (size > 0 && (buf->pos == NULL || buf->last == NULL
+        || (size_t) ngx_buf_size(buf) < size))
+    {
+        ngx_memzero(buf, sizeof(ngx_buf_t));
+
+        buf->start = ngx_palloc(p, size);
+        if (buf->start == NULL) {
+            return NULL;
+        }
+
+        /*
+         * set by ngx_memzero():
+         *
+         *     b->file_pos = 0;
+         *     b->file_last = 0;
+         *     b->file = NULL;
+         *     b->shadow = NULL;
+         *     b->tag = 0;
+         *     and flags
+         */
+
+        buf->pos = buf->start;
+        buf->last = buf->start;
+        buf->end = buf->last + size;
+        buf->temporary = 1;
+    }
+
+    if (*head == NULL) {
+        *head = elem;
+    } else {
+        tail->next = elem;
+    }
+    return elem;
+}
+
+/* Given a chain of buffers containing client body data,
+ * this filter wraps all that data into chunked encoding
+ * headers and footers.
+ */
+static ngx_int_t
+body_rechunk_output_filter(void *data, ngx_chain_t *input)
+{
+    ngx_http_request_t *r = data;
+    ngx_chain_t *output_head = NULL, *output_tail = NULL;
+    ngx_int_t body_eof_reached = 0;
+    ngx_int_t rc;
+    passenger_context_t *ctx;
+
+    ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                   PROGRAM_NAME " rechunk output filter");
+
+    ctx = ngx_http_get_module_ctx(r, ngx_http_passenger_module);
+
+    if (input == NULL) {
+        goto out;
+    }
+
+    if (!ctx->header_sent) {
+        /* The first buffer contains the request header, so pass it unmodified. */
+        ctx->header_sent = 1;
+
+        while (input != NULL) {
+            output_tail = append_ngx_chain_element(r->pool,
+                &output_head, output_tail, &ctx->free,
+                (ngx_buf_tag_t) &body_rechunk_output_filter,
+                0);
+            if (output_tail == NULL) {
+                return NGX_ERROR;
+            }
+
+            ngx_memcpy(output_tail->buf, input->buf, sizeof(ngx_buf_t));
+
+            body_eof_reached = input->buf->last_buf;
+            input = input->next;
+        }
+    } else {
+        while (input != NULL) {
+            /* Append chunked encoding size header */
+            output_tail = append_ngx_chain_element(r->pool,
+                &output_head, output_tail, &ctx->free,
+                (ngx_buf_tag_t) &body_rechunk_output_filter,
+                32);
+            if (output_tail == NULL) {
+                return NGX_ERROR;
+            }
+
+            output_tail->buf->last = ngx_sprintf(output_tail->buf->last, "%xO\r\n",
+                ngx_buf_size(input->buf));
+
+
+            /* Append chunked encoding payload */
+            output_tail = append_ngx_chain_element(r->pool,
+                &output_head, output_tail, &ctx->free,
+                (ngx_buf_tag_t) &body_rechunk_output_filter,
+                0);
+            if (output_tail == NULL) {
+                return NGX_ERROR;
+            }
+
+            ngx_memcpy(output_tail->buf, input->buf, sizeof(ngx_buf_t));
+
+
+            /* Append chunked encoding footer */
+            output_tail = append_ngx_chain_element(r->pool,
+                &output_head, output_tail, &ctx->free,
+                (ngx_buf_tag_t) &body_rechunk_output_filter,
+                2);
+            if (output_tail == NULL) {
+                return NGX_ERROR;
+            }
+
+            output_tail->buf->last = ngx_copy(output_tail->buf->last, "\r\n", 2);
+
+
+            body_eof_reached = input->buf->last_buf;
+            input = input->next;
+        }
+    }
+
+    if (body_eof_reached) {
+        /* Append final termination chunk. */
+        output_tail = append_ngx_chain_element(r->pool,
+                &output_head, output_tail, &ctx->free,
+                (ngx_buf_tag_t) &body_rechunk_output_filter,
+                5);
+        if (output_tail == NULL) {
+            return NGX_ERROR;
+        }
+
+        output_tail->buf->last = ngx_copy(output_tail->buf->last,
+            "0\r\n\r\n", 5);
+    }
+
+out:
+
+    rc = ngx_chain_writer(&r->upstream->writer, output_head);
+
+    /*
+     * The previous ngx_chain_writer() call consumed some buffers.
+     * Find such consumped (empty) buffers in the output buffer list,
+     * and either free them or add them to the freelist depending on
+     * whether the buffer's tag matches ours.
+     */
+    ngx_chain_update_chains(r->pool, &ctx->free, &ctx->busy, &output_head,
+        (ngx_buf_tag_t) &body_rechunk_output_filter);
+
+    return rc;
+}
+
 #define SET_NGX_STR(str, the_data) \
     do { \
         (str)->data = (u_char *) the_data; \
@@ -346,15 +519,25 @@ header_is_transfer_encoding(ngx_str_t *key)
 typedef struct {
     ngx_str_t     method; /* Includes trailing space */
     ngx_str_t     app_type;
+    ngx_str_t     app_start_command;
     ngx_str_t     escaped_uri;
-    ngx_str_t     content_length;
+    ngx_str_t     content_length; /* Only used if !r->request_body_no_buffering */
     ngx_str_t     core_password;
     ngx_str_t     remote_port;
 } buffer_construction_state;
 
+/* prepare_request_buffer_construction() and construct_request_buffer() are
+ * used to create an HTTP request header buffer to be sent to the Core Controller.
+ *
+ * construct_request_buffer() is actually called twice: the first time in "no-op" mode to
+ * calculate how many bytes it must allocate, and the second time to actually create the
+ * buffer. For efficiency reasons, as much preparation work as possible is split into
+ * the prepare_request_buffer_construction() function so that the two construct_request_buffer()
+ * calls don't have to perform that work twice.
+ */
 static ngx_int_t
-prepare_request_buffer_construction(ngx_http_request_t *r, passenger_context_t *context,
-    buffer_construction_state *state)
+prepare_request_buffer_construction(ngx_http_request_t *r, passenger_loc_conf_t *slcf,
+    passenger_context_t *context, buffer_construction_state *state)
 {
     unsigned int          len;
     ngx_uint_t            port;
@@ -364,6 +547,7 @@ prepare_request_buffer_construction(ngx_http_request_t *r, passenger_context_t *
 #endif
     const PsgWrapperRegistryEntry *wrapper_registry_entry;
 
+    /* Construct HTTP method string, including trailing space. */
     switch (r->method) {
     case NGX_HTTP_GET:
         SET_NGX_STR(&state->method, "GET ");
@@ -415,10 +599,28 @@ prepare_request_buffer_construction(ngx_http_request_t *r, passenger_context_t *
         break;
     }
 
-    wrapper_registry_entry = psg_app_type_detector_result_get_wrapper_registry_entry(
-        context->detector_result);
-    state->app_type.data = (u_char *) psg_wrapper_registry_entry_get_language(wrapper_registry_entry,
-        &state->app_type.len);
+    if (slcf->autogenerated.app_start_command.data != NULL) {
+        /* The config specified that this is either a generic app or a Kuria app. */
+        state->app_type.data = NULL;
+        state->app_type.len = 0;
+        state->app_start_command = slcf->autogenerated.app_start_command;
+    } else {
+        wrapper_registry_entry = psg_app_type_detector_result_get_wrapper_registry_entry(
+            context->detector_result);
+        if (wrapper_registry_entry != NULL) {
+            /* This is an auto-supported app. */
+            state->app_type.data = (u_char *) psg_wrapper_registry_entry_get_language(wrapper_registry_entry,
+                &state->app_type.len);
+            state->app_start_command.data = NULL;
+            state->app_start_command.len = 0;
+        } else {
+            /* This has been autodetected to be a generic app or a Kuria app. */
+            state->app_type.data = NULL;
+            state->app_type.len = 0;
+            state->app_start_command.data = (u_char *) psg_app_type_detector_result_get_app_start_command(
+                context->detector_result, &state->app_start_command.len);
+        }
+    }
 
     /*
      * Nginx unescapes URI's before passing them to Phusion Passenger,
@@ -446,7 +648,7 @@ prepare_request_buffer_construction(ngx_http_request_t *r, passenger_context_t *
             NGX_ESCAPE_URI);
     }
 
-    if (r->headers_in.chunked) {
+    if (r->headers_in.chunked && !r->request_body_no_buffering) {
         /* If the request body is chunked, then Nginx sets r->headers_in.content_length_n
          * but does not set r->headers_in.headers, so we add this header ourselves.
          */
@@ -495,6 +697,7 @@ prepare_request_buffer_construction(ngx_http_request_t *r, passenger_context_t *
     return NGX_OK;
 }
 
+/* See comment for prepare_request_buffer_construction() */
 static ngx_uint_t
 construct_request_buffer(ngx_http_request_t *r, passenger_loc_conf_t *slcf,
     passenger_context_t *context, buffer_construction_state *state, ngx_buf_t *b)
@@ -554,7 +757,7 @@ construct_request_buffer(ngx_http_request_t *r, passenger_loc_conf_t *slcf,
 
         if (ngx_hash_find(&slcf->headers_set_hash, header[i].hash,
                           header[i].lowcase_key, header[i].key.len)
-         || header_is_transfer_encoding(&header[i].key))
+         || (!r->request_body_no_buffering && header_is_transfer_encoding(&header[i].key)))
         {
             continue;
         }
@@ -568,7 +771,7 @@ construct_request_buffer(ngx_http_request_t *r, passenger_loc_conf_t *slcf,
         total_size += header[i].key.len + header[i].value.len + 4;
     }
 
-    if (r->headers_in.chunked) {
+    if (r->headers_in.chunked && !r->request_body_no_buffering) {
         PUSH_STATIC_STR("Content-Length: ");
         if (b != NULL) {
             b->last = ngx_copy(b->last, state->content_length.data,
@@ -756,13 +959,23 @@ construct_request_buffer(ngx_http_request_t *r, passenger_loc_conf_t *slcf,
         PUSH_STATIC_STR("\r\n");
     }
 
-    PUSH_STATIC_STR("!~PASSENGER_APP_TYPE: ");
-    if (b != NULL) {
-        b->last = ngx_copy(b->last, state->app_type.data,
-            state->app_type.len);
+    if (state->app_type.len > 0) {
+        PUSH_STATIC_STR("!~PASSENGER_APP_TYPE: ");
+        if (b != NULL) {
+            b->last = ngx_copy(b->last, state->app_type.data,
+                state->app_type.len);
+        }
+        total_size += state->app_type.len;
+        PUSH_STATIC_STR("\r\n");
+    } else {
+        PUSH_STATIC_STR("!~PASSENGER_APP_START_COMMAND: ");
+        if (b != NULL) {
+            b->last = ngx_copy(b->last, state->app_start_command.data,
+                state->app_start_command.len);
+        }
+        total_size += state->app_start_command.len;
+        PUSH_STATIC_STR("\r\n");
     }
-    total_size += state->app_type.len;
-    PUSH_STATIC_STR("\r\n");
 
     if (b != NULL) {
         b->last = ngx_copy(b->last, slcf->options_cache.data, slcf->options_cache.len);
@@ -816,7 +1029,7 @@ create_request(ngx_http_request_t *r)
 
     /* Construct and pass request headers */
 
-    if (prepare_request_buffer_construction(r, context, &state) != NGX_OK) {
+    if (prepare_request_buffer_construction(r, slcf, context, &state) != NGX_OK) {
         return NGX_ERROR;
     }
     request_size = construct_request_buffer(r, slcf, context, &state, NULL);
@@ -825,20 +1038,45 @@ create_request(ngx_http_request_t *r)
     if (b == NULL) {
         return NGX_ERROR;
     }
+    construct_request_buffer(r, slcf, context, &state, b);
+
     cl = ngx_alloc_chain_link(r->pool);
     if (cl == NULL) {
         return NGX_ERROR;
     }
     cl->buf = b;
 
-    construct_request_buffer(r, slcf, context, &state, b);
 
-    /* Pass request body */
+    /* Pass already received request body buffers. Make sure they come
+     * after the request header buffer we just constructed.
+     */
 
     body = r->upstream->request_bufs;
     r->upstream->request_bufs = cl;
 
     while (body) {
+        if (r->headers_in.chunked && r->request_body_no_buffering) {
+            /* If Transfer-Encoding is chunked, then Nginx dechunks the body.
+             * If at the same time request body buffering is disabled, then
+             * we pass the Transfer-Encoding header to the Passenger Core,
+             * and thus we also need to ensure we rechunk the body.
+             */
+            b = ngx_create_temp_buf(r->pool, 32);
+            if (b == NULL) {
+                return NGX_ERROR;
+            }
+
+            b->last = ngx_sprintf(b->last, "%xO\r\n",
+                ngx_buf_size(body->buf));
+            cl->next = ngx_alloc_chain_link(r->pool);
+            if (cl->next == NULL) {
+                return NGX_ERROR;
+            }
+
+            cl = cl->next;
+            cl->buf = b;
+        }
+
         b = ngx_alloc_buf(r->pool);
         if (b == NULL) {
             return NGX_ERROR;
@@ -850,15 +1088,41 @@ create_request(ngx_http_request_t *r)
         if (cl->next == NULL) {
             return NGX_ERROR;
         }
-
         cl = cl->next;
         cl->buf = b;
 
         body = body->next;
+
+        if (r->headers_in.chunked && r->request_body_no_buffering) {
+            b = ngx_create_temp_buf(r->pool, 2);
+            if (b == NULL) {
+                return NGX_ERROR;
+            }
+
+            b->last = ngx_copy(b->last, "\r\n", 2);
+            cl->next = ngx_alloc_chain_link(r->pool);
+            if (cl->next == NULL) {
+                return NGX_ERROR;
+            }
+
+            cl = cl->next;
+            cl->buf = b;
+        }
     }
+
     b->flush = 1;
     cl->next = NULL;
 
+    /* Again, if Transfer-Encoding is chunked, then Nginx dechunks the body.
+     * Here we install an output filter to make sure that the request body parts
+     * that will be received in the future, will also be rechunked when passed
+     * to the Passenger Core.
+     */
+    if (r->headers_in.chunked && r->request_body_no_buffering) {
+        r->upstream->output.output_filter = body_rechunk_output_filter;
+        r->upstream->output.filter_ctx = r;
+    }
+
     return NGX_OK;
 }
 
@@ -1467,7 +1731,15 @@ passenger_content_handler(ngx_http_request_t *r)
     detector_result_cleanup->handler = cleanup_detector_result;
     detector_result_cleanup->data = context->detector_result;
 
-    if (slcf->autogenerated.app_type.data == NULL) {
+    /* If `app_start_command` is set, then it means the config specified that it is
+     * either a generic app or a Kuria app.
+     */
+    if (slcf->autogenerated.app_start_command.data == NULL
+     && slcf->autogenerated.app_type.data == NULL)
+    {
+        /* If neither `app_start_command` nor `app_type` are set, then
+         * autodetect what kind of app this is.
+         */
         pp_error_init(&error);
         if (slcf->autogenerated.app_root.data == NULL) {
             psg_app_type_detector_check_document_root(
@@ -1502,7 +1774,11 @@ passenger_content_handler(ngx_http_request_t *r)
             pp_error_destroy(&error);
             return NGX_HTTP_INTERNAL_SERVER_ERROR;
         }
-    } else {
+    } else if (slcf->autogenerated.app_start_command.data == NULL) {
+        /* If `app_start_command` is not set but `app_type` is, then
+         * verify whether the given `app_type` value is supported
+         * and resolve aliases.
+         */
         wrapper_registry_entry = psg_wrapper_registry_lookup(psg_wrapper_registry,
             (const char *) slcf->autogenerated.app_type.data,
             slcf->autogenerated.app_type.len);
@@ -1547,6 +1823,8 @@ passenger_content_handler(ngx_http_request_t *r)
     u->pipe->input_filter = ngx_event_pipe_copy_input_filter;
     u->pipe->input_ctx = r;
 
+    r->request_body_no_buffering = !slcf->upstream_config.request_buffering;
+
     rc = ngx_http_read_client_request_body(r, ngx_http_upstream_init);
 
     fix_peer_address(r);