Nginx Nginx 1.13.10 Released

eva2000 · Mar 20, 2018

Nginx 1.13.10 is officially released now. You will be able to run the SSH command = cmupdate to update Centmin Mod 123.09beta01 code and then run centmin.sh menu option 4 to update Nginx to 1.13.10 just like with Nginx 1.13.9

Nginx 1.13.10 adds

ALPN ssl_preread parsing support

gRPC proxy module - for details see Announcing gRPC Support in NGINX - NGINX

Changes with nginx 1.13.10 20 Mar 2018

*) Feature: the "set" parameter of the "include" SSI directive now
allows writing arbitrary responses to a variable; the
"subrequest_output_buffer_size" directive defines maximum response
size.

*) Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available,
to avoid timeouts being incorrectly triggered on system time changes.

*) Feature: the "escape=none" parameter of the "log_format" directive.
Thanks to Johannes Baiter and Calin Don.

*) Feature: the $ssl_preread_alpn_protocols variable in the
ngx_stream_ssl_preread_module.

*) Feature: the ngx_http_grpc_module.

*) Bugfix: in memory allocation error handling in the "geo" directive.

*) Bugfix: when using variables in the "auth_basic_user_file" directive
a null character might appear in logs.
Thanks to Vadim Filimonov.
Click to expand...

Just a heads up for folks using NGINX_HPACK='y' which isn't enabled by default for Cloudflare's HTTP/2 HPACK Full Encoding patch. It's broken in Nginx 1.13.10 due to major changes in code. So I have updated Centmin Mod 123.09beta01 to disable the patch when Nginx 1.13.10 is detected. Nginx 1.13.9 will still get patched if you have set NGINX_HPACK='y'.

Bug listed at HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig for folks who want to follow on.

Example compile of Centmin Mod 123.09beta01 based Nginx 1.13.10 pulled from master dev branch. On centmin.sh menu option 4 specify Nginx version to update to = master to pull and install master branch code Nginx 1.13.10

nginx -V
nginx version: nginx/1.13.10
built by gcc 8.0.1 20180318 (experimental) (GCC)
built with OpenSSL 1.1.0g 2 Nov 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --add-dynamic-module=../nginx-module-vts --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0g --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...

eva2000 · Mar 21, 2018

Nginx 1.3.10 has been officially released now nginx news

Changes with nginx 1.13.10 20 Mar 2018

*) Feature: the "set" parameter of the "include" SSI directive now
allows writing arbitrary responses to a variable; the
"subrequest_output_buffer_size" directive defines maximum response
size.

*) Feature: now nginx uses clock_gettime(CLOCK_MONOTONIC) if available,
to avoid timeouts being incorrectly triggered on system time changes.

*) Feature: the "escape=none" parameter of the "log_format" directive.
Thanks to Johannes Baiter and Calin Don.

*) Feature: the $ssl_preread_alpn_protocols variable in the
ngx_stream_ssl_preread_module.

*) Feature: the ngx_http_grpc_module.

*) Bugfix: in memory allocation error handling in the "geo" directive.

*) Bugfix: when using variables in the "auth_basic_user_file" directive
a null character might appear in logs.
Thanks to Vadim Filimonov.
Click to expand...

rdan · Mar 21, 2018

Updated .
Code:
Total Nginx Upgrade Time: 98.330884620 seconds
nginx version: nginx/1.13.10
built by gcc 7.2.1 20170829 (Red Hat 7.2.1-1) (GCC)
built with OpenSSL 1.1.0g 2 Nov 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0g --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...

eva2000 · Mar 21, 2018

yup

nginx -V
nginx version: nginx/1.13.10
built by gcc 8.0.1 20180318 (experimental) (GCC)
built with OpenSSL 1.1.0g 2 Nov 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --add-dynamic-module=../nginx-module-vts --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0g --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...

Sunka · Mar 21, 2018

good

# nginx -V
nginx version: nginx/1.13.10
built by gcc 7.2.1 20170829 (Red Hat 7.2.1-1) (GCC)
built with OpenSSL 1.1.0g 2 Nov 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0g --with-openssl-opt='enable-ec_nistp_64_gcc_128'
Click to expand...

@eva2000 change version of nginx in thread title

eva2000 · Mar 21, 2018

Sunka said: ↑

change version of nginx in thread title
Click to expand...

yeah all day I have been mistyping 1.13.10 as 1.3.10 for some reason

Revenge · Mar 22, 2018

Now comes the doubt. Stick with Nginx 1.13.9 with HPACK patch or update to Nginx 1.13.10 without it.

dcg · Mar 22, 2018

HPACK and nginx updates seem to have a rocky relationship
Thanks for the info @eva2000

eva2000 · Mar 22, 2018

Revenge said: ↑

Now comes the doubt. Stick with Nginx 1.13.9 with HPACK patch or update to Nginx 1.13.10 without it.
Click to expand...

Yeah having HTTP/2 HPACK Full Encoding patch is nice compared to HPACK partial encoding in standard Nginx, but the bandwidth savings isn't that substantial with lower traffic. So usually would be fine. For now I suggest using 1.13.10 and just keep an eye on the bug/issue report for updates HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig

buik · Mar 22, 2018

eva2000 said: ↑

Yeah having HTTP/2 HPACK Full Encoding patch is nice compared to HPACK partial encoding in standard Nginx, but the bandwidth savings isn't that substantial with lower traffic. So usually would be fine.
Click to expand...

This is a difficult point.
As Cloudflare no longer issues new code, no longer makes any changes. And it does not seem to manage it at all anymore (repo sslconfig). Because Nginx does not implement it in her own code.

And with every release the Cloudflare patches are breaking the Nginx code. again and again, harder and harder. I wonder if it still makes sense to use Cloudflare patches nowadays.

Nginx code is changed more and more and there will be a turning point that Cloudflare patches won't longer work.

eva2000 · Mar 22, 2018

Yeah it's tricky to navigate. Only thing to do for Centmin Mod is deal with it as the issues come. Centmin Mod Nginx upgrade routine when it fails to compile Nginx will just use the previous Nginx version anyway. So worse case is your don't update to the Nginx version you want and use previous Nginx version. It's not as critical as your sites powered by Centmin Mod Nginx will continue to run as it was anyway just with existing Nginx version and the Nginx version you're trying to upgrade to.

Right now latest Centmin Mod 123.09beta01 code updated in past 48hrs, just detects Nginx versions 1.13.10 and greater and skips cloudflare HPACK patch setting NGINX_HPACK='n' so no breakage for that going forth for now.

Revenge · Mar 23, 2018

@eva2000 this patch works: https://raw.githubusercontent.com/kn007/patch/master/nginx.patch

Just tested it.

eva2000 · Mar 23, 2018

Revenge said: ↑

@eva2000 this patch works: https://raw.githubusercontent.com/kn007/patch/master/nginx.patch

Just tested it.
Click to expand...

thanks for heads up HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig

seems that patch is 3 patches in one so would conflict with my dynamic tls patch

Add SPDY Support.
Add HTTP2 HPACK Encoding Support.
Add Dynamic TLS Record support.
Click to expand...

Revenge · Mar 23, 2018

Yes, i noticed it. But it works flawless if we just use that patch.

eva2000 · Mar 25, 2018

well kn007 shared his Cloudflare HTTP/2 HPACK Full Encoding patch update for Nginx 1.13.10 compatibility and it does compile and work according to h2load tests. Just need see if all web browsers work with it too HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig

buik · Mar 25, 2018

eva2000 said: ↑

well kn007 shared his Cloudflare HTTP/2 HPACK Full Encoding patch update for Nginx 1.13.10 compatibility and it does compile and work according to h2load tests. Just need see if all web browsers work with it too HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig
Click to expand...

h2load test HTTP/2 HPACK Full Encoding = 93.7+ % header space savings and counting
Click to expand...

Did someone bench the Nginx none HPACK stack vs Nginx HPACK stack not on the headers but the whole environment?

93.7+ % saving on header size sounds impressive but how many ms are you saving on the the total package?

Don't get me wrong. The HPACK patch is great.
Obviously if you have millions of visitors just like Cloudflare.

But what about the small sites?

eva2000 · Mar 25, 2018

Yeah HPACK full vs partial encoding of headers is not going to make much of difference for small sites compared to large sites and depends on the specific site's header size/usage too. For example HTTP/2 and the evolving requirements for implementing many security related headers will increase the header size footprint of each request over time. Might not affect Nginx performance that much, but web servers like h2o and caddy it might as their performance degrades more as you add more headers to their requests from my past experience/benchmarks. Nginx doesn't degrade much at all. Though no idea of reason Nginx folks don't implement HPACK Full encoding as opposed to it's current partial encoding.

buik · Mar 25, 2018

eva2000 said: ↑

YNginx doesn't degrade much at all. Though no idea of reason Nginx folks don't implement HPACK Full encoding as opposed to it's current partial encoding.
Click to expand...

The reason is simple. No time.
Apparently too busy with Nginx plus, Nginx unit et al.

Thank you for the patch.

Sorry, I'm busy with other work. I'll look on it later, as time permits.

wbr, Valentin V. Bartenev
Click to expand...

The above comment was the last one after sending in the patch by Cloudflare.

[PATCH] HTTP/2: add support for HPACK encoding
[PATCH] HTTP/2: add support for HPACK encoding

eva2000 · Mar 25, 2018

bassie said: ↑

The reason is simple. No time.
Click to expand...

ah i remember reading that reply.. guess it's just different priorities and not seeing HPACK full encoding as important as they could of added it to Nginx Plus if that was a reason to priortize Nginx Plus over Nginx open source.

knguyen2015 · Apr 2, 2018

Do you have official HPACK that supports 1.3.10?

eva2000 · Apr 3, 2018

knguyen2015 said: ↑

Do you have official HPACK that supports 1.3.10?
Click to expand...

I am using same patch discussed above in this thread at HPACK patch broken for Nginx 1.13.10 · Issue #93 · cloudflare/sslconfig

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Nginx Nginx 1.13.10 Released

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

Revenge Active Member

dcg Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

knguyen2015 New Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Nginx Nginx 1.13.10 Released

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

eva2000 Administrator Staff Member

Revenge Active Member

dcg Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

Revenge Active Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

buik “A winner never stops trying.” Premium Member

eva2000 Administrator Staff Member

knguyen2015 New Member

eva2000 Administrator Staff Member

.