Hakase/nginx-build
2
1 Fork 1
Code Issues Pull Requests Releases Activity

Compare commits

base: Hakase/nginx-build:9913b968f9776549021b525417d6c9a78fdce58d
Branches Tags
Hakase/nginx-build:master
..
compare: Hakase/nginx-build:b225850d52678e9d7af849bdd9224b3e53ceaff5
Branches Tags
Hakase/nginx-build:master
3 Commits
9913b968f9 .. b225850d52
Author SHA1 Message Date
Hakase b225850d52 Version bump. 2018-10-03 13:43:55 +09:00
Hakase fb2e8c1e54 Latest update - 7369 2018-10-03 13:43:14 +09:00
Hakase b8556fb704 Update nginx default configuration file. 2018-10-03 13:42:22 +09:00
7 changed files with 244 additions and 47 deletions
Expand all files Collapse all files
.hgtags
+1
View File
@@ -430,3 +430,4 @@ fb1212c7eca4c5328fe17d6cd95b010c67336aac release-1.13.9
b234199c7ed8a156a6bb98f7ff58302c857c954f release-1.15.2
28b3e17ca7eba1e6a0891afde0e4bc5bcc99c861 release-1.15.3
49d49835653857daa418e68d6cbfed4958c78fca release-1.15.4
f062e43d74fc2578bb100a9e82a953efa1eb9e4e release-1.15.5
conf/nginx.conf
+204 -39
View File
@@ -1,36 +1,219 @@
#user nobody;
worker_processes 1;
user www www;
worker_processes 1;
#error_log logs/error.log;
#error_log logs/error.log notice;
#error_log logs/error.log info;
#pid logs/nginx.pid;
pcre_jit on;
events {
worker_connections 1024;
use epoll;
multi_accept on;
worker_connections 1024;
# accept_mutex off;
# accept_mutex_delay 50ms;
}
http {
include mime.types;
default_type application/octet-stream;
include koi-utf;
charset utf-8;
charset_types text/xml text/plain text/vnd.wap.wml
application/javascript application/x-javascript
application/rss+xml text/css;
override_charset on;
#log_format main '$remote_addr - $remote_user [$time_local] "$request" '
# '$status $body_bytes_sent "$http_referer" '
# '"$http_user_agent" "$http_x_forwarded_for"';
map_hash_bucket_size 256;
map_hash_max_size 4096;
server_names_hash_bucket_size 128;
server_names_hash_max_size 2048;
variables_hash_max_size 2048;
#access_log logs/access.log main;
# Cloudflare CDN
set_real_ip_from 199.27.128.0/21;
set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/12;
#set_real_ip_from 2400:cb00::/32;
#set_real_ip_from 2606:4700::/32;
#set_real_ip_from 2803:f800::/32;
#set_real_ip_from 2405:b500::/32;
#set_real_ip_from 2405:8100::/32;
real_ip_header CF-Connecting-IP;
sendfile on;
#tcp_nopush on;
# SSL Config
strict_sni on;
strict_sni_header on;
ssl_dyn_rec_enable on;
ssl_early_data on;
#keepalive_timeout 0;
keepalive_timeout 65;
## SSL OCSP Stapling
resolver 1.1.1.1 1.0.0.1 valid=86400s ipv6=off;
resolver_timeout 15s;
ssl_stapling on;
ssl_stapling_verify on;
#gzip on;
include mime.types;
default_type application/octet-stream;
sendfile on;
server_tokens off;
tcp_nopush on;
tcp_nodelay on;
# HTTP2 PUSH
#http2_push on;
#http2_push_preload on;
client_header_timeout 45s; # 45s = 45s
client_body_timeout 450s; # 450s = 7m 30s
send_timeout 45s; # 45s = 45s
log_not_found off;
open_file_cache max=50000 inactive=60s;
open_file_cache_valid 120s;
open_file_cache_min_uses 2;
open_file_cache_errors off;
open_log_file_cache max=10000 inactive=30s min_uses=2;
# Keepalive timeout
keepalive_timeout 60s;
keepalive_requests 15000;
lingering_time 60s;
lingering_close on;
lingering_timeout 10s;
keepalive_disable msie6;
# php upload size
client_max_body_size 4G; # 4GB = 4096MB
# Brotli compression
brotli on;
brotli_static on;
brotli_min_length 150;
brotli_window 16m;
brotli_buffers 2048 4k;
brotli_comp_level 6;
brotli_types text/richtext
text/plain
text/css
text/x-script
text/x-component
text/x-java-source
application/javascript
application/x-javascript
text/javascript
text/js
image/x-icon
application/x-perl
application/x-httpd-cgi
text/xml
application/xml
application/rss+xml
application/json
multipart/bag
multipart/mixed
application/xhtml+xml
font/ttf
font/otf
font/woff
font/woff2
image/svg+xml
application/vnd.ms-fontobject
application/ttf
application/x-ttf
application/otf
application/x-otf
application/x-font-ttf
application/x-font-truetype
application/x-font-opentype
application/x-opentype
application/woff
application/eot
application/font
application/font-woff
application/font-woff2
application/x-font-woff2
application/font-sfnt;
# gzip compression
gzip on;
gzip_comp_level 9;
gzip_static on;
gzip_vary on;
gzip_proxied any;
gzip_min_length 150;
gzip_buffers 2048 4k;
gzip_http_version 1.1;
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
gzip_types text/richtext
text/plain
text/css
text/x-script
text/x-component
text/x-java-source
application/javascript
application/x-javascript
text/javascript
text/js
image/x-icon
application/x-perl
application/x-httpd-cgi
text/xml
application/xml
application/rss+xml
application/json
multipart/bag
multipart/mixed
application/xhtml+xml
font/ttf
font/otf
font/woff
font/woff2
image/svg+xml
application/vnd.ms-fontobject
application/ttf
application/x-ttf
application/otf
application/x-otf
application/x-font-ttf
application/x-font-truetype
application/x-font-opentype
application/x-opentype
application/woff
application/eot
application/font
application/font-woff
application/font-woff2
application/x-font-woff2
application/font-sfnt;
gzip_disable "MSIE [1-6].(?!.*SV1)";
# GeoIP2
#geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
# $geoip2_metadata_country_build metadata build_epoch;
# $geoip2_data_country_code default=US source=$remote_addr country iso_code;
# $geoip2_data_country_name country names en;
#}
#geoip2 /usr/share/GeoIP/GeoLite2-City.mmdb {
# $geoip2_data_city_name default=London city names en;
# $geoip2_data_continent_name default=Europe continent names en;
# $geoip2_data_subdivisions_name default=London subdivisions 0 names en;
#}
# index
index index.html index.htm index.php;
server {
listen 80;
@@ -78,21 +261,6 @@ http {
#}
}
# another virtual host using mix of IP-, name-, and port-based configuration
#
#server {
# listen 8000;
# listen somename:8080;
# server_name somename alias another.alias;
# location / {
# root html;
# index index.html index.htm;
# }
#}
# HTTPS server
#
#server {
@@ -102,16 +270,13 @@ http {
# ssl_certificate cert.pem;
# ssl_certificate_key cert.key;
# ssl_session_cache shared:SSL:1m;
# ssl_session_timeout 5m;
# ssl_ciphers HIGH:!aNULL:!MD5;
# ssl_prefer_server_ciphers on;
# ssl_session_cache shared:SSL:20m;
# ssl_session_timeout 1d;
# ssl_session_tickets on;
# location / {
# root html;
# index index.html index.htm;
# }
#}
}
docs/xml/nginx/changes.xml
+27
View File
@@ -5,6 +5,33 @@
<change_log title="nginx">
<changes ver="1.15.5" date="2018-10-02">
<change type="bugfix">
<para lang="ru">
при использовании OpenSSL 1.1.0h и новее
в рабочем процессе мог произойти segmentation fault;
ошибка появилась в 1.15.4.
</para>
<para lang="en">
a segmentation fault might occur in a worker process
when using OpenSSL 1.1.0h or newer;
the bug had appeared in 1.15.4.
</para>
</change>
<change type="bugfix">
<para lang="ru">
незначительных потенциальных ошибок.
</para>
<para lang="en">
of minor potential bugs.
</para>
</change>
</changes>
<changes ver="1.15.4" date="2018-09-25">
<change type="feature">
src/core/nginx.h
+2 -2
View File
@@ -9,8 +9,8 @@
#define _NGINX_H_INCLUDED_
#define nginx_version 1015005
#define NGINX_VERSION "1.15.5"
#define nginx_version 1015006
#define NGINX_VERSION "1.15.6"
#define NGINX_VER "nginx/" NGINX_VERSION " by Hakase"
#define NGINX_SERVER_FULL NGINX_SERVER "/" NGINX_VERSION
#define NGINX_ORIG "nginx/" NGINX_VERSION
src/core/ngx_cycle.c
+2 -1
View File
@@ -921,7 +921,8 @@ ngx_init_zone_pool(ngx_cycle_t *cycle, ngx_shm_zone_t *zn)
#else
file = ngx_pnalloc(cycle->pool, cycle->lock_file.len + zn->shm.name.len);
file = ngx_pnalloc(cycle->pool,
cycle->lock_file.len + zn->shm.name.len + 1);
if (file == NULL) {
return NGX_ERROR;
}
src/event/ngx_event_openssl.c
+3 -4
View File
@@ -350,10 +350,6 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
#endif
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_RENEGOTIATION);
#endif
#ifdef SSL_OP_PRIORITIZE_CHACHA
SSL_CTX_set_options(ssl->ctx, SSL_OP_PRIORITIZE_CHACHA);
#endif
@@ -1303,6 +1299,9 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
} else {
SSL_set_accept_state(sc->connection);
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
#endif
}
if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {
src/http/ngx_http_request.c
+5 -1
View File
@@ -858,7 +858,7 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
return (clcf->strict_sni) ? SSL_TLSEXT_ERR_ALERT_FATAL : SSL_TLSEXT_ERR_NOACK;
}
if (c->ssl->renegotiation) {
if (c->ssl->handshaked) {
return SSL_TLSEXT_ERR_NOACK;
}
@@ -919,6 +919,10 @@ ngx_http_ssl_servername(ngx_ssl_conn_t *ssl_conn, int *ad, void *arg)
#endif
SSL_set_options(ssl_conn, SSL_CTX_get_options(sscf->ssl.ctx));
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_set_options(ssl_conn, SSL_OP_NO_RENEGOTIATION);
#endif
}
return SSL_TLSEXT_ERR_OK;