passenger 6.0.6 → 6.0.22

data/src/cxx_supportlib/IOTools/BufferedIO.h

@@ -30,7 +30,7 @@
 #include <utility>
 #include <algorithm>
 #include <boost/function.hpp>
-#include <boost/bind.hpp>
+#include <boost/bind/bind.hpp>
 #include <oxt/system_calls.hpp>
 #include <oxt/macros.hpp>
 #include <sys/types.h>

data/src/cxx_supportlib/IOTools/IOUtils.cpp

@@ -530,7 +530,6 @@ connectToUnixServer(const StaticString &filename, const char *file,
 		}
 	}
 	abort();   // Never reached.
-	return -1; // Shut up compiler warning.
 }
 
 void
@@ -782,9 +781,6 @@ pingTcpServer(const StaticString &host, unsigned int port, unsigned long long *t
 			#else
 				throw e;
 			#endif
-
-			// Never reached, shut up compiler warning.
-			return false;
 		} else {
 			throw e;
 		}
@@ -919,7 +915,7 @@ staticStringArrayToIoVec(const StaticString ary[], size_t count, struct iovec *v
 			 * platforms it's still defined as non-const char *
 			 * :-(
 			 */
-			vec[vecCount].iov_base = (char *) ary[i].data();
+			vec[vecCount].iov_base = const_cast<char *>(ary[i].data());
 			vec[vecCount].iov_len  = ary[i].size();
 			total += ary[i].size();
 			vecCount++;
@@ -1030,7 +1026,7 @@ realGatheredWrite(int fd, const StaticString *data, unsigned int dataCount, stri
 			return totalSize;
 		}
 	} else {
-		iov[0].iov_base = (char *) restBuffer.data();
+		iov[0].iov_base = const_cast<char *>(restBuffer.data());
 		iov[0].iov_len  = restBuffer.size();
 		totalSize = staticStringArrayToIoVec(data, dataCount, iov + 1, iovCount);
 		totalSize += restBuffer.size();
@@ -1183,7 +1179,7 @@ readFileDescriptor(int fd, unsigned long long *timeout) {
 	struct msghdr msg;
 	struct iovec vec;
 	char dummy[1];
-	#if defined(__APPLE__) || defined(__SOLARIS__) || defined(__arm__)
+	#if defined(__APPLE__) || defined(__SOLARIS__)
 		// File descriptor passing macros (CMSG_*) seem to be broken
 		// on 64-bit MacOS X. This structure works around the problem.
 		struct {
@@ -1226,7 +1222,7 @@ readFileDescriptor(int fd, unsigned long long *timeout) {
 		throw IOException("No valid file descriptor received.");
 	}
 
-	#if defined(__APPLE__) || defined(__SOLARIS__) || defined(__arm__)
+	#if defined(__APPLE__) || defined(__SOLARIS__)
 		return control_data.fd;
 	#else
 		return *((int *) CMSG_DATA(control_header));
@@ -1242,7 +1238,7 @@ writeFileDescriptor(int fd, int fdToSend, unsigned long long *timeout) {
 	struct msghdr msg;
 	struct iovec vec;
 	char dummy[1];
-	#if defined(__APPLE__) || defined(__SOLARIS__) || defined(__arm__)
+	#if defined(__APPLE__) || defined(__SOLARIS__)
 		struct {
 			struct cmsghdr header;
 			int fd;
@@ -1273,7 +1269,7 @@ writeFileDescriptor(int fd, int fdToSend, unsigned long long *timeout) {
 	control_header = CMSG_FIRSTHDR(&msg);
 	control_header->cmsg_level = SOL_SOCKET;
 	control_header->cmsg_type  = SCM_RIGHTS;
-	#if defined(__APPLE__) || defined(__SOLARIS__) || defined(__arm__)
+	#if defined(__APPLE__) || defined(__SOLARIS__)
 		control_header->cmsg_len = sizeof(control_data);
 		control_data.fd = fdToSend;
 	#else

data/src/cxx_supportlib/IOTools/MessageIO.h

@@ -83,7 +83,7 @@
 #include <cstdarg>
 
 #include <boost/cstdint.hpp>
-#include <boost/bind.hpp>
+#include <boost/bind/bind.hpp>
 #include <boost/scoped_array.hpp>
 
 #include <oxt/macros.hpp>

data/src/cxx_supportlib/Integrations/LibevJsonUtils.h

@@ -62,7 +62,7 @@ evTimeToJson(ev_tstamp evTime, ev_tstamp evNow, unsigned long long now = 0) {
 
 	Json::Value doc;
 	unsigned long long wallClockTimeUsec = now
-		+ (evTime - evNow) * 1000000ull;
+		+ llround((evTime - evNow) * 1000000);
 	time_t wallClockTime = (time_t) (wallClockTimeUsec / 1000000ull);
 	char buf[32];
 	size_t len;
@@ -79,9 +79,9 @@ evTimeToJson(ev_tstamp evTime, ev_tstamp evNow, unsigned long long now = 0) {
 
 	doc["relative_timestamp"] = evTime - evNow;
 	if (evTime > evNow) {
-		doc["relative"] = distanceOfTimeInWords(evTime, evNow) + " from now";
+		doc["relative"] = distanceOfTimeInWords(llround(evTime), llround(evNow)) + " from now";
 	} else {
-		doc["relative"] = distanceOfTimeInWords(evTime, evNow) + " ago";
+		doc["relative"] = distanceOfTimeInWords(llround(evTime), llround(evNow)) + " ago";
 	}
 	return doc;
 }

data/src/cxx_supportlib/JsonTools/CBindings.cpp

@@ -73,7 +73,6 @@ psg_json_value_new_with_type(PsgJsonValueType type) {
 	default:
 		fprintf(stderr, "BUG: Unrecognized PsgJsonValueType %d\n", (int) type);
 		abort();
-		break;
 	}
 	return new Json::Value(realType);
 }
@@ -164,7 +163,6 @@ psg_json_value_type(const PsgJsonValue *doc) {
 	default:
 		fprintf(stderr, "BUG: Unrecognized Json::ValueType %d\n", (int) cxxdoc.type());
 		abort();
-		return PSG_JSON_VALUE_TYPE_NULL;
 	}
 }
 

data/src/cxx_supportlib/JsonTools/JsonUtils.h

@@ -435,9 +435,9 @@ inline Json::Value
 byteSpeedToJson(double speed, const string &per) {
 	Json::Value doc;
 	if (speed >= 0) {
-		doc = byteSizeToJson(speed);
+		doc = byteSizeToJson(llround(speed));
 	} else {
-		doc = signedByteSizeToJson(speed);
+		doc = signedByteSizeToJson(llround(speed));
 	}
 	doc["per"] = per;
 	return doc;
@@ -449,9 +449,9 @@ byteSpeedToJson(double speed, double nullValue, const string &per) {
 	if (speed == nullValue) {
 		doc["bytes"] = Json::Value(Json::nullValue);
 	} else if (speed >= 0) {
-		doc = byteSizeToJson(speed);
+		doc = byteSizeToJson(llround(speed));
 	} else {
-		doc = signedByteSizeToJson(speed);
+		doc = signedByteSizeToJson(llround(speed));
 	}
 	doc["per"] = per;
 	return doc;

data/src/cxx_supportlib/LoggingKit/Context.h

@@ -70,16 +70,7 @@ public:
 	typedef LoggingKit::ConfigChangeRequest ConfigChangeRequest;
 
 private:
-	Schema schema;
-	mutable boost::mutex syncher;
-	ConfigKit::Store config;
-	boost::atomic<ConfigRealization *> configRlz;
-
-	mutable boost::mutex gcSyncher;
-	oxt::thread *gcThread;
-	boost::condition_variable gcShuttingDownCond, gcHasShutDownCond;
-	queue< pair<ConfigRealization *, MonotonicTimeUsec> > oldConfigs;
-	bool shuttingDown;
+	friend struct ConfigRealization;
 
 	struct TimestampedLog {
 		// time at which time the log entered the core, which is unfortunately somewhat
@@ -97,8 +88,22 @@ private:
 		SimpleLogMap watchFileLog; // a separate log buffer per (watched file name)
 	};
 	typedef StringKeyTable<AppGroupLog> LogStore;
+
+	Schema schema;
+	mutable boost::mutex syncher;
+	ConfigKit::Store config;
+	boost::atomic<ConfigRealization *> configRlz;
 	LogStore logStore;
 
+	mutable boost::mutex gcSyncher;
+	boost::condition_variable gcSyncherCond;
+	oxt::thread *gcThread;
+	std::queue< pair<ConfigRealization *, MonotonicTimeUsec> > oldConfigRlzs;
+	bool gcShuttingDown;
+
+	void freeOldConfigRlzLater(ConfigRealization *oldConfigRlz, MonotonicTimeUsec monotonicNow);
+	void gcThreadMain();
+
 public:
 	Context(const Json::Value &initialConfig = Json::Value(),
 		const ConfigKit::Translator &translator = ConfigKit::DummyTranslator());
@@ -124,22 +129,12 @@ public:
 	const ConfigRealization *getConfigRealization() const {
 		return configRlz.load(boost::memory_order_acquire);
 	}
-
-	void pushOldConfigAndCreateGcThread(ConfigRealization *oldConfigRlz, MonotonicTimeUsec monotonicNow);
-	void gcThreadMain();
-
-private:
-	pair<ConfigRealization*,MonotonicTimeUsec> peekOldConfig();
-	void popOldConfig(ConfigRealization *oldConfig);
-	bool oldConfigsExist();
-	void createGcThread();
-	void killGcThread();
-	void gcLockless(bool wait, boost::unique_lock<boost::mutex> &lock);
 };
 
 
 void initialize(const Json::Value &initialConfig = Json::Value(),
 	const ConfigKit::Translator &translator = ConfigKit::DummyTranslator());
+void shutdown();
 
 
 } // namespace LoggingKit

data/src/cxx_supportlib/LoggingKit/Forward.h

@@ -73,8 +73,6 @@ enum TargetType {
 
 extern Context *context;
 
-void shutdown();
-
 const char *_strdupFastStringStream(const FastStringStream<> &stream);
 bool _passesLogLevel(const Context *context, Level level, const ConfigRealization **outputConfigRlz);
 bool _shouldLogFileDescriptors(const Context *context, const ConfigRealization **outputConfigRlz);

data/src/cxx_supportlib/LoggingKit/Implementation.cpp

@@ -527,29 +527,31 @@ normalizeConfig(const Json::Value &effectiveValues) {
 Context::Context(const Json::Value &initialConfig,
 	const ConfigKit::Translator &translator)
 	: config(schema, initialConfig, translator),
-	  gcThread(NULL),
-	  shuttingDown(false)
+	  gcShuttingDown(false)
 {
 	configRlz.store(new ConfigRealization(config));
 	configRlz.load()->apply(config, NULL);
 	configRlz.load()->finalize();
+	gcThread = new oxt::thread(boost::bind(&Context::gcThreadMain, this),
+		"LoggingKit config garbage collector thread",
+		128 * 1024);
 }
 
 Context::~Context() {
-	boost::unique_lock<boost::mutex> l(gcSyncher);
-
-	// If a gc thread exists, tell it to shut down and
-	// wait until it has done so.
-	shuttingDown = true;
-	gcShuttingDownCond.notify_one();
-	while (gcThread != NULL) {
-		gcHasShutDownCond.wait(l);
+	{
+		boost::unique_lock<boost::mutex> l(gcSyncher);
+		gcShuttingDown = true;
+		gcSyncherCond.notify_one();
 	}
+	gcThread->join();
 
-	killGcThread();
-	gcLockless(false, l);
-
+	delete gcThread;
 	delete configRlz.load();
+
+	while (!oldConfigRlzs.empty()) {
+		delete oldConfigRlzs.front().first;
+		oldConfigRlzs.pop();
+	}
 }
 
 ConfigKit::Store
@@ -596,33 +598,8 @@ Context::inspectConfig() const {
 	return config.inspect();
 }
 
-pair<ConfigRealization*,MonotonicTimeUsec>
-Context::peekOldConfig() {
-	return oldConfigs.front();
-}
-
-void
-Context::popOldConfig(ConfigRealization *oldConfig) {
-	delete oldConfig;
-	oldConfigs.pop();
-}
-
-void
-Context::createGcThread() {
-	if (gcThread == NULL) {
-		try {
-			gcThread = new oxt::thread(boost::bind(&Context::gcThreadMain, this),
-				"LoggingKit config garbage collector thread",
-				128 * 1024);
-		} catch (const std::exception &e) {
-			P_ERROR("Error spawning background thread to garbage collect"
-				" old LoggingKit configuration: " << e.what());
-		}
-	}
-}
-
 void
-Context::pushOldConfigAndCreateGcThread(ConfigRealization *oldConfigRlz, MonotonicTimeUsec monotonicNow) {
+Context::freeOldConfigRlzLater(ConfigRealization *oldConfigRlz, MonotonicTimeUsec monotonicNow) {
 	// Garbage collect old config realization in 5 minutes.
 	// There is no way to cheaply find out whether oldConfigRlz
 	// is still being used (we don't want to resort to more atomic
@@ -630,47 +607,34 @@ Context::pushOldConfigAndCreateGcThread(ConfigRealization *oldConfigRlz, Monoton
 	// waiting 5 minutes should be good enough.
 	MonotonicTimeUsec gcTime = monotonicNow + 5llu * 60llu * 1000000llu;
 	boost::unique_lock<boost::mutex> l(gcSyncher);
-	oldConfigs.push(make_pair(oldConfigRlz, gcTime));
-	createGcThread();
-}
-
-bool
-Context::oldConfigsExist() {
-	return !oldConfigs.empty();
+	oldConfigRlzs.push(make_pair(oldConfigRlz, gcTime));
+	gcSyncherCond.notify_one();
 }
 
 void
 Context::gcThreadMain() {
 	boost::unique_lock<boost::mutex> l(gcSyncher);
-	gcLockless(true, l);
-}
-
-void
-Context::gcLockless(bool wait, boost::unique_lock<boost::mutex> &lock) {
-	while (!shuttingDown && oldConfigsExist()) {
-		pair<ConfigRealization *, MonotonicTimeUsec> p = peekOldConfig();
-		for (MonotonicTimeUsec now = SystemTime::getMonotonicUsecWithGranularity<SystemTime::GRAN_1SEC>();
-			 !shuttingDown && wait && now < p.second;
-			 now = SystemTime::getMonotonicUsecWithGranularity<SystemTime::GRAN_1SEC>())
-		{
-			// Wait until it's time to GC this config object,
-			// or until the destructor tells us that we're shutting down.
-			gcShuttingDownCond.timed_wait(lock, boost::posix_time::microseconds(p.second - now));
+	while (true) {
+		while (oldConfigRlzs.empty() && !gcShuttingDown) {
+			gcSyncherCond.wait(l);
 		}
-		if (!shuttingDown) {
-			popOldConfig(p.first);
+		if (gcShuttingDown) {
+			break;
 		}
-	}
-	killGcThread();
-}
 
-void
-Context::killGcThread() {
-	if (gcThread != NULL) {
-		delete gcThread;
-		gcThread = NULL;
+		pair<ConfigRealization *, MonotonicTimeUsec> p = oldConfigRlzs.front();
+		MonotonicTimeUsec now = SystemTime::getMonotonicUsecWithGranularity<SystemTime::GRAN_1SEC>();
+		// Wait until it's time to GC this config object,
+		// or until the destructor tells us that we're shutting down.
+		while (!gcShuttingDown && now < p.second) {
+			gcSyncherCond.timed_wait(l, boost::posix_time::microseconds(p.second - now));
+			now = SystemTime::getMonotonicUsecWithGranularity<SystemTime::GRAN_1SEC>();
+		}
+		if (!gcShuttingDown) {
+			delete p.first;
+			oldConfigRlzs.pop();
+		}
 	}
-	gcHasShutDownCond.notify_one();
 }
 
 Json::Value
@@ -916,7 +880,7 @@ ConfigRealization::apply(const ConfigKit::Store &config, ConfigRealization *oldC
 
 	if (oldConfigRlz != NULL) {
 		MonotonicTimeUsec monotonicNow = SystemTime::getMonotonicUsecWithGranularity<SystemTime::GRAN_1SEC>();
-		context->pushOldConfigAndCreateGcThread(oldConfigRlz, monotonicNow);
+		context->freeOldConfigRlzLater(oldConfigRlz, monotonicNow);
 	}
 }
 

data/src/cxx_supportlib/MemoryKit/mbuf.cpp

@@ -16,6 +16,7 @@
  * limitations under the License.
  */
 
+#include <cassert>
 #include <cstdlib>
 #include <cstring>
 #include <oxt/macros.hpp>
@@ -110,7 +111,9 @@ _mbuf_block_init(struct mbuf_pool *pool, char *buf, size_t block_offset)
 	 *                                    \
 	 *                                    block
 	 */
-	mbuf_block = (struct mbuf_block *)(buf + block_offset);
+	uintptr_t ptr = reinterpret_cast<uintptr_t>(buf + block_offset);
+	assert(ptr % alignof(struct mbuf_block) == 0);
+	mbuf_block = reinterpret_cast<struct mbuf_block*>(ptr);
 	mbuf_block->magic = MBUF_BLOCK_MAGIC;
 	mbuf_block->pool  = pool;
 	mbuf_block->offset = 0;
@@ -138,7 +141,7 @@ _mbuf_block_get(struct mbuf_pool *pool)
 		return mbuf_block;
 	}
 
-	buf = (char *) malloc(pool->mbuf_block_chunk_size);
+	buf = (char *) aligned_alloc(alignof(struct mbuf_block), pool->mbuf_block_chunk_size);
 	if (OXT_UNLIKELY(buf == NULL)) {
 		return NULL;
 	}
@@ -180,7 +183,10 @@ mbuf_block_new_standalone(struct mbuf_pool *pool, size_t size)
 	char *buf;
 
 	block_offset = std::max<size_t>(size, mbuf_pool_data_size(pool));
-	buf = (char *) malloc(MBUF_BLOCK_HSIZE + block_offset);
+	if (OXT_UNLIKELY(block_offset % alignof(struct mbuf_block) != 0)) {
+		return NULL;
+	}
+	buf = (char *) aligned_alloc(alignof(struct mbuf_block), MBUF_BLOCK_HSIZE + block_offset);
 	if (OXT_UNLIKELY(buf == NULL)) {
 		return NULL;
 	}
@@ -279,7 +285,9 @@ mbuf_pool_init(struct mbuf_pool *pool)
 		TAILQ_INIT(&pool->active_mbuf_blockq);
 	#endif
 
-	pool->mbuf_block_offset = pool->mbuf_block_chunk_size - MBUF_BLOCK_HSIZE;
+	size_t block_offset = pool->mbuf_block_chunk_size - MBUF_BLOCK_HSIZE;
+	assert((block_offset % alignof(struct mbuf_block)) == 0);
+	pool->mbuf_block_offset = block_offset;
 }
 
 void

data/src/cxx_supportlib/MemoryKit/mbuf.h

@@ -108,7 +108,6 @@ struct mbuf_pool {
 #define MBUF_BLOCK_MAGIC      0xdeadbeef
 #define MBUF_BLOCK_MIN_SIZE   512
 #define MBUF_BLOCK_MAX_SIZE   16777216
-#define MBUF_BLOCK_SIZE       16384
 #define MBUF_BLOCK_HSIZE      sizeof(struct mbuf_block)
 
 #define MBUF_BLOCK_EMPTY(mbuf_block) ((mbuf_block)->pos  == (mbuf_block)->last)
@@ -120,6 +119,7 @@ size_t mbuf_pool_data_size(struct mbuf_pool *pool);
 unsigned int mbuf_pool_compact(struct mbuf_pool *pool);
 
 struct mbuf_block *mbuf_block_get(struct mbuf_pool *pool);
+struct mbuf_block *mbuf_block_new_standalone(struct mbuf_pool *pool, size_t size);
 void mbuf_block_put(struct mbuf_block *mbuf_block);
 
 void mbuf_block_ref(struct mbuf_block *mbuf_block);

data/src/cxx_supportlib/ProcessManagement/Utils.cpp

@@ -52,7 +52,7 @@
 #include <ProcessManagement/Utils.h>
 #include <Utils/AsyncSignalSafeUtils.h>
 
-#if defined(__NetBSD__) || defined(__OpenBSD__) || defined(__sun)
+#if defined(__NetBSD__) || defined(__OpenBSD__) || defined(__sun) || defined(__FreeBSD__)
 	// Introduced in Solaris 9. Let's hope nobody actually uses
 	// a version that doesn't support this.
 	#define HAS_CLOSEFROM

data/src/cxx_supportlib/ResourceLocator.h

@@ -175,7 +175,7 @@ public:
 		bool found;
 		try {
 			found = fileExists(path);
-		} catch (const SystemException &e) {
+		} catch (const SystemException&) {
 			found = false;
 		}
 		if (found) {

data/src/cxx_supportlib/SafeLibev.h

@@ -34,7 +34,7 @@
 #include <boost/scoped_ptr.hpp>
 #include <boost/shared_ptr.hpp>
 #include <boost/function.hpp>
-#include <boost/bind.hpp>
+#include <boost/bind/bind.hpp>
 #include <oxt/thread.hpp>
 #include <LoggingKit/LoggingKit.h>
 
@@ -147,9 +147,11 @@ public:
 
 	~SafeLibev() {
 		destroy();
+		#ifdef USE_VENDORED_LIBEV
 		P_LOG_FILE_DESCRIPTOR_CLOSE(ev_loop_get_pipe(loop, 0));
 		P_LOG_FILE_DESCRIPTOR_CLOSE(ev_loop_get_pipe(loop, 1));
 		P_LOG_FILE_DESCRIPTOR_CLOSE(ev_backend_fd(loop));
+		#endif
 		ev_loop_destroy(loop);
 	}
 

data/src/cxx_supportlib/SecurityKit/Crypto.cpp

@@ -73,18 +73,6 @@ CFDictionaryRef Crypto::createQueryDict(const char *label) {
 	return NULL;
 }
 
-OSStatus Crypto::lookupKeychainItem(const char *label, SecIdentityRef *oIdentity) {
-	OSStatus status = errSecItemNotFound;
-
-	CFDictionaryRef queryDict = createQueryDict(label);
-	if (queryDict) {
-		/* Do we have a match? */
-		status = SecItemCopyMatching(queryDict, (CFTypeRef *) oIdentity);
-		CFRelease(queryDict);
-	}
-	return status;
-}
-
 SecAccessRef Crypto::createAccess(const char *cLabel) {
 	SecAccessRef access = NULL;
 	CFStringRef label = CFStringCreateWithCString(NULL, cLabel, kCFStringEncodingUTF8);
@@ -162,85 +150,6 @@ OSStatus Crypto::copyIdentityFromPKCS12File(const char *cPath,
 	return status;
 }
 
-#if PRE_HIGH_SIERRA
-void Crypto::killKey(const char *cLabel) {
-	SecIdentityRef id = NULL;
-	OSStatus status = lookupKeychainItem(cLabel, &id);
-	if (status != errSecItemNotFound) {
-
-		CFArrayRef itemList = CFArrayCreate(NULL, (const void **) &id, 1, NULL);
-		CFTypeRef keys[]   = { kSecClass,  kSecMatchItemList,  kSecMatchLimit };
-		CFTypeRef values[] = { kSecClassCertificate, itemList, kSecMatchLimitOne };
-
-		CFDictionaryRef dict = CFDictionaryCreate(NULL, keys, values, 3L, NULL, NULL);
-		OSStatus oserr = SecItemDelete(dict);
-		if (oserr) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Removing Passenger Cert from keychain failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-					". Please remove the certificate labeled " + cLabel + " in your keychain.");
-			CFRelease(str);
-		}
-		CFRelease(dict);
-		CFRelease(itemList);
-
-		if(id){
-			CFTypeRef keys2[]   = { kSecClass,  kSecAttrSubjectKeyID,  kSecMatchLimit };
-			CFTypeRef values2[] = { kSecClassKey, id, kSecMatchLimitOne };
-			dict = CFDictionaryCreate(NULL, keys2, values2, 3L, NULL, NULL);
-			oserr = SecItemDelete(dict);
-			if (oserr) {
-				CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-				logError(string("Removing Passenger private key from keychain failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-						 ". Please remove the private key from the certificate labeled " + cLabel + " in your keychain.");
-				CFRelease(str);
-			}
-			CFRelease(dict);
-			CFRelease(id);
-			id = NULL;
-		}
-
-	} else {
-		CFStringRef str = SecCopyErrorMessageString(status, NULL);
-		logError(string("Finding Passenger Cert failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) );
-		CFRelease(str);
-	}
-}
-
-bool Crypto::preAuthKey(const char *path, const char *passwd, const char *cLabel) {
-	SecIdentityRef id = NULL;
-	if (lookupKeychainItem(cLabel, &id) == errSecItemNotFound) {
-		OSStatus oserr = SecKeychainSetUserInteractionAllowed(false);
-		if (oserr) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Disabling GUI Keychain interaction failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8));
-			CFRelease(str);
-		}
-		oserr = copyIdentityFromPKCS12File(path, passwd, cLabel);
-		bool success = (noErr == oserr);
-		if (!success) {
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Pre authorizing the Passenger client certificate failed: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8));
-			CFRelease(str);
-		}
-		oserr = SecKeychainSetUserInteractionAllowed(true);
-		if (oserr) {
-			//This is really bad, we should probably ask the user to reboot.
-			CFStringRef str = SecCopyErrorMessageString(oserr, NULL);
-			logError(string("Re-enabling GUI Keychain interaction failed with error: ") + CFStringGetCStringPtr(str, kCFStringEncodingUTF8) +
-					" Please reboot as soon as possible, thanks.");
-			CFRelease(str);
-		}
-		return success;
-	} else {
-		logError(string("Passenger client certificate was found in the keychain unexpectedly, skipping security update check. Please remove the private key from the certificate labeled ") + cLabel + " in your keychain.");
-		if (id) {
-			CFRelease(id);
-		}
-		return false;
-	}
-}
-#endif
-
 bool Crypto::generateRandomChars(unsigned char *rndChars, int rndLen) {
 	FILE *fPtr = fopen("/dev/random", "r");
 	if (fPtr == NULL) {
@@ -546,7 +455,7 @@ bool Crypto::verifySignature(string signaturePubKeyPath, char *signatureChars, i
 
 		CFDataRef signatureRef = CFDataCreateWithBytesNoCopy(NULL, (UInt8*) signatureChars, signatureLen, kCFAllocatorNull);
 
-		CFDataRef dataRef = CFDataCreateWithBytesNoCopy(NULL, (UInt8*) data.c_str(), data.length(), kCFAllocatorNull);
+		CFDataRef dataRef = CFDataCreateWithBytesNoCopy(NULL, reinterpret_cast<const UInt8*>(data.c_str()), data.length(), kCFAllocatorNull);
 
 		CFErrorRef error = NULL;
 		verifier = SecVerifyTransformCreate(rsaPubKey, signatureRef, &error);
@@ -609,7 +518,7 @@ PUBKEY_TYPE Crypto::loadPubKey(const char *filename) {
 	CFArrayRef temparray = NULL;
 	do {
 		url = CFURLCreateFromFileSystemRepresentation(kCFAllocatorDefault,
-													  (UInt8*) filename, strlen(filename), false);
+													  reinterpret_cast<const UInt8*>(filename), strlen(filename), false);
 		if (url == NULL) {
 			logError("CFURLCreateFromFileSystemRepresentation failed.");
 			break;
@@ -655,7 +564,7 @@ PUBKEY_TYPE Crypto::loadPubKey(const char *filename) {
 			CFRelease(str);
 			break;
 		}
-		pubKey = (SecKeyRef) CFArrayGetValueAtIndex(temparray, 0);
+		pubKey = reinterpret_cast<SecKeyRef>(const_cast<void*>(CFArrayGetValueAtIndex(temparray, 0)));
 		CFRetain(pubKey); //bump ref count, now we own this and need to release it eventually
 	} while (0);
 

data/src/cxx_supportlib/SecurityKit/Crypto.h

@@ -90,7 +90,6 @@ private:
 	void logFreeErrorExtended(const StaticString &prefix, CFErrorRef &additional);
 	CFDictionaryRef createQueryDict(const char *label);
 	SecAccessRef createAccess(const char *cLabel);
-	OSStatus lookupKeychainItem(const char *label, SecIdentityRef *oIdentity);
 	OSStatus copyIdentityFromPKCS12File(const char *cPath, const char *cPassword, const char *cLabel);
 	CFDataRef genIV(size_t iv_size);
 	bool getKeyBytes(SecKeyRef cryptokey, void **target, size_t &len);
@@ -110,13 +109,6 @@ public:
 	bool generateAndAppendNonce(string &nonce);
 
 #if BOOST_OS_MACOS
-#if PRE_HIGH_SIERRA
-	/**
-	 * sets the permissions on the certificate so that curl doesn't prompt
-	 */
-	bool preAuthKey(const char *path, const char *passwd, const char *cLabel);
-	void killKey(const char *cLabel);
-#endif
 	bool generateRandomChars(unsigned char *rndChars, int rndLen);
 #endif
 

data/src/cxx_supportlib/ServerKit/AcceptLoadBalancer.h

@@ -26,7 +26,7 @@
 #ifndef _PASSENGER_SERVER_KIT_ACCEPT_LOAD_BALANCER_H_
 #define _PASSENGER_SERVER_KIT_ACCEPT_LOAD_BALANCER_H_
 
-#include <boost/bind.hpp>
+#include <boost/bind/bind.hpp>
 #include <boost/cstdint.hpp>
 #include <oxt/thread.hpp>
 #include <oxt/macros.hpp>

data/src/cxx_supportlib/ServerKit/Context.h

@@ -83,6 +83,12 @@ public:
 		}
 
 		mbuf_pool.mbuf_block_chunk_size = configStore["mbuf_block_chunk_size"].asUInt();
+		if ((mbuf_pool.mbuf_block_chunk_size - sizeof(struct MemoryKit::mbuf_block)) % alignof(struct MemoryKit::mbuf_block) != 0) {
+			throw RuntimeException("mbuf_block_chunk_size(" +
+								   toString(mbuf_pool.mbuf_block_chunk_size) +
+								   ") - " + toString(sizeof(struct MemoryKit::mbuf_block)) +
+								   " must be a multiple of " + toString(alignof(struct MemoryKit::mbuf_block)));
+		}
 		MemoryKit::mbuf_pool_init(&mbuf_pool);
 	}