theraw/The-World-Is-Yours
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ssl fix.
build-and-publish / build (Raccoon, ubuntu:26.04, NEXUS_PASS_RACCOON, NEXUS_REPO_RACCOON, NEXUS_USER_RACCOON, raccoon) (push) Successful in 5m0s
Details
build-and-publish / build (Trixie, debian:13, NEXUS_PASS_TRIXIE, NEXUS_REPO_TRIXIE, NEXUS_USER_TRIXIE, trixie) (push) Successful in 4m19s
Details

Browse Source
This commit is contained in:
theraw
2026-08-20 17:47:47 +00:00
parent 391372825c
commit 7830bac934
1 changed files with 1 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
static/nginx/nginx.conf
+1 -11
View File
@@ -77,17 +77,7 @@ http {
# Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch). # Cloudflare dynamic TLS record sizing (build/patches/nginx-X-dynamic-tls-records.patch).
# Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS # Small records up front cut TTFB by ~1 RTT, then ramp up to amortise TLS
# overhead once the connection is past head-of-line blocking. # overhead once the connection is past head-of-line blocking.
# INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size. The # INVARIANT: ssl_dyn_rec_size_lo/hi must never exceed ssl_buffer_size.
# SSL buffer is allocated at ssl_buffer_size bytes, but the patch points
# buf->end at buf->start + size_hi -- a larger size_hi makes the copy loop
# memcpy response body past the end of that allocation and over adjacent
# nginx pools. Hit in production 2026-08-20: ssl_buffer_size 4k against
# size_hi 4229 overflowed by 133 bytes and crashed workers in unrelated
# code (ngx_http_v2_handle_frame, ngx_destroy_pool). The patch now clamps
# with ngx_min() so this is fail-safe, but exceeding it still silently caps
# records at ssl_buffer_size and wastes the ramp these values buy.
# ssl_buffer_size is NOT set here -- it lives in ssl.conf (outside this
# repo) and is settable per server block, so a single vhost can lower it.
ssl_dyn_rec_enable on; ssl_dyn_rec_enable on;
ssl_dyn_rec_size_lo 1369; ssl_dyn_rec_size_lo 1369;
ssl_dyn_rec_size_hi 4229; ssl_dyn_rec_size_hi 4229;