nginx · pchickey · Aug 20, 2025
diff --git a/Cargo.toml b/Cargo.toml
@@ -12,6 +12,10 @@ homepage = "https://github.com/nginx/ngx-rust"
 repository = "https://github.com/nginx/ngx-rust"
 rust-version = "1.81.0"
 
+[workspace.lints.rust]
+rust-2024-compatibility = "warn"
+edition-2024-expr-fragment-specifier = "allow"
+
 [package]
 name = "ngx"
 version = "0.5.0-beta"
@@ -70,3 +74,6 @@ maintenance = { status = "experimental" }
 
 [dev-dependencies]
 tempfile = { version = "3.20.0", default-features = false }
+
+[lints]
+workspace = true
diff --git a/examples/Cargo.toml b/examples/Cargo.toml
@@ -65,3 +65,6 @@ default = ["export-modules", "ngx/vendored"]
 # See https://github.com/rust-lang/rust/issues/20267
 export-modules = []
 linux = []
+
+[lints]
+workspace = true
diff --git a/examples/async.rs b/examples/async.rs
@@ -24,19 +24,21 @@ impl http::HttpModule for Module {
     }
 
     unsafe extern "C" fn postconfiguration(cf: *mut ngx_conf_t) -> ngx_int_t {
-        // SAFETY: this function is called with non-NULL cf always
-        let cf = &mut *cf;
-        let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
-
-        let h = ngx_array_push(
-            &mut cmcf.phases[ngx_http_phases_NGX_HTTP_ACCESS_PHASE as usize].handlers,
-        ) as *mut ngx_http_handler_pt;
-        if h.is_null() {
-            return core::Status::NGX_ERROR.into();
+        unsafe {
+            // SAFETY: this function is called with non-NULL cf always
+            let cf = &mut *cf;
+            let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
+
+            let h = ngx_array_push(
+                &mut cmcf.phases[ngx_http_phases_NGX_HTTP_ACCESS_PHASE as usize].handlers,
+            ) as *mut ngx_http_handler_pt;
+            if h.is_null() {
+                return core::Status::NGX_ERROR.into();
+            }
+            // set an Access phase handler
+            *h = Some(async_access_handler);
+            core::Status::NGX_OK.into()
         }
-        // set an Access phase handler
-        *h = Some(async_access_handler);
-        core::Status::NGX_OK.into()
     }
 }
 
@@ -98,16 +100,16 @@ impl http::Merge for ModuleConfig {
 
 unsafe extern "C" fn check_async_work_done(event: *mut ngx_event_t) {
     let ctx = ngx::ngx_container_of!(event, RequestCTX, event);
-    let c: *mut ngx_connection_t = (*event).data.cast();
+    let c: *mut ngx_connection_t = unsafe { (*event).data.cast() };
 
-    if (*ctx).done.load(Ordering::Relaxed) {
+    if unsafe { (*ctx).done.load(Ordering::Relaxed) } {
         // Triggering async_access_handler again
-        ngx_post_event((*c).write, addr_of_mut!(ngx_posted_events));
+        unsafe { ngx_post_event((*c).write, addr_of_mut!(ngx_posted_events)) };
     } else {
         // this doesn't have have good performance but works as a simple thread-safe example and
         // doesn't causes segfault. The best method that provides both thread-safety and
         // performance requires an nginx patch.
-        ngx_post_event(event, addr_of_mut!(ngx_posted_next_events));
+        unsafe { ngx_post_event(event, addr_of_mut!(ngx_posted_next_events)) };
     }
 }
 

diff --git a/examples/awssig.rs b/examples/awssig.rs
@@ -1,3 +1,8 @@
+// Allow following allow to work in MSRV 1.81
+#![allow(unknown_lints)]
+// Suppress spurrions lint for 2024 compatibility
+#![allow(tail_expr_drop_order)]
+
 use std::ffi::{c_char, c_void};
 
 use http::HeaderMap;
@@ -19,19 +24,21 @@ impl HttpModule for Module {
     }
 
     unsafe extern "C" fn postconfiguration(cf: *mut ngx_conf_t) -> ngx_int_t {
-        // SAFETY: this function is called with non-NULL cf always
-        let cf = &mut *cf;
-        let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
-
-        let h = ngx_array_push(
-            &mut cmcf.phases[ngx_http_phases_NGX_HTTP_PRECONTENT_PHASE as usize].handlers,
-        ) as *mut ngx_http_handler_pt;
-        if h.is_null() {
-            return core::Status::NGX_ERROR.into();
+        unsafe {
+            // SAFETY: this function is called with non-NULL cf always
+            let cf = &mut *cf;
+            let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
+
+            let h = ngx_array_push(
+                &mut cmcf.phases[ngx_http_phases_NGX_HTTP_PRECONTENT_PHASE as usize].handlers,
+            ) as *mut ngx_http_handler_pt;
+            if h.is_null() {
+                return core::Status::NGX_ERROR.into();
+            }
+            // set an phase handler
+            *h = Some(awssigv4_header_handler);
+            core::Status::NGX_OK.into()
         }
-        // set an phase handler
-        *h = Some(awssigv4_header_handler);
-        core::Status::NGX_OK.into()
     }
 }
 
@@ -298,10 +305,13 @@ http_request_handler!(awssigv4_header_handler, |request: &mut Request| {
         for (name, value) in request.headers_in_iterator() {
             if let Ok(name) = name.to_str() {
                 if name.to_lowercase() == "host" {
-                    if let Ok(value) = http::HeaderValue::from_bytes(value.as_bytes()) {
-                        headers.insert(http::header::HOST, value);
-                    } else {
-                        return core::Status::NGX_DECLINED;
+                    match http::HeaderValue::from_bytes(value.as_bytes()) {
+                        Ok(value) => {
+                            headers.insert(http::header::HOST, value);
+                        }
+                        _ => {
+                            return core::Status::NGX_DECLINED;
+                        }
                     }
                 }
             } else {

diff --git a/examples/curl.rs b/examples/curl.rs
@@ -18,19 +18,21 @@ impl http::HttpModule for Module {
     }
 
     unsafe extern "C" fn postconfiguration(cf: *mut ngx_conf_t) -> ngx_int_t {
-        // SAFETY: this function is called with non-NULL cf always
-        let cf = &mut *cf;
-        let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
-
-        let h = ngx_array_push(
-            &mut cmcf.phases[ngx_http_phases_NGX_HTTP_ACCESS_PHASE as usize].handlers,
-        ) as *mut ngx_http_handler_pt;
-        if h.is_null() {
-            return core::Status::NGX_ERROR.into();
+        unsafe {
+            // SAFETY: this function is called with non-NULL cf always
+            let cf = &mut *cf;
+            let cmcf = NgxHttpCoreModule::main_conf_mut(cf).expect("http core main conf");
+
+            let h = ngx_array_push(
+                &mut cmcf.phases[ngx_http_phases_NGX_HTTP_ACCESS_PHASE as usize].handlers,
+            ) as *mut ngx_http_handler_pt;
+            if h.is_null() {
+                return core::Status::NGX_ERROR.into();
+            }
+            // set an Access phase handler
+            *h = Some(curl_access_handler);
+            core::Status::NGX_OK.into()
         }
-        // set an Access phase handler
-        *h = Some(curl_access_handler);
-        core::Status::NGX_OK.into()
     }
 }
 

diff --git a/examples/httporigdst.rs b/examples/httporigdst.rs
@@ -1,5 +1,5 @@
 use std::ffi::{c_int, c_void};
-use std::ptr::addr_of;
+use std::ptr::{addr_of, NonNull};
 
 use ngx::core;
 use ngx::ffi::{
@@ -47,29 +47,33 @@ impl NgxHttpOrigDstCtx {
     }
 
     pub unsafe fn bind_addr(&self, v: *mut ngx_variable_value_t) {
+        let mut v = NonNull::new(v).unwrap();
+        let v = unsafe { v.as_mut() };
         if self.orig_dst_addr.len == 0 {
-            (*v).set_not_found(1);
+            v.set_not_found(1);
             return;
         }
 
-        (*v).set_valid(1);
-        (*v).set_no_cacheable(0);
-        (*v).set_not_found(0);
-        (*v).set_len(self.orig_dst_addr.len as u32);
-        (*v).data = self.orig_dst_addr.data;
+        v.set_valid(1);
+        v.set_no_cacheable(0);
+        v.set_not_found(0);
+        v.set_len(self.orig_dst_addr.len as u32);
+        v.data = self.orig_dst_addr.data;
     }
 
     pub unsafe fn bind_port(&self, v: *mut ngx_variable_value_t) {
+        let mut v = NonNull::new(v).unwrap();
+        let v = unsafe { v.as_mut() };
         if self.orig_dst_port.len == 0 {
-            (*v).set_not_found(1);
+            v.set_not_found(1);
             return;
         }
 
-        (*v).set_valid(1);
-        (*v).set_no_cacheable(0);
-        (*v).set_not_found(0);
-        (*v).set_len(self.orig_dst_port.len as u32);
-        (*v).data = self.orig_dst_port.data;
+        v.set_valid(1);
+        v.set_no_cacheable(0);
+        v.set_not_found(0);
+        v.set_len(self.orig_dst_port.len as u32);
+        v.data = self.orig_dst_port.data;
     }
 }
 
@@ -129,19 +133,21 @@ unsafe fn ngx_get_origdst(
 ) -> Result<(String, in_port_t), core::Status> {
     let c = request.connection();
 
-    if (*c).type_ != libc::SOCK_STREAM {
+    if unsafe { (*c).type_ } != libc::SOCK_STREAM {
         ngx_log_debug_http!(request, "httporigdst: connection is not type SOCK_STREAM");
         return Err(core::Status::NGX_DECLINED);
     }
 
-    if ngx_connection_local_sockaddr(c, std::ptr::null_mut(), 0) != core::Status::NGX_OK.into() {
+    if unsafe { ngx_connection_local_sockaddr(c, std::ptr::null_mut(), 0) }
+        != core::Status::NGX_OK.into()
+    {
         ngx_log_debug_http!(request, "httporigdst: no local sockaddr from connection");
         return Err(core::Status::NGX_ERROR);
     }
 
     let level: c_int;
     let optname: c_int;
-    match (*(*c).local_sockaddr).sa_family as i32 {
+    match unsafe { (*(*c).local_sockaddr).sa_family } as i32 {
         libc::AF_INET => {
             level = libc::SOL_IP;
             optname = libc::SO_ORIGINAL_DST;
@@ -152,15 +158,17 @@ unsafe fn ngx_get_origdst(
         }
     }
 
-    let mut addr: sockaddr_storage = { std::mem::zeroed() };
+    let mut addr: sockaddr_storage = unsafe { std::mem::zeroed() };
     let mut addrlen: libc::socklen_t = std::mem::size_of_val(&addr) as libc::socklen_t;
-    let rc = libc::getsockopt(
-        (*c).fd,
-        level,
-        optname,
-        &mut addr as *mut _ as *mut _,
-        &mut addrlen as *mut u32,
-    );
+    let rc = unsafe {
+        libc::getsockopt(
+            (*c).fd,
+            level,
+            optname,
+            &mut addr as *mut _ as *mut _,
+            &mut addrlen as *mut u32,
+        )
+    };
     if rc == -1 {
         ngx_log_debug_http!(request, "httporigdst: getsockopt failed");
         return Err(core::Status::NGX_DECLINED);
@@ -192,10 +200,11 @@ unsafe fn ngx_get_origdst(
 http_variable_get!(
     ngx_http_orig_dst_addr_variable,
     |request: &mut http::Request, v: *mut ngx_variable_value_t, _: usize| {
-        let ctx = request.get_module_ctx::<NgxHttpOrigDstCtx>(&*addr_of!(ngx_http_orig_dst_module));
+        let ctx = request
+            .get_module_ctx::<NgxHttpOrigDstCtx>(unsafe { &*addr_of!(ngx_http_orig_dst_module) });
         if let Some(obj) = ctx {
             ngx_log_debug_http!(request, "httporigdst: found context and binding variable",);
-            obj.bind_addr(v);
+            unsafe { obj.bind_addr(v) };
             return core::Status::NGX_OK;
         }
         // lazy initialization:
@@ -204,7 +213,7 @@ http_variable_get!(
         //   set context
         // bind address
         ngx_log_debug_http!(request, "httporigdst: context not found, getting address");
-        let r = ngx_get_origdst(request);
+        let r = unsafe { ngx_get_origdst(request) };
         match r {
             Err(e) => {
                 return e;
@@ -226,10 +235,11 @@ http_variable_get!(
                     ip,
                     port,
                 );
-                (*new_ctx).save(&ip, port, &request.pool());
-                (*new_ctx).bind_addr(v);
-                request
-                    .set_module_ctx(new_ctx as *mut c_void, &*addr_of!(ngx_http_orig_dst_module));
+                unsafe { (*new_ctx).save(&ip, port, &request.pool()) };
+                unsafe { (*new_ctx).bind_addr(v) };
+                request.set_module_ctx(new_ctx as *mut c_void, unsafe {
+                    &*addr_of!(ngx_http_orig_dst_module)
+                });
             }
         }
         core::Status::NGX_OK
@@ -239,10 +249,11 @@ http_variable_get!(
 http_variable_get!(
     ngx_http_orig_dst_port_variable,
     |request: &mut http::Request, v: *mut ngx_variable_value_t, _: usize| {
-        let ctx = request.get_module_ctx::<NgxHttpOrigDstCtx>(&*addr_of!(ngx_http_orig_dst_module));
+        let ctx = request
+            .get_module_ctx::<NgxHttpOrigDstCtx>(unsafe { &*addr_of!(ngx_http_orig_dst_module) });
         if let Some(obj) = ctx {
             ngx_log_debug_http!(request, "httporigdst: found context and binding variable",);
-            obj.bind_port(v);
+            unsafe { obj.bind_port(v) };
             return core::Status::NGX_OK;
         }
         // lazy initialization:
@@ -251,7 +262,7 @@ http_variable_get!(
         //   set context
         // bind port
         ngx_log_debug_http!(request, "httporigdst: context not found, getting address");
-        let r = ngx_get_origdst(request);
+        let r = unsafe { ngx_get_origdst(request) };
         match r {
             Err(e) => {
                 return e;
@@ -273,10 +284,11 @@ http_variable_get!(
                     ip,
                     port,
                 );
-                (*new_ctx).save(&ip, port, &request.pool());
-                (*new_ctx).bind_port(v);
-                request
-                    .set_module_ctx(new_ctx as *mut c_void, &*addr_of!(ngx_http_orig_dst_module));
+                unsafe { (*new_ctx).save(&ip, port, &request.pool()) };
+                unsafe { (*new_ctx).bind_port(v) };
+                request.set_module_ctx(new_ctx as *mut c_void, unsafe {
+                    &*addr_of!(ngx_http_orig_dst_module)
+                });
             }
         }
         core::Status::NGX_OK
@@ -292,13 +304,15 @@ impl HttpModule for Module {
 
     // static ngx_int_t ngx_http_orig_dst_add_variables(ngx_conf_t *cf)
     unsafe extern "C" fn preconfiguration(cf: *mut ngx_conf_t) -> ngx_int_t {
-        for mut v in NGX_HTTP_ORIG_DST_VARS {
-            let var = ngx_http_add_variable(cf, &mut v.name, v.flags);
-            if var.is_null() {
+        for mut v in unsafe { NGX_HTTP_ORIG_DST_VARS } {
+            let var = NonNull::new(unsafe { ngx_http_add_variable(cf, &mut v.name, v.flags) });
+            if var.is_none() {
                 return core::Status::NGX_ERROR.into();
             }
-            (*var).get_handler = v.get_handler;
-            (*var).data = v.data;
+            let mut var = var.unwrap();
+            let var = unsafe { var.as_mut() };
+            var.get_handler = v.get_handler;
+            var.data = v.data;
         }
         core::Status::NGX_OK.into()
     }