Nginx [nginx-announce] nginx-1.13.1

eva2000 · May 31, 2017

Changes with nginx 1.13.1 30 May 2017

*) Feature: now a hostname can be used as the "set_real_ip_from"
directive parameter.

*) Feature: vim syntax highlighting scripts improvements.

*) Feature: the "worker_cpu_affinity" directive now works on DragonFly
BSD.
Thanks to Sepherosa Ziehau.

*) Bugfix: SSL renegotiation on backend connections did not work when
using OpenSSL before 1.1.0.

*) Workaround: nginx could not be built with Oracle Developer Studio
12.5.

*) Workaround: now cache manager ignores long locked cache entries when
cleaning cache based on the "max_size" parameter.

*) Bugfix: client SSL connections were immediately closed if deferred
accept and the "proxy_protocol" parameter of the "listen" directive
were used.

*) Bugfix: in the "proxy_cache_background_update" directive.

*) Workaround: now the "tcp_nodelay" directive sets the TCP_NODELAY
option before an SSL handshake.

--
Maxim Dounin
http://nginx.org/
_______________________________________________
nginx-announce mailing list
nginx-announce@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-announce

Continue reading...

eva2000 · May 31, 2017

nginx -V
nginx version: nginx/1.13.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-11) (GCC)
built with OpenSSL 1.0.2l 25 May 2017
TLS SNI support enabled
configure arguments: --with-ld-opt=' -lpcre -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_pagespeed-1.12.34.2-beta --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --with-google_perftools_module --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-dynamic-module=../lua-nginx-module-0.10.9rc5 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.0.2l
Click to expand...

Sunka · May 31, 2017

[root@upcloud ~]# nginx -V
nginx version: nginx/1.13.1
built by gcc 6.2.1 20160916 (Red Hat 6.2.1-3) (GCC)
built with LibreSSL 2.5.4
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../libressl-2.5.4
Click to expand...

ahmed · May 31, 2017

are we now done with TLS 1.3?

ahmed · May 31, 2017

in centmin conf, can we put OpenSSL so the installer can pick the latest version instead of specifying the exact version number?

OPENSSL_VERSION='1.1.0f'

ahmed · May 31, 2017

mine is

Code:

nginx -V
nginx version: nginx/1.13.1
built by gcc 6.2.1 20160916 (Red Hat 6.2.1-3) (GCC)
built with OpenSSL 1.1.0f  25 May 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.0f

eva2000 · May 31, 2017

ahmed said: ↑

are we now done with TLS 1.3?
Click to expand...

openssl 1.1.1 TLS v1.3 doesn't get official release until TLS 1.3 spec is finalised see https://community.centminmod.com/th...n-nginx-master-branch.11424/page-2#post-49509

Current status of the TLSv1.3 standard
As of the time of writing TLSv1.3 is still in draft. Periodically a new version of the draft standard is published by the TLS Working Group. Implementations of the draft are required to identify the specific draft version that they are using. This means that implementations based on different draft versions do not interoperate with each other.

OpenSSL 1.1.1 will not be released until (at least) TLSv1.3 is finalised. In the meantime the OpenSSL git master branch contains our development TLSv1.3 code which can be used for testing purposes (i.e. it is not for production use). You can check which draft TLSv1.3 version is implemented in any particular OpenSSL checkout by examining the value of the TLS1_3_VERSION_DRAFT_TXT macro in the tls1.h header file. This macro will be removed when the final version of the standard is released.
Click to expand...

centmin mod 123.09beta01 already supports testing openssl 1.1.1 dev with TLS v1.3 draft-18 which is what web browsers support but openssl 1.1.1 dev is on TLS v1.3 draft-20 and counting

ahmed said: ↑

in centmin conf, can we put OpenSSL so the installer can pick the latest version instead of specifying the exact version number?

OPENSSL_VERSION='1.1.0f'
Click to expand...

nope, need specify a version number so you have finer grain control over versions

Log in / Register

Forums

Join the community today

Nginx [nginx-announce] nginx-1.13.1

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Sunka Active Member

ahmed Member

ahmed Member

ahmed Member

eva2000 Administrator Staff Member

.

Log in / Register

Useful Searches

Join the community today

Nginx [nginx-announce] nginx-1.13.1

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

Sunka Active Member

ahmed Member

ahmed Member

ahmed Member

eva2000 Administrator Staff Member

.