Version bump.

.hgtags

@@ -430,3 +430,4 @@ fb1212c7eca4c5328fe17d6cd95b010c67336aac release-1.13.9
 b234199c7ed8a156a6bb98f7ff58302c857c954f release-1.15.2
 28b3e17ca7eba1e6a0891afde0e4bc5bcc99c861 release-1.15.3
 49d49835653857daa418e68d6cbfed4958c78fca release-1.15.4
+f062e43d74fc2578bb100a9e82a953efa1eb9e4e release-1.15.5

conf/nginx.conf

@@ -1,36 +1,219 @@
-
+user www www;
-#user  nobody;
+worker_processes 1;
-worker_processes  1;
 
 #error_log  logs/error.log;
 #error_log  logs/error.log  notice;
 #error_log  logs/error.log  info;
 
-#pid        logs/nginx.pid;
+pcre_jit on;
-
 
 events {
-    worker_connections  1024;
+    use epoll;
+    multi_accept on;
+    worker_connections 1024;
+
+    # accept_mutex off;
+    # accept_mutex_delay 50ms;
 }
 
-
 http {
-    include       mime.types;
+    include koi-utf;
-    default_type  application/octet-stream;
+    charset utf-8;
+    charset_types text/xml text/plain text/vnd.wap.wml
+                  application/javascript application/x-javascript
+                  application/rss+xml text/css;
+    override_charset on;
 
-    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
+    map_hash_bucket_size 256;
-    #                  '$status $body_bytes_sent "$http_referer" '
+    map_hash_max_size 4096;
-    #                  '"$http_user_agent" "$http_x_forwarded_for"';
+    server_names_hash_bucket_size 128;
+    server_names_hash_max_size 2048;
+    variables_hash_max_size 2048;
 
-    #access_log  logs/access.log  main;
+    # Cloudflare CDN
+    set_real_ip_from   199.27.128.0/21;
+    set_real_ip_from   173.245.48.0/20;
+    set_real_ip_from   103.21.244.0/22;
+    set_real_ip_from   103.22.200.0/22;
+    set_real_ip_from   103.31.4.0/22;
+    set_real_ip_from   141.101.64.0/18;
+    set_real_ip_from   108.162.192.0/18;
+    set_real_ip_from   190.93.240.0/20;
+    set_real_ip_from   188.114.96.0/20;
+    set_real_ip_from   197.234.240.0/22;
+    set_real_ip_from   198.41.128.0/17;
+    set_real_ip_from   162.158.0.0/15;
+    set_real_ip_from   104.16.0.0/12;
+    #set_real_ip_from   2400:cb00::/32;
+    #set_real_ip_from   2606:4700::/32;
+    #set_real_ip_from   2803:f800::/32;
+    #set_real_ip_from   2405:b500::/32;
+    #set_real_ip_from   2405:8100::/32;
+    real_ip_header     CF-Connecting-IP;
 
-    sendfile        on;
+    # SSL Config
-    #tcp_nopush     on;
+    strict_sni on;
+    strict_sni_header on;
+    ssl_dyn_rec_enable on;
+    ssl_early_data on;
 
-    #keepalive_timeout  0;
+    ## SSL OCSP Stapling
-    keepalive_timeout  65;
+    resolver 1.1.1.1 1.0.0.1 valid=86400s ipv6=off;
+    resolver_timeout 15s;
+    ssl_stapling on;
+    ssl_stapling_verify on;
 
-    #gzip  on;
+    include mime.types;
+    default_type application/octet-stream;
+    sendfile on;
+    server_tokens off;
+    tcp_nopush on;
+    tcp_nodelay on;
+
+    # HTTP2 PUSH
+    #http2_push on;
+    #http2_push_preload on;
+
+    client_header_timeout  45s;  # 45s = 45s
+    client_body_timeout    450s; # 450s = 7m 30s
+    send_timeout           45s;  # 45s = 45s
+
+    log_not_found off;
+
+    open_file_cache max=50000 inactive=60s;
+    open_file_cache_valid 120s;
+    open_file_cache_min_uses 2;
+    open_file_cache_errors off;
+    open_log_file_cache max=10000 inactive=30s min_uses=2;
+
+    # Keepalive timeout
+    keepalive_timeout 60s;
+    keepalive_requests 15000;
+    lingering_time 60s;
+    lingering_close on;
+    lingering_timeout 10s;
+    keepalive_disable msie6;
+
+    # php upload size
+    client_max_body_size 4G; # 4GB = 4096MB
+
+    # Brotli compression
+    brotli on;
+    brotli_static on;
+    brotli_min_length 150;
+    brotli_window 16m;
+    brotli_buffers 2048 4k;
+    brotli_comp_level 6;
+    brotli_types text/richtext
+                 text/plain
+                 text/css
+                 text/x-script
+                 text/x-component
+                 text/x-java-source
+                 application/javascript
+                 application/x-javascript
+                 text/javascript
+                 text/js
+                 image/x-icon
+                 application/x-perl
+                 application/x-httpd-cgi
+                 text/xml
+                 application/xml
+                 application/rss+xml
+                 application/json
+                 multipart/bag
+                 multipart/mixed
+                 application/xhtml+xml
+                 font/ttf
+                 font/otf
+                 font/woff
+                 font/woff2
+                 image/svg+xml
+                 application/vnd.ms-fontobject
+                 application/ttf
+                 application/x-ttf
+                 application/otf
+                 application/x-otf
+                 application/x-font-ttf
+                 application/x-font-truetype
+                 application/x-font-opentype
+                 application/x-opentype
+                 application/woff
+                 application/eot
+                 application/font
+                 application/font-woff
+                 application/font-woff2
+                 application/x-font-woff2
+                 application/font-sfnt;
+
+    # gzip compression
+    gzip on;
+    gzip_comp_level 9;
+    gzip_static on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_min_length 150;
+    gzip_buffers 2048 4k;
+    gzip_http_version 1.1;
+    gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+    gzip_types text/richtext
+               text/plain
+               text/css
+               text/x-script
+               text/x-component
+               text/x-java-source
+               application/javascript
+               application/x-javascript
+               text/javascript
+               text/js
+               image/x-icon
+               application/x-perl
+               application/x-httpd-cgi
+               text/xml
+               application/xml
+               application/rss+xml
+               application/json
+               multipart/bag
+               multipart/mixed
+               application/xhtml+xml
+               font/ttf
+               font/otf
+               font/woff
+               font/woff2
+               image/svg+xml
+               application/vnd.ms-fontobject
+               application/ttf
+               application/x-ttf
+               application/otf
+               application/x-otf
+               application/x-font-ttf
+               application/x-font-truetype
+               application/x-font-opentype
+               application/x-opentype
+               application/woff
+               application/eot
+               application/font
+               application/font-woff
+               application/font-woff2
+               application/x-font-woff2
+               application/font-sfnt;
+    gzip_disable "MSIE [1-6].(?!.*SV1)";
+
+    # GeoIP2
+    #geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
+    #    $geoip2_metadata_country_build metadata build_epoch;
+    #    $geoip2_data_country_code default=US source=$remote_addr country iso_code;
+    #    $geoip2_data_country_name country names en;
+    #}
+
+    #geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {
+    #    $geoip2_data_city_name default=London city names en;
+    #    $geoip2_data_continent_name default=Europe continent names en;
+    #    $geoip2_data_subdivisions_name default=London subdivisions 0 names en;
+    #}
+
+    # index
+    index index.html index.htm index.php;
 
     server {
         listen       80;
@@ -78,21 +261,6 @@ http {
         #}
     }
 
-
-    # another virtual host using mix of IP-, name-, and port-based configuration
-    #
-    #server {
-    #    listen       8000;
-    #    listen       somename:8080;
-    #    server_name  somename  alias  another.alias;
-
-    #    location / {
-    #        root   html;
-    #        index  index.html index.htm;
-    #    }
-    #}
-
-
     # HTTPS server
     #
     #server {
@@ -102,16 +270,13 @@ http {
     #    ssl_certificate      cert.pem;
     #    ssl_certificate_key  cert.key;
 
-    #    ssl_session_cache    shared:SSL:1m;
+    #    ssl_session_cache    shared:SSL:20m;
-    #    ssl_session_timeout  5m;
+    #    ssl_session_timeout  1d;
-
+    #    ssl_session_tickets  on;
-    #    ssl_ciphers  HIGH:!aNULL:!MD5;
-    #    ssl_prefer_server_ciphers  on;
 
     #    location / {
     #        root   html;
     #        index  index.html index.htm;
     #    }
     #}
-
 }

docs/xml/nginx/changes.xml

@@ -5,6 +5,33 @@
 <change_log title="nginx">
 
 
+<changes ver="1.15.5" date="2018-10-02">
+
+<change type="bugfix">
+<para lang="ru">
+при использовании OpenSSL 1.1.0h и новее
+в рабочем процессе мог произойти segmentation fault;
+ошибка появилась в 1.15.4.
+</para>
+<para lang="en">
+a segmentation fault might occur in a worker process
+when using OpenSSL 1.1.0h or newer;
+the bug had appeared in 1.15.4.
+</para>
+</change>
+
+<change type="bugfix">
+<para lang="ru">
+незначительных потенциальных ошибок.
+</para>
+<para lang="en">
+of minor potential bugs.
+</para>
+</change>
+
+</changes>
+
+
 <changes ver="1.15.4" date="2018-09-25">
 
 <change type="feature">

src/core/nginx.h

@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1015005
+#define nginx_version      1015006
-#define NGINX_VERSION      "1.15.5"
+#define NGINX_VERSION      "1.15.6"
 #define NGINX_VER          "nginx/" NGINX_VERSION " by Hakase"
 #define NGINX_SERVER_FULL  NGINX_SERVER "/" NGINX_VERSION
 #define NGINX_ORIG         "nginx/" NGINX_VERSION

src/core/ngx_cycle.c

@@ -921,7 +921,8 @@ ngx_init_zone_pool(ngx_cycle_t *cycle, ngx_shm_zone_t *zn)
 
 #else
 
-    file = ngx_pnalloc(cycle->pool, cycle->lock_file.len + zn->shm.name.len);
+    file = ngx_pnalloc(cycle->pool,
+                       cycle->lock_file.len + zn->shm.name.len + 1);
     if (file == NULL) {
         return NGX_ERROR;
     }

src/event/ngx_event_openssl.c

@@ -350,10 +350,6 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
     SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
 #endif
 
-#ifdef SSL_OP_NO_RENEGOTIATION
-    SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_RENEGOTIATION);
-#endif
-
 #ifdef SSL_OP_PRIORITIZE_CHACHA
     SSL_CTX_set_options(ssl->ctx, SSL_OP_PRIORITIZE_CHACHA);
 #endif
@@ -1303,6 +1299,9 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
     } else {
         SSL_set_accept_state(sc->connection);
 
+#ifdef SSL_OP_NO_RENEGOTIATION
+        SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
+#endif
     }
 
     if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {

src/http/ngx_http_request.c

@@ -858,7 +858,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
         return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK;
     }
 
-    if (c->ssl->renegotiation) {
+    if (c->ssl->handshaked) {
         return SSL_TLSEXT_ERR_NOACK;
     }
 
@@ -919,6 +919,10 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
 #endif
 
         SSL_set_options(ssl_conn, SSL_CTX_get_options(sscf->ssl.ctx));
+
+#ifdef SSL_OP_NO_RENEGOTIATION
+        SSL_set_options(ssl_conn, SSL_OP_NO_RENEGOTIATION);
+#endif
     }
 
     return SSL_TLSEXT_ERR_OK;