release-1.5.6 tag
Version bump.
Unused macro and variable removed.

The macro NGX_HTTP_DAV_COPY_BLOCK is not used since 8101d9101ed8 (0.8.9).
The variable ngx_accept_mutex_lock_file was never used.
Upstream: fixed "down" and "backup" parsing.

Previously arguments starting with "down" or "backup" were considered
valid, e.g. "server ... downFOO;".
Limit req: fixed "nodelay" parsing.

Previously arguments starting with "nodelay" were considered valid,
e.g. "limit_req ... nodelayFOO;".
SSL: fixed build with OpenSSL 0.9.7.

SSL_get_rbio() and SSL_get_wbio() functions used to get non-const pointer
in OpenSSL 0.9.7, hence an explicit cast added to drop const qualifier.
SSL: SSL_CTX_set_timeout() now always called.

The timeout set is used by OpenSSL as a hint for clients in TLS Session
Tickets.  Previous code resulted in a default timeout (5m) used for TLS
Sessions Tickets if there was no session cache configured.

Prodded by Piotr Sikora.
SSL: added ability to set keys used for Session Tickets (RFC5077).

In order to support key rollover, ssl_session_ticket_key can be defined
multiple times. The first key will be used to issue and resume Session
Tickets, while the rest will be used only to resume them.

    ssl_session_ticket_key  session_tickets/current.key;
    ssl_session_ticket_key  session_tickets/prev-1h.key;
    ssl_session_ticket_key  session_tickets/prev-2h.key;

Please note that nginx supports Session Tickets even without explicit
configuration of the keys and this feature should be only used in setups
where SSL traffic is distributed across multiple nginx servers.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
Style.
Headers filter: empty Cache-Control is no longer added.

Much like with other headers, "add_header Cache-Control $value;" no longer
results in anything added to response headers if $value evaluates to an
empty string.
Fixed "satisfy any" if 403 is returned after 401 (ticket #285).

The 403 (Forbidden) should not overwrite 401 (Unauthorized) as the
latter should be returned with the WWW-Authenticate header to request
authentication by a client.

The problem could be triggered with 3rd party modules and the "deny"
directive, or with auth_basic and auth_request which returns 403
(in 1.5.4+).

Patch by Jan Marc Hoffmann.
Upstream: optimize loops in ngx_http_upstream_init_round_robin().
Core: apply missed options to sockets added during binary upgrade.

The accept_filter and deferred options were not applied to sockets
that were added to configuration during binary upgrade cycle.

Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
Core: handling of getsockopt(TCP_DEFER_ACCEPT) failures.

Recent Linux versions started to return EOPNOTSUPP to getsockopt() calls
on unix sockets, resulting in log pollution on binary upgrade.  Such errors
are silently ignored now.
Gzip, gunzip: flush pending data when incoming chain is NULL.
Auth basic: "info" logging level on no user/password.

This isn't an exceptional condition and normally happens on
first request from a client.
Removed extra allocation for $sent_http_last_modified.

There is no need to allocate memory for "Last-Modified: " string,
the variable only contains date itself.
Gunzip: "error" logging level on inflate() errors.

Errors can easily happen due to broken upstream responses, there is no
need to log them at "alert" level.
Gunzip: proper error handling on gunzipping an empty response.

With previous code, an empty (malformed) response resulted in a request
finalized without sending anything to a client.
Win32: plugged memory leak.