passenger 4.0.36 → 4.0.37

checksums.yaml

@@ -1,15 +1,15 @@
 ---
 !binary "U0hBMQ==":
   metadata.gz: !binary |-
-    YTQyM2E1ZmM5N2JlM2VlZjY5ZjUwZWUyZTU5NWFlZDZlZWE3NGU0Yg==
+    NzY2YjMwZGFkMjkzNDNlMjgwYWIwZjM0OTk4OTEzZDczYmNhZTUxNw==
   data.tar.gz: !binary |-
-    YWZiMzg5YmI0MDEyOTRhZDBmZTg1ODNjZGRlMjk2MTFjNDgxNWI2Ng==
+    NjMwYmQ4ZWM4ZWZkOTc1OWY2NTk0OGFjYTdjYjllZGE0ZWFkMTlhMQ==
 SHA512:
   metadata.gz: !binary |-
-    NDYyNjlkYTdlMjY0ZmM0ODYyODk3NmQ5NjdlZjhiMGE0NjgwMTk2ZTAzNTg1
-    ZjRkNWEwNmM5M2Y2YzBhZTFkZTllNGVkZWI4YjVlYTU3MGIyNGU3NTEyYmJi
-    ZjllODk5M2Q0ZjVjOGY4OGQxYzE2NGIzNTEyNmUzZWYzZGIzM2Q=
+    ZWY2OGFiZTMxNTMxMmNkZGFhYTQ4Nzk3OWM4MTNlNjJjZGQ1MDkwZTA0ZTNl
+    MDY2N2FhOWFkNjdkYWYzYTgzNzMxMmE5ZGMzNjU2MmUwYjA4MDRlMDZmZDg2
+    YTk1MTlmMjJmYmI5OWQ0ZjU4YzU5MDI0M2ZkMzU2NGRkNWU5Mzk=
   data.tar.gz: !binary |-
-    NTkwMTZmMzIzNWM1YTk3NTA1NTMzYmZjNGZmNjc5ZmY0MTQ2NGNiZmQxYTI2
-    MGFlNjMzZGE0YTE5NWQxNjhlYjA0NmY2NzQzNDc0NTU3ZTVmOTk0OGFmNDdl
-    YWU1MTc0Y2UxZTkxMjMyY2UxMjFlMTdjZmQ2OTg0OTEyM2Y3NzQ=
+    ODFhMDg0OWU1YmY2MjRiNWZjYjFkY2ZjN2MwMTZhYjA5YmNjM2E3ZDMwNTMx
+    M2ExZDYxZGQyNWQ2ZjFjNzA4MDhjZjIzMzA5YTQyN2E1MjVmOTQyMzU4YzBi
+    OGM2NDliMWNkMjQwYTBhYmFhNzhmZTZkNTUyMTVjMWE2Nzc3NTM=

checksums.yaml.gz.asc

@@ -2,11 +2,11 @@
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 
-iQEcBAABAgAGBQJS4syLAAoJECrHRaUKISqMsVsIAIfwEwJO7MHIz8Q1ct4QuKHC
-Ll99P56zwQ/trV4PyAEDC1NB9cpbf85vzA+45hlFx6iMqN9oLA33eQVoVvKtI3qG
-lBtC4SIdWRvQZBoBhTgDjmzDzGGc3UHtc9siAaxty7a2vkGZBqKXpX/okS6DYAV0
-TfoH8ImWg/2qBVFffKLv2ApRcMcjXdh+C0rGtLOTzU4AiTrIlFytQkDBZuMtsZOp
-B2jHoLhyzzZ1ZHkUpxMDA2S9jiLbzh+MQ93/kNe1eDa6WH7Gz1Z9GXGNSwo1behJ
-b9gp40pdnIxFFuPphiRevfrcCEprGi7a2s5q3sdYF7UVNRQBbuyauXUSI4K3a24=
-=zcR9
+iQEcBAABAgAGBQJS6CPIAAoJECrHRaUKISqMBzMIAJc+WtmkHIzclF/yuMagWa40
+0p9dz6CINEmYQ4gCabMeRhBa/VeQauXhvR3d2cm7TyCyLqfoN6YLHnesVwGGI2vu
+Kt5HbgOYGTT6cyf8QmGjubNC+VslKTZIyoapRigRRtX10tLsvAYyC9WnaOMGikWS
+OKpNucWMA7UnXfsfyNa/u4L0c+pNI15DM5asjMPG46QHiYDfAKIhRzGTRovjBAOW
+WaLu+qtfMJ9ui261i9KBJuPjIbbIeHZQeGDA70tvnm6na5W8A11XilYav4T8Qcv+
+fGoDcJ88M6q3cYspeOJPsEEICFHvhjQ0wMm5qT/YHhLd1dqxapCidmj+nqFwxuQ=
+=6pys
 -----END PGP SIGNATURE-----

data.tar.gz.asc

@@ -2,11 +2,11 @@
 Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
 Comment: GPGTools - http://gpgtools.org
 
-iQEcBAABAgAGBQJS4syKAAoJECrHRaUKISqM92QH/2/DJsZccgKyRyhPpBF8Bl41
-zhKzJTnxddS7Q/qd5N+NL1Xqp3+P0crS8CHHV+QNjZh6jXWBBGe+1Ftcp3TZGxpw
-EYFzDkX8bIQQ83RxwCYah2Vj/uGuy7XKlDk0kEMSNeLlVOmBWR1yi78DomFJzcXc
-wPsvwRr8ZYr3++2o61LeReEhPjNSMb+tlzb3sIDrKsAMx9B0012RGFc8t9bb2Qny
-9bTmJSKj8cwCBmyFvvM+Dh6wfse3wCHT6/rH0n7K40l85NNftidwUI0zhYUC3/8H
-Y7TcFqFBq5NzNrYlMcsyzsteePOd5HW7c6NSiGIuu6zFfLGEETWP5W5fdsps6ok=
-=4drC
+iQEcBAABAgAGBQJS6CPIAAoJECrHRaUKISqMvrEIAKw15y9cgHaX26Mh6AYj+Bj1
+jQ2aTpVBoNwhxX6dGEvLhpxxknTmvaryffRxYJX7eE8JJKP526RzJogkbgBMktqY
+vxSRNSzpZpvoEztvpiy+UGVtgaUjTEaIFl9daOQbWxQkiLmvglRPMBFu7j30fU9B
+56vdqzGxqZ9eSHMqd3B+kVSnpoiVOgRCigVocU/hoblLBDankxuzNkj6tAtlX+G3
+zmX0QZ+QBfWDqEvw2mVbXIQFwz9+tMCnybEctz5VJIPHaO8cco129jXYo+hcdu1Q
+EUlt3bcb0/w7a2giU2WuzYdRJqQFdTF24XOOwLozx0Kf8HizpQCU7dJaz3hE79E=
+=0LER
 -----END PGP SIGNATURE-----

data/NEWS

@@ -1,3 +1,54 @@
+Release 4.0.37
+--------------
+
+ * Improved Node.js compatibility. Calling on() on the request object
+   now returns the request object itself. This fixes some issues with
+   Express, Connect and Formidable. Furthermore, some WebSocket-related
+   issues have been fixed.
+ * Improved Meteor support. Meteor application processes are now shut down
+   quicker. Previously, they linger around for 5 seconds while waiting for
+   all connections to terminate, but that didn't work well because WebSocket
+   connections were kept open indefinitely. Also, some WebSocket-related
+   issues have been fixed.
+ * Introduced a new tool `passenger-config detach-process` for gracefully
+   detaching an application process from the process pool. Has a similar
+   effect to killing the application process directly with `kill <PID>`,
+   but killing directly may cause the HTTP client to see an error, while
+   using this command guarantees that clients see no errors.
+ * Fixed a crash occurs when an application fails to spawn, but the HTTP
+   client disconnects before the error page is generated. Fixes issue #1028.
+ * Fixed a symlink-related security vulnerability.
+
+   Urgency: low
+   Scope: local exploit
+   Summary: writing files to arbitrary directory by hijacking temp directories
+   Affected versions: 4.0.5 and later
+   Fixed versions: 4.0.37
+
+   Description:
+   Phusion Passenger creates a "server instance directory" in /tmp during startup,
+   which is a temporary directory that Phusion Passenger uses to store working files.
+   This directory is deleted after Phusion Passenger exits. For various technical
+   reasons, this directory must have a semi-predictable filename. If a local attacker
+   can predict this filename, and precreates a symlink with the same filename that
+   points to an arbitrary directory with mode 755, owner root and group root, then
+   the attacker will succeed in making Phusion Passenger write files and create
+   subdirectories inside that target directory. The following files/subdirectories
+   are created:
+
+    * control_process.pid
+    * generation-X, where X is a number.
+
+   If you happen to have a file inside the target directory called `control_process.pid`,
+   then that file's contents are overwritten.
+
+   These files and directories are deleted during Phusion Passenger exit. The target
+   directory itself is not deleted, nor are any other contents inside the target
+   directory, although the symlink is.
+
+   Thanks go to Jakub Wilk for discovering this issue.
+
+
 Release 4.0.36
 --------------
 

data/README.md

@@ -4,9 +4,11 @@
 
 What makes it so fast and reliable is its **C++** core, its **zero-copy** architecture, its **watchdog** system and its **hybrid** evented, multi-threaded and multi-process design.
 
+<a href="http://vimeo.com/phusionnl/review/80475623/c16e940d1f"><img src="http://blog.phusion.nl/wp-content/uploads/2014/01/gameofthrones.jpg" height="300"></a><br><em>Phusion Passenger used in Game of Thrones Ascention</em>
+
 **Learn more:** [Website](https://www.phusionpassenger.com/) | [Documentation](https://www.phusionpassenger.com/documentation_and_support) | [Support resources](https://www.phusionpassenger.com/documentation_and_support) | [Github](https://github.com/phusion/passenger) | [Twitter](https://twitter.com/phusion_nl) | [Blog](http://blog.phusion.nl/)
 
-<center><img src="http://blog.phusion.nl/wp-content/uploads/2012/07/Passenger_chair_256x256.jpg" width="160" height="160" alt="Phusion Passenger"></center>
+<a href="https://www.phusionpassenger.com"><center><img src="http://blog.phusion.nl/wp-content/uploads/2012/07/Passenger_chair_256x256.jpg" width="160" height="160" alt="Phusion Passenger"></center></a>
 
 ## Installation
 

data/build/integration_tests.rb

@@ -59,7 +59,11 @@ task 'test:integration:nginx' => dependencies do
 			require 'shellwords'
 			command << " -e #{Shellwords.escape(grep)}"
 		end
-		sh "cd test && exec #{command}"
+		repeat = true
+		while repeat
+			sh "cd test && exec #{command}"
+			repeat = boolean_option('REPEAT')
+		end
 	end
 end
 

data/build/test_basics.rb

@@ -1,5 +1,5 @@
 #  Phusion Passenger - https://www.phusionpassenger.com/
-#  Copyright (c) 2010-2013 Phusion
+#  Copyright (c) 2010-2014 Phusion
 #
 #  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
 #
@@ -77,6 +77,6 @@ task 'test:install_deps' do
                 end
 	end
 	if boolean_option('NODE_MODULES', default)
-		sh "npm install mocha should sinon"
+		sh "npm install mocha should sinon express"
 	end
 end

data/dev/run_travis.sh

@@ -111,6 +111,7 @@ fi
 
 if [[ "$TEST_NGINX" = 1 ]]; then
 	install_base_test_deps
+	install_node_and_modules
 	run ./bin/passenger-install-nginx-module --auto --prefix=/tmp/nginx --auto-download
 	run rake test:integration:nginx
 fi
@@ -120,6 +121,7 @@ if [[ "$TEST_APACHE2" = 1 ]]; then
 	run sudo apt-get install -y --no-install-recommends \
 		apache2-mpm-worker apache2-threaded-dev
 	install_base_test_deps
+	install_node_and_modules
 	run ./bin/passenger-install-apache2-module --auto #--no-update-config
 	run rvmsudo ./bin/passenger-install-apache2-module --auto --no-compile
 	run rake test:integration:apache2
@@ -137,6 +139,7 @@ if [[ "$TEST_DEBIAN_PACKAGING" = 1 ]]; then
 		ruby1.8 ruby1.8-dev ruby1.9.1 ruby1.9.1-dev rubygems libev-dev gdebi-core \
 		source-highlight
 	install_test_deps_with_doctools
+	install_node_and_modules
 	run rake debian:dev debian:dev:reinstall
 	run rake test:integration:native_packaging SUDO=1
 	run env PASSENGER_LOCATION_CONFIGURATION_FILE=/usr/lib/ruby/vendor_ruby/phusion_passenger/locations.ini \

data/doc/Users guide Nginx.txt

@@ -561,9 +561,9 @@ server {
 ==== passenger_ruby <filename>
 The `passenger_ruby` option allows one to specify the Ruby interpreter to use. Similarly, the `passenger_python` and `passenger_nodejs` options are for specifying the Python interpreter and Node.js commands, respectively.
 
-In versions prior to 4.0.0, only a single Ruby version was supported for the entire Nginx instance, so `passenger_ruby` may only occur in the global server configuration. Also, the `passenger_python` option was not supported.
+In versions prior to 4.0.0, only a single Ruby version was supported for the entire Nginx instance, so `passenger_ruby` may only occur in the global server configuration. Also, the `passenger_python`/`passenger_nodejs` options were not supported.
 
-Since version 4.0.0, the `passenger_python` option was added. Also, Phusion Passenger supports multiple Ruby or Python interpreters in the same Nginx instance. And so, since version 4.0.0, this option may occur in the following places:
+Since version 4.0.0, Phusion Passenger supports multiple Ruby interpreters in the same Nginx instance. And so, since version 4.0.0, this option may occur in the following places:
 
  * In the 'http' configuration block.
  * In a 'server' configuration block.
@@ -574,7 +574,7 @@ The `passenger_ruby` in the `http` block - that is, the one that `passenger-inst
 
 The `passenger_ruby` directive in the `http` block is also used as the default Ruby interpreter for Ruby web apps. You don't *have* to specify a `passenger_ruby` in the `http` block though, because the default is to use the first `ruby` command found in `$PATH`.
 
-The `passenger_python` and `passenger_nodejs` options works in a similar manner, but apply to Python and Node.js instead.
+The `passenger_python` and `passenger_nodejs` options work in a similar manner, but apply to Python and Node.js instead.
 
 You can also override `passenger_ruby` and other directives in specific contexts if you want to use a different interpreter for that web app. For example:
 

data/ext/common/ApplicationPool2/Group.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2013 Phusion
+ *  Copyright (c) 2011-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -510,6 +510,7 @@ public:
 		} else if (&destination == &detachedProcesses) {
 			assert(process->isAlive());
 			process->enabled = Process::DETACHED;
+			process->abortLongRunningConnections();
 		} else {
 			P_BUG("Unknown destination list");
 		}

data/ext/common/ApplicationPool2/Implementation.cpp

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2013 Phusion
+ *  Copyright (c) 2011-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -35,6 +35,7 @@
 #include <Exceptions.h>
 #include <MessageReadersWriters.h>
 #include <Utils/ScopeGuard.h>
+#include <Utils/MessageIO.h>
 
 namespace Passenger {
 namespace ApplicationPool2 {
@@ -1225,12 +1226,40 @@ Group::generateSecret(const SuperGroupPtr &superGroup) {
 }
 
 
+PoolPtr
+Process::getPool() const {
+	assert(getLifeStatus() != DEAD);
+	return getGroup()->getPool();
+}
+
 SuperGroupPtr
 Process::getSuperGroup() const {
 	assert(getLifeStatus() != DEAD);
 	return getGroup()->getSuperGroup();
 }
 
+void
+Process::sendAbortLongRunningConnectionsMessage(const string &address) {
+	boost::function<void ()> func = boost::bind(
+		realSendAbortLongRunningConnectionsMessage, address);
+	return getPool()->nonInterruptableThreads.create_thread(
+		boost::bind(runAndPrintExceptions, func, false),
+		"Sending detached message to process " + toString(pid),
+		256 * 1024);
+}
+
+void
+Process::realSendAbortLongRunningConnectionsMessage(string address) {
+	TRACE_POINT();
+	FileDescriptor fd(connectToServer(address));
+	unsigned long long timeout = 3000000;
+	vector<string> args;
+
+	UPDATE_TRACE_POINT();
+	args.push_back("abort_long_running_connections");
+	writeArrayMessage(fd, args, &timeout);
+}
+
 string
 Process::inspect() const {
 	assert(getLifeStatus() != DEAD);

data/ext/common/ApplicationPool2/Pool.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2013 Phusion
+ *  Copyright (c) 2011-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -149,6 +149,7 @@ public:
 
 	enum LifeStatus {
 		ALIVE,
+		PREPARED_FOR_SHUTDOWN,
 		SHUTTING_DOWN,
 		SHUT_DOWN
 	} lifeStatus;
@@ -953,6 +954,7 @@ public:
 		}
 	}
 
+	/** Must be called right after construction. */
 	void initialize() {
 		LockGuard l(syncher);
 		interruptableThreads.create_thread(
@@ -972,10 +974,31 @@ public:
 		debugSupport = boost::make_shared<DebugSupport>();
 	}
 
-	void destroy() {
+	/** Should be called right after the HelperAgent has received
+	 * the message to exit gracefully. This will tell processes to
+	 * abort any long-running connections, e.g. WebSocket connections,
+	 * because the RequestHandler has to wait until all connections are
+	 * finished before proceeding with shutdown.
+	 */
+	void prepareForShutdown() {
 		TRACE_POINT();
 		ScopedLock lock(syncher);
 		assert(lifeStatus == ALIVE);
+		lifeStatus = PREPARED_FOR_SHUTDOWN;
+		vector<ProcessPtr> processes = getProcesses(false);
+		foreach (ProcessPtr process, processes) {
+			if (process->abortLongRunningConnections()) {
+				// Ensure that the process is not immediately respawned.
+				process->getGroup()->options.minProcesses = 0;
+			}
+		}
+	}
+
+	/** Must be called right before destruction. */
+	void destroy() {
+		TRACE_POINT();
+		ScopedLock lock(syncher);
+		assert(lifeStatus == ALIVE || lifeStatus == PREPARED_FOR_SHUTDOWN);
 
 		lifeStatus = SHUTTING_DOWN;
 
@@ -1004,7 +1027,7 @@ public:
 	void asyncGet(const Options &options, const GetCallback &callback, bool lockNow = true) {
 		DynamicScopedLock lock(syncher, lockNow);
 
-		assert(lifeStatus == ALIVE);
+		assert(lifeStatus == ALIVE || lifeStatus == PREPARED_FOR_SHUTDOWN);
 		verifyInvariants();
 		P_TRACE(2, "asyncGet(appGroupName=" << options.getAppGroupName() << ")");
 		vector<Callback> actions;

data/ext/common/ApplicationPool2/Process.h

@@ -1,6 +1,6 @@
 /*
  *  Phusion Passenger - https://www.phusionpassenger.com/
- *  Copyright (c) 2011-2013 Phusion
+ *  Copyright (c) 2011-2014 Phusion
  *
  *  "Phusion Passenger" is a trademark of Hongli Lai & Ninh Bui.
  *
@@ -113,20 +113,21 @@ public:
  * ## Life time
  *
  * A Process object lives until the containing Group calls `detach(process)`,
- * which indicates that it wants this Process to should down. This causes
- * the Process to enter the `detached() == true` state. Processes in this
- * state are stored in the `detachedProcesses` collection in the Group and
- * are no longer eligible for receiving requests. They will be removed from
- * the Group and destroyed when all of the following applies:
- * 
- *  1. the OS process is gone.
- *  2. `sessions == 0`
+ * which indicates that it wants this Process to shut down. This causes
+ * `signalDetached()` to be called, which may or may not send a message
+ * to the process. After this, the Process object is stored in the
+ * `detachedProcesses` collection in the Group and are no longer eligible for
+ * receiving requests. Once all requests on this Process have finished,
+ * `triggerShutdown()` will be called, which will send a message to the
+ * process telling it to shut down. Once the process is gone, `cleanup()` is
+ * called, and the Process object is removed from the collection.
  *
  * This means that a Group outlives all its Processes, a Process outlives all
  * its Sessions, and a Process also outlives the OS process.
  */
 class Process: public boost::enable_shared_from_this<Process> {
-private:
+// Actually private, but marked public so that unit tests can access the fields.
+public:
 	friend class Group;
 	
 	/** A mutex to protect access to `lifeStatus`. */
@@ -147,6 +148,9 @@ private:
 	/** The handle inside the associated Group's process priority queue. */
 	PriorityQueue<Process>::Handle pqHandle;
 
+	void sendAbortLongRunningConnectionsMessage(const string &address);
+	static void realSendAbortLongRunningConnectionsMessage(string address);
+
 	static bool
 	isZombie(pid_t pid) {
 		string filename = "/proc/" + toString(pid) + "/status";
@@ -308,6 +312,7 @@ public:
 	} oobwStatus;
 	/** Caches whether or not the OS process still exists. */
 	mutable bool m_osProcessExists;
+	bool longRunningConnectionsAborted;
 	/** Time at which shutdown began. */
 	time_t shutdownStartTime;
 	/** Collected by Pool::collectAnalytics(). */
@@ -346,6 +351,7 @@ public:
 		  enabled(ENABLED),
 		  oobwStatus(OOBW_NOT_ACTIVE),
 		  m_osProcessExists(true),
+		  longRunningConnectionsAborted(false),
 		  shutdownStartTime(0)
 	{
 		SpawnerConfigPtr config;
@@ -408,6 +414,13 @@ public:
 		this->group = group;
 	}
 
+	/**
+	 * Thread-safe.
+	 * @pre getLifeState() != DEAD
+	 * @post result != NULL
+	 */
+	PoolPtr getPool() const;
+
 	/**
 	 * Thread-safe.
 	 * @pre getLifeState() != DEAD
@@ -439,6 +452,22 @@ public:
 		return lifeStatus;
 	}
 
+	bool abortLongRunningConnections() {
+		bool sent = false;
+		if (!longRunningConnectionsAborted) {
+			SocketList::iterator it, end = sockets->end();
+			for (it = sockets->begin(); it != end; it++) {
+				Socket *socket = &(*it);
+				if (socket->name == "control") {
+					sendAbortLongRunningConnectionsMessage(socket->address);
+					sent = true;
+				}
+			}
+			longRunningConnectionsAborted = true;
+		}
+		return sent;
+	}
+
 	bool canTriggerShutdown() const {
 		return getLifeStatus() == ALIVE && sessions == 0;
 	}

data/ext/common/Constants.h

@@ -88,7 +88,7 @@
 
 	#define NGINX_DOC_URL "http://www.modrails.com/documentation/Users%20guide%20Nginx.html"
 
-	#define PASSENGER_VERSION "4.0.36"
+	#define PASSENGER_VERSION "4.0.37"
 
 	#define POOL_HELPER_THREAD_STACK_SIZE 262144