theraw/The-World-Is-Yours
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssl fix
build-and-publish / build (Trixie, debian:13, NEXUS_PASS_TRIXIE, NEXUS_REPO_TRIXIE, NEXUS_USER_TRIXIE, trixie) (push) Canceled after 0s
Details
build-and-publish / build (Raccoon, ubuntu:26.04, NEXUS_PASS_RACCOON, NEXUS_REPO_RACCOON, NEXUS_USER_RACCOON, raccoon) (push) Canceled after 1m46s
Details

Browse Source
This commit is contained in:
theraw
2026-08-20 17:44:25 +00:00
parent f156364a26
commit 391372825c
2 changed files with 16 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
build/patches/nginx-1.31.3-dynamic-tls-records.patch
+3 -3
View File
@@ -28,7 +28,7 @@ diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c nginx-1.31.0-manu
+ if (ngx_current_msec - c->ssl->dyn_rec_last_write > + if (ngx_current_msec - c->ssl->dyn_rec_last_write >
+ c->ssl->dyn_rec.timeout) + c->ssl->dyn_rec.timeout)
+ { + {
+ buf->end = buf->start + c->ssl->dyn_rec.size_lo; + buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_lo, c->ssl->buffer_size);
+ c->ssl->dyn_rec_records_sent = 0; + c->ssl->dyn_rec_records_sent = 0;
+ +
+ } else { + } else {
@@ -40,10 +40,10 @@ diff -urN nginx-1.31.0-pristine2/src/event/ngx_event_openssl.c nginx-1.31.0-manu
+ } else if (c->ssl->dyn_rec_records_sent > + } else if (c->ssl->dyn_rec_records_sent >
+ c->ssl->dyn_rec.threshold) + c->ssl->dyn_rec.threshold)
+ { + {
+ buf->end = buf->start + c->ssl->dyn_rec.size_hi; + buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_hi, c->ssl->buffer_size);
+ +
+ } else { + } else {
+ buf->end = buf->start + c->ssl->dyn_rec.size_lo; + buf->end = buf->start + ngx_min(c->ssl->dyn_rec.size_lo, c->ssl->buffer_size);
+ } + }
+ } + }
+ } + }
static/nginx/nginx.conf
+13 -2
View File
@@ -30,8 +30,8 @@ http {
# =================== END LOGS ========================= # # =================== END LOGS ========================= #
# ==================== GENERAL ========================= # # ==================== GENERAL ========================= #
client_header_buffer_size 4k; client_header_buffer_size 8k;
large_client_header_buffers 4 16k; large_client_header_buffers 8 16k;
client_body_buffer_size 16k; client_body_buffer_size 16k;
client_max_body_size 2M; client_max_body_size 2M;
client_body_timeout 30s; client_body_timeout 30s;
@@ -77,6 +77,17 @@ http {
# Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch). # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
# Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
# overhead once the connection is past head-of-line blocking. # overhead once the connection is past head-of-line blocking.
# INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. The
# SSL buffer is allocated at ssl_buffer_size bytes, but the patch points
# buf->end at buf->start + size_hi -- a larger size_hi makes the copy loop
# memcpy response body past the end of that allocation and over adjacent
# nginx pools. Hit in production 2026-08-20: ssl_buffer_size 4k against
# size_hi 4229 overflowed by 133 bytes and crashed workers in unrelated
# code (ngx_http_v2_handle_frame, ngx_destroy_pool). The patch now clamps
# with ngx_min() so this is fail-safe, but exceeding it still silently caps
# records at ssl_buffer_size and wastes the ramp these values buy.
# ssl_buffer_size is NOT set here -- it lives in ssl.conf (outside this
# repo) and is settable per server block, so a single vhost can lower it.
ssl_dyn_rec_enable on; ssl_dyn_rec_enable on;
ssl_dyn_rec_size_lo 1369; ssl_dyn_rec_size_lo 1369;
ssl_dyn_rec_size_hi 4229; ssl_dyn_rec_size_hi 4229;