On some Python 3.11 systems, 3.11.9 & 3.11.10, we were seeing a crash
triggered by Py_Finalize() in nxt_python_atexit() when running one of
our pytests, namely
test/test_python_factory.py::test_python_factory_invalid_callable_value

  2024/09/12 15:07:29 [alert] 5452#5452 factory "wsgi_invalid_callable" in module "wsgi" can not be called to fetch callable
  Fatal Python error: none_dealloc: deallocating None: bug likely caused by a refcount error in a C extension
  Python runtime state: finalizing (tstate=0x00007f560b88a718)

  Current thread 0x00007f560bde7ad0 (most recent call first):
    <no Python frame>
  2024/09/12 15:07:29 [alert] 5451#5451 app process 5452 exited on signal 6 (core dumped)

This was due to

  obj = PyDict_GetItemString(PyModule_GetDict(module), callable);

in nxt_python_set_target() which returns a *borrowed* reference, then
due to the test meaning this is a `None` object we `goto fail` and call

  Py_DECREF(obj);

which then causes `Py_Finalize()` to blow up.

The simple fix is to just increment its reference count before the `goto
fail`.

Note: This problem only showed up under (the various versions of Python
we test on); 3.11.9 & 3.11.10. It doesn't show up under; 3.6, 3.7, 3.9,
3.10, 3.12

Cc: Konstantin Pavlov <thresh@nginx.com>
Closes: https://github.com/nginx/unit/issues/1413
Fixes: a9aa9e76d ("python: Support application factories")
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>

When the client closes the connection before the upstream,
the proxy's error handler was calling cleanup operation like
peer close and request close twice, this fix ensures the cleanup
is performed only once, improving proxy stability.

Closes: https://github.com/nginx/unit/issues/828

While the C based wasm language module inherits the process environment
the Rust based wasm-wasi-component language module did not.

One upshot of this is that with wasm-wasi-component you don't get access
to any environment variables specified in the Unit configuration.

wasm-wasi-component was based on wasmtime 17.0.0. This capability wasn't
added to the wasmtime-crate until version 20.0.0.

Now that wasm-wasi-component has been updated to a newer wasmtime-crate
we can enable this functionality.

Closes: https://github.com/nginx/unit/issues/1312
[ Commit message - Andrew ]
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>

Signed-off-by: Ava Hahn <a.hahn@f5.com>

This was found via ASan.

Given a listener address like ":" (or any address where the first
character is a colon) we can end up under-reading the addr->start
buffer here

  if (nxt_slow_path(*(buf + length - 1) == '.')) {

due to length (essentially the position of the ":" in the string) being
0.

Seeing as any address that starts with a ":" is invalid Unit config
wise, we should simply reject the address if length == 0 in
nxt_sockaddr_inet_parse().

Link: <https://clang.llvm.org/docs/AddressSanitizer.html>
Signed-off-by: Arjun <pkillarjun@protonmail.com>
[ Commit message - Andrew ]
Signed-off-by: Andrew Clayton <a.clayton@nginx.com>

This feature allows users to specify conditions to check if one
route is matched. It is used the same way as the "if" option in
the access log.

Example:

    {
        "match": {
            "if": "`${headers['User-Agent'].split('/')[0] == 'curl'}`"
        },
        "action": {
            "return": 204
        }
    }

This nxt_tstr_cond_t will be reused for the feature of adding "if"
option to the "match" object. The two "if" options have the same usage.