Nginx nginx 1.13.9 - released

pamamolf · Feb 21, 2018

http://nginx.org/en/CHANGES

Changes with nginx 1.13.9 20 Feb 2018

*) Feature: HTTP/2 server push support; the "http2_push" and
"http2_push_preload" directives.

*) Bugfix: "header already sent" alerts might appear in logs when using
cache; the bug had appeared in 1.9.13.

*) Bugfix: a segmentation fault might occur in a worker process if the
"ssl_verify_client" directive was used and no SSL certificate was
specified in a virtual server.

*) Bugfix: in the ngx_http_v2_module.

*) Bugfix: in the ngx_http_dav_module.
Click to expand...

I think it will be good to update Centminmod before you upgrade Nginx using the ssh command cmupdate or from Centminmod menu

rdan · Feb 21, 2018

Done Updated

nginx version: nginx/1.13.9
built by gcc 7.2.1 20170829 (Red Hat 7.2.1-1) (GCC)
built with OpenSSL 1.0.2n 7 Dec 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-openssl=../openssl-1.0.2n --with-openssl-opt='enable-ec_nistp_64_gcc_128' --with-libatomic --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0
Click to expand...

eva2000 · Feb 21, 2018

Yay @bassie

Remember to play with HTTP/2 Server Push Nginx - Nginx HTTP/2 Server Push Finally Supported

Official blog Introducing HTTP/2 Server Push with NGINX 1.13.9 | NGINX

Sunka · Feb 21, 2018

Updated

# nginx -V
nginx version: nginx/1.13.9
built by gcc 7.2.1 20170829 (Red Hat 7.2.1-1) (GCC)
built with LibreSSL 2.6.4
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../libressl-2.6.4
Click to expand...

Revenge · Feb 21, 2018

@eva2000 your hpack patch works fine?

eva2000 · Feb 21, 2018

Revenge said: ↑

@eva2000 your hpack patch works fine?
Click to expand...

Yup Cloudflare HTTP/2 HPACK full encoding patching worked on Nginx 1.13.9 master branch code tested below. The master branch code hasn't changed from official Nginx 1.13.9 release, so should work fine as well. Just compiling GCC 8.0.1 Feb 18th build right now and will retest with Nginx 1.13.9 official release + GCC 8.0.1 soon
Code (Text):
patching nginx http/2 full HPACK encoding support
nginx-1.13.9_http2-hpack.patch
patch -p1 < /usr/local/src/centminmod/patches/cloudflare/nginx-1.13.9_http2-hpack.patch
patching file auto/modules
Hunk #1 succeeded at 437 (offset 1 line).
patching file auto/options
patching file src/core/ngx_murmurhash.c
patching file src/core/ngx_murmurhash.h
patching file src/http/v2/ngx_http_v2.c
Hunk #1 succeeded at 274 with fuzz 1 (offset 27 lines).
Hunk #2 succeeded at 2076 with fuzz 1 (offset 54 lines).
patching file src/http/v2/ngx_http_v2.h
Hunk #6 succeeded at 414 (offset -1 lines).
patching file src/http/v2/ngx_http_v2_filter_module.c
Hunk #1 succeeded at 26 (offset 1 line).
Hunk #2 succeeded at 88 with fuzz 2 (offset 40 lines).
Hunk #3 succeeded at 187 with fuzz 2 (offset 45 lines).
Hunk #4 succeeded at 465 (offset 56 lines).
Hunk #5 succeeded at 473 (offset 56 lines).
Hunk #6 succeeded at 493 (offset 56 lines).
Hunk #7 succeeded at 540 (offset 56 lines).
Hunk #8 succeeded at 592 (offset 56 lines).
Hunk #9 succeeded at 1025 (offset 347 lines).
Hunk #10 succeeded at 1051 (offset 347 lines).
patching file src/http/v2/ngx_http_v2_table.c
nginx 1.13.9 from master compiles fine

nginx -V
nginx version: nginx/1.13.9
built by gcc 8.0.1 20180211 (experimental) (GCC)
built with OpenSSL 1.1.1-pre1 (alpha) 13 Feb 2018
TLS SNI support enabled
configure arguments: --with-ld-opt='-ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wp,-D_FORTIFY_SOURCE=2' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-http_v2_hpack_enc --with-openssl=../openssl-1.1.1-pre1 --with-openssl-opt='enable-tls1_3'
Click to expand...

h2load testing HTTP/2 HPACK Full Encoding also works ~93% HTTP/2 header space savings after 20 runs
Code (Text):
url=https://http2.domain.com

for i in $(seq 1 20); do echo "h2load run $i"; h2load $url -n $i | tail -6 | head -1; done

h2load run 1
traffic: 6.20KB (6350) total, 250B (250) headers (space savings 38.12%), 5.89KB (6033) data
h2load run 2
traffic: 12.12KB (12415) total, 264B (264) headers (space savings 67.33%), 11.78KB (12066) data
h2load run 3
traffic: 18.05KB (18480) total, 278B (278) headers (space savings 77.06%), 17.67KB (18099) data
h2load run 4
traffic: 23.97KB (24545) total, 292B (292) headers (space savings 81.93%), 23.57KB (24132) data
h2load run 5
traffic: 29.89KB (30610) total, 306B (306) headers (space savings 84.85%), 29.46KB (30165) data
h2load run 6
traffic: 35.82KB (36675) total, 320B (320) headers (space savings 86.80%), 35.35KB (36198) data
h2load run 7
traffic: 41.74KB (42740) total, 334B (334) headers (space savings 88.19%), 41.24KB (42231) data
h2load run 8
traffic: 47.66KB (48805) total, 348B (348) headers (space savings 89.23%), 47.13KB (48264) data
h2load run 9
traffic: 53.58KB (54870) total, 362B (362) headers (space savings 90.04%), 53.02KB (54297) data
h2load run 10
traffic: 59.51KB (60935) total, 376B (376) headers (space savings 90.69%), 58.92KB (60330) data
h2load run 11
traffic: 65.43KB (67000) total, 390B (390) headers (space savings 91.22%), 64.81KB (66363) data
h2load run 12
traffic: 71.35KB (73065) total, 404B (404) headers (space savings 91.67%), 70.70KB (72396) data
h2load run 13
traffic: 77.28KB (79130) total, 418B (418) headers (space savings 92.04%), 76.59KB (78429) data
h2load run 14
traffic: 83.20KB (85195) total, 432B (432) headers (space savings 92.36%), 82.48KB (84462) data
h2load run 15
traffic: 89.12KB (91260) total, 446B (446) headers (space savings 92.64%), 88.37KB (90495) data
h2load run 16
traffic: 95.04KB (97325) total, 460B (460) headers (space savings 92.88%), 94.27KB (96528) data
h2load run 17
traffic: 100.97KB (103390) total, 474B (474) headers (space savings 93.10%), 100.16KB (102561) data
h2load run 18
traffic: 106.89KB (109455) total, 488B (488) headers (space savings 93.29%), 106.05KB (108594) data
h2load run 19
traffic: 112.81KB (115520) total, 502B (502) headers (space savings 93.46%), 111.94KB (114627) data
h2load run 20
traffic: 118.74KB (121585) total, 516B (516) headers (space savings 93.61%), 117.83KB (120660) data

eva2000 · Feb 21, 2018

Ok done Nginx 1.13.9 final release + GCC 8.0.1 Feb 18th build release + OpenSSL 1.1.1-pre1 alpha release for TLS v1.3 + Cloudflare zlib performance patch + ngx_pagespeed 1.13.35.2-stable + Cloudflare HTTP/2 HPACK Full Encoding patch

nginx -V
nginx version: nginx/1.13.9
built by gcc 8.0.1 20180218 (experimental) (GCC)
built with OpenSSL 1.1.1-pre1 (alpha) 13 Feb 2018
TLS SNI support enabled
configure arguments: --with-ld-opt='-L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --add-dynamic-module=../nginx-module-vts --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --add-dynamic-module=../incubator-pagespeed-ngx-1.13.35.2-stable --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.4.2 --add-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.31 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre=../pcre-8.41 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-http_v2_hpack_enc --with-openssl=../openssl-1.1.1-pre1 --with-openssl-opt='enable-tls1_3'
Click to expand...

rdan · Feb 21, 2018

What is the right way for fonts?

Code:

default "</fontawesome-webfont.woff2>; as=font; rel=preload; type="font/woff2"";

or

Code:

default "</fontawesome-webfont.woff2>; as=font; rel=preload;";

rdan · Feb 21, 2018

I guess this codes are correct for css, js and png files?

Code:

default "</font-awesome.min.css>; as=style; rel=preload;";

default "</jquery-1.11.0.min.js>; as=script; rel=preload;";

default "</logo.png>; as=image; rel=preload;";

eva2000 · Feb 21, 2018

See examples at Introducing HTTP/2 Server Push with NGINX 1.13.9 | NGINX and on my thread at Nginx - Nginx HTTP/2 Server Push Finally Supported

From Nginx blog, suggest not doing HTTP/2 Push for web fonts as there's an outstanding Chrome web browser bug so preload as a header hint in non-HTTP/2 Push mode for web font only i.e. use nopush flag for web fonts

It’s not possible to push or preload font resources efficiently, due to a known issue in Chrome. Chrome makes an explicit request for a font resource even it it has already been pushed or preloaded.

Click to expand...

but that link is back in 2017 and as per https://stackoverflow.com/a/42683378/272648 comment

You cannot use the preload link by itself to load fonts. It must be used in conjunction with @font-face. Specifically, the preload link must precede the @font-face directive, and @font-face must occur soon after the preload link, if not immediately. It would seem that in the <head> section, the preload link should come last in your links, and then @font-face should immediately follow, either in a linked style sheet or in a <style> section that follows.
Click to expand...

Probably best to try for yourself and see

eva2000 · Feb 21, 2018

Be sure to test before and after HTTP/2 Server Push implementations via webpagetest.org in Cable 5Mbps and 3G mobile connection profiles WebPerf - PageSpeed - How to use webpagetest.org for page load speed testing

rdan · Feb 21, 2018

Opz, I already got previous MAP for http cookie:
Code:
map $http_cookie $nocachecookie {
     default                   0;
    ~xf_fbUid                  1;
    ~xf_user                   1;
    ~xf_logged_in              1;
}
How can I use 2 maps for http_cookie variable now?

nginx: [emerg] duplicate default map parameter in /usr/local/nginx/conf/nginx.conf:69
Click to expand...

Edit 1: Seems I got different issue, trying to fix now.

Sunka · Feb 21, 2018

eva2000 said: ↑

See examples at Introducing HTTP/2 Server Push with NGINX 1.13.9 | NGINX and on my thread at Nginx - Nginx HTTP/2 Server Push Finally Supported
Click to expand...

I am so confused (again).
Could someone write what part of code and in which file to add it?

rdan · Feb 21, 2018

Fixed now, I just need to combine the assets into one default line .
Sample:
Code:
map $http_cookie $resources {
    "~*session=1" "";
    default "</style.css>; as=style; rel=preload, </image1.jpg>; as=image; rel=preload, </image2.jpg>; as=style; rel=preload";
}

rdan · Feb 21, 2018

Sunka said: ↑

Could someone write what part of code and in which file to add it?
Click to expand...

Nginx.conf and yourdomain.conf only.

Sunka · Feb 21, 2018

And what to add and in which part of file?

btw

Code:

# curl -I https://http2.pijanitvor.com/
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

rdan · Feb 21, 2018

Do I need more set headers module for this to work?
I can't see the link headers added.

eva2000 · Feb 21, 2018

RoldanLT said: ↑

Do I need more set headers module for this to work?
I can't see the link headers added.
Click to expand...

no need for headers more openresty nginx module

if you setup map cookie then only see header if cookie isn't presence so need to clear the cookie before loading page in chrome, 2nd reload will remove preload link headers as cookie would of populated in web browser. So only first visit without cookie shows preload link header and second visit will skip HTTP/2 push for serving via web browser cache = cache aware HTTP/2 server push
Sunka said: ↑
And what to add and in which part of file?

btw
Code:
# curl -I https://http2.pijanitvor.com/
curl: (60) Peer's certificate issuer has been marked as not trusted by the user.
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
Click to expand...
you setup SSL cert incorrectly as it gives a SSL certificate mismatch on dev SSLLABs test SSL Server Test: http2.pijanitvor.com (Powered by Qualys SSL Labs)

You're using upload.domain.com self-signed SSL certificate for http2.domain.com site

rdan · Feb 21, 2018

HTTP Push is only great for first time visitors or Guest, but as I can observed it conflicts with fastcgi_cache which most of my site uses except Wordpress.

It does work only on request that doesn't come from fastcgi_cache.

Revenge · Feb 21, 2018

eva2000 said: ↑

Ok done Nginx 1.13.9 final release + GCC 8.0.1 Feb 18th build release + OpenSSL 1.1.1-pre1 alpha release for TLS v1.3 + Cloudflare zlib performance patch + ngx_pagespeed 1.13.35.2-stable + Cloudflare HTTP/2 HPACK Full Encoding patch
Click to expand...

Eva, you seem to be using Cloudflare Zlib 1.3.0. In their github i only find version 1.2.8. Some change you did or its really a new version from them?

PS: Forget it, i just noticed you just renamed it

Log in / Register

Forums

Join the community today

Nginx nginx 1.13.9 - released

pamamolf Premium Member Premium Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Sunka Well-Known Member

rdan Well-Known Member

rdan Well-Known Member

Sunka Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Revenge Active Member

.

Log in / Register

Useful Searches

Join the community today

Nginx nginx 1.13.9 - released

pamamolf Premium Member Premium Member

rdan Well-Known Member

eva2000 Administrator Staff Member

Sunka Well-Known Member

Revenge Active Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Sunka Well-Known Member

rdan Well-Known Member

rdan Well-Known Member

Sunka Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

Revenge Active Member

.