Nginx [nginx-announce] nginx-1.17.0

eva2000 · May 22, 2019

Changes with nginx 1.17.0 21 May 2019

*) Feature: variables support in the "limit_rate" and "limit_rate_after"
directives.

*) Feature: variables support in the "proxy_upload_rate" and
"proxy_download_rate" directives in the stream module.

*) Change: minimum supported OpenSSL version is 0.9.8.

*) Change: now the postpone filter is always built.

*) Bugfix: the "include" directive did not work inside the "if" and
"limit_except" blocks.

*) Bugfix: in byte ranges processing.

--
Maxim Dounin
http://nginx.org/
_______________________________________________
nginx-announce mailing list
nginx-announce@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-announce

Continue reading...

rdan · May 22, 2019

nginx version: nginx/1.17.0 (220519-073615-centos7)
built by gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC)
built with OpenSSL 1.1.1b 26 Feb 2019
TLS SNI support enabled
configure arguments:
--with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/zlib-cf/lib:/usr/local/lib'
--with-cc-opt='-I/usr/local/zlib-cf/include -I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold
--param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf'
--sbin-path=/usr/local/sbin/nginx
--conf-path=/usr/local/nginx/conf/nginx.conf
--build=220519-073615-centos7
--with-compat
--with-libatomic
--with-http_gzip_static_module
--add-dynamic-module=../ngx_brotli
--with-pcre-jit
--with-zlib=../zlib-cloudflare-1.3.0
--with-http_ssl_module
--with-http_v2_module
--with-openssl=../openssl-1.1.1b
Click to expand...

eva2000 · May 22, 2019

nice beat me to it

excellent news

looks like nginx 1.17.0 broke compatibility with openresty nginx lua module for stream-lua-nginx (this module isn't enabled by default so most folks won't be affected)

Code (Text):

        -o objs/addon/src/ngx_stream_lua_util.o \
        ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_util.c
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_api.c:21:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_api.o] Error 1
make[1]: *** Waiting for unfinished jobs....
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_request.c:9:10: fatal error: ngx_stream.h: No such file or directory
    9 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_request.o] Error 1
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_directive.h:20,
                 from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_module.c:22:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_module.o] Error 1
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_directive.c:22:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_directive.o] Error 1
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_contentby.h:20,
                 from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_contentby.c:22:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_contentby.o] Error 1
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_lex.h:19,
                 from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_lex.c:19:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_lex.o] Error 1
In file included from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_directive.h:20,
                 from ../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_util.c:23:
../stream-lua-nginx-module-0.0.7/src/ngx_stream_lua_common.h:27:10: fatal error: ngx_stream.h: No such file or directory
   27 | #include <ngx_stream.h>
      |          ^~~~~~~~~~~~~~
compilation terminated.
make[1]: *** [objs/addon/src/ngx_stream_lua_util.o] Error 1
make[1]: Leaving directory `/svr-setup/nginx-1.17.0'
make: *** [build] Error 2

eva2000 · May 22, 2019

Updated 123.09beta01 with fixes for stream-lua-nginx module when you specifically enable the optional openresty lua nginx modules via variable ORESTY_LUANGINX='y'

nginx -V
nginx version: nginx/1.17.0 (220519-071058-centos7-kvm)
built by gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC)
built with OpenSSL 1.1.1b 26 Feb 2019
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/lib -ljemalloc -lpcre -Wl,-z,relro -Wl,-rpath,/usr/local/zlib-cf/lib:/usr/local/lib' --with-cc-opt='-I/usr/local/zlib-cf/include -I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=220519-071058-centos7-kvm --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../nginx-length-hiding-filter-module --add-dynamic-module=../ngx_brotli --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.5 --add-dynamic-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-dynamic-module=../lua-nginx-module-0.10.15 --add-module=../stream-lua-nginx-module-0.0.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.1b --with-openssl-opt='enable-ec_nistp_64_gcc_128 enable-tls1_3'
Click to expand...

with test GCC 9.1.0 compiler

nginx -V
nginx version: nginx/1.17.0 (220519-065805-centos7)
built by gcc 9.1.0 (GCC)
built with OpenSSL 1.1.1b 26 Feb 2019
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/lib -ljemalloc -lpcre -Wl,-z,relro -Wl,-rpath,/usr/local/zlib-cf/lib:/usr/local/lib' --with-cc-opt='-I/usr/local/zlib-cf/include -I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -Wno-error=strict-aliasing -fstack-protector-strong -flto --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wno-cast-function-type -Wno-format-extra-args -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=220519-065805-centos7 --with-compat --with-http_stub_status_module --with-http_secure_link_module --add-dynamic-module=../nginx-module-vts --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --add-dynamic-module=../ngx_http_geoip2_module --add-dynamic-module=../incubator-pagespeed-ngx-1.13.35.2-stable --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.5 --add-dynamic-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-dynamic-module=../lua-nginx-module-0.10.15 --add-module=../stream-lua-nginx-module-0.0.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.1b --with-openssl-opt='enable-ec_nistp_64_gcc_128 enable-tls1_3' --add-dynamic-module=../ModSecurity-nginx
Click to expand...

eva2000 · May 23, 2019

For folks confused with Nginx mainline 1.17 vs stable 1.16 blog post https://www.nginx.com/blog/nginx-1-16-1-17-released/ and my thread at https://community.centminmod.com/threads/nginx-1-16-1-17-roadmap.17207/

Today we release NGINX 1.17.0 – the latest version of the NGINX open source project, which is now the most popular web server on the Internet. This release also signals the start of the NGINX 1.17 development branch, following the release of NGINX 1.16.0 last month.

In this blog we discuss the NGINX versioning scheme, look back at what happened during the NGINX 1.15 development cycle, and look forward to what is in store with NGINX 1.17.

NGINX Versioning Explained
At NGINX, we maintain two branches in the NGINX source code repository, named mainline and stable:

Mainline is the active development branch where the latest features and bug fixes get added. It is denoted by an odd number in the second part of the version number, for example 1.17.0.

Stable receives fixes for high‑severity bugs, but is not updated with new features. It is denoted by an even number in the second part of the version number, for example 1.16.0.

Click to expand...

Which Branch Should I Use?
We generally recommend using the mainline branch. This is where we commit all new features, performance improvements, and enhancements. We actively test and QA the mainline branch, and as the source of NGINX Plus builds it is completely suitable for production use.

If you are concerned about the overhead of monitoring the mainline branch for new features and bug fixes, then using the stable branch means that you only need to review new functionality once a year, and bug fixes on an infrequent basis.

NGINX 1.15 in Review, AKA What’s New in Stable NGINX 1.16
The NGINX 1.15 development cycle carried some major development efforts, including improvements to UDP proxying in the Stream module, the Random load‑balancing method, support for TLS 1.3 early data, dynamic loading of SSL certificates, and more. Before we look at the most significant enhancements in more detail, here’s NGINX 1.15, by the numbers:

13 mainline releases (one every 4 weeks on average)

16 bug fixes

19 new features

3000 net new lines of code (increasing the codebase by 2.2%)

Improvements to UDP Proxying
Support for proxying and load balancing UDP traffic was first introduced in NGINX 1.9.13. This enabled NGINX to sit in front of popular UDP applications such as DNS, syslog, NTP, and RADIUS to provide high availability and scalability of the application servers. The initial implementation was limited to UDP applications that expect a single UDP packet from the client for each interaction with the server.

Support for UDP sessions arrived in NGINX 1.15.0, which means that more complex UDP applications can be proxied and load balanced. These include OpenVPN, VoIP, and virtual desktop solutions. NGINX 1.15.7 added the proxy_requests directive which provides more control over how a virtual UDP session is “connected” to a backend server. Furthermore, handling of all UDP applications – simple or complex – is also significantly faster.

TLS 1.3 Early Data
One of the performance improvements introduced in TLS 1.3 is called 0‑RTT (zero round‑trip time). It makes it possible to resume TLS sessions faster, by reducing the number of round trips between client and server when re‑establishing an encrypted session. NGINX now supports 0‑RTT through the ssl_early_data directive.

Dynamic Certificate Loading
When managing TLS/SSL certificates for secure sites and applications, NGINX is typically configured to specify the certificate and associated private key as files on disk. The certificate and key for each hostname are specified as static configuration in a separate server block, and loaded at NGINX startup. NGINX 1.15.9 enabled dynamic loading by using the SNI variable $ssl_server_name to locate the file on disk. NGINX 1.15.10 extended this further by allowing the certificate data to be obtained from a variable.

Random Load Balancing and the “Power of Two Choices”
NGINX 1.15.1 added the random load‑balancing method, specifically aimed at distributed load‑balancing deployments where multiple NGINX instances are load balancing to the same set of backend servers.

A simple variation on random load balancing, yet one which is proven to improve load distribution, is to select two backend servers at random and then choose the one with the lower load. We call this Random with Two Choices. The goal of comparing two random choices is to avoid making a bad load‑balancing decision (even though the choice might not be the best among all the available servers). By avoiding the backend server with the greater load, each load balancer can operate independently, without sending spikes of traffic to individual backend servers. Thus we get the benefits and computational efficiency of random load balancing but with demonstrably better load distribution. Random with Two Choices is now the default load‑balancing method configured by the official NGINX Ingress Controller for Kubernetes.

Two-Stage Rate Limiting
NGINX can enforce request rate limits by rejecting excessive requests or by delaying excessive requests until they can be processed within a defined rate limit. NGINX 1.15.7 enabled both of these enforcement methods to be combined in two‑stage rate limiting, whereby excessive requests are initially delayed, and ultimately rejected if they cannot be processed according to the limit. Enable two‑stage rate limiting with the delay parameter to the limit_req directive.

Thanks to Vladislav Shabanov and Peter Shchuchkin for this contribution.

Listen Port Ranges
NGINX 1.15.10 can listen on a range of ports with both the HTTP and Stream modules, implementing a commonly requested feature for FTP proxying.

Maturity of the JavaScript Module
The NGINX JavaScript module (njs) is a convenient scripting extension to NGINX, and offers a range of advanced use cases by extending NGINX. During the NGINX 1.15 development cycle, the JavaScript module received 38 new features over 10 releases. There are too many to list here, but most significant are:

Support for JavaScript modules so that code can be managed across multiple files with the import and exportmethods

Richer support for functions and prototypes, including “fat arrow” functions

Broader support for non‑integer numbers

Binary literals, and conversion to and from bytes

What’s Coming in NGINX 1.17
The first release on the NGINX 1.17 mainline is already here. NGINX 1.17.0 includes support for variables in bandwidth‑limiting configurations with the limit_rate directive and also allows the include directive to be used in all configuration contexts, even inside an if block.

Development has also started on support for QUIC and HTTP/3 – the next significant update to the transport protocols that will deliver websites, applications, and APIs. This is a significant undertaking, but likely to arrive during the NGINX 1.17 development cycle. To get the latest insights on the NGINX roadmap and, our other open source projects and products, join us at NGINX Conf, our annual user conference, this September 9–12 in Seattle.
Click to expand...

negative · May 23, 2019

I'm afraid about upgrade nginx to 1.17 now because of i saw some threads about that problems after upgrade in here.

Everything fixed and can i switch to 1.17 without any problem from 1.15 ?

p.s: using centminmod beta

Sunka · May 23, 2019

# nginx -V
nginx version: nginx/1.17.0 (220519-162634-centos7-kvm)
built by gcc 8.2.1 20180905 (Red Hat 8.2.1-3) (GCC)
built with OpenSSL 1.1.1b 26 Feb 2019
TLS SNI support enabled
configure arguments: --with-ld-opt='-Wl,-E -L/usr/local/zlib-cf/lib -L/usr/local/lib -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/zlib-cf/lib:/usr/local/lib' --with-cc-opt='-I/usr/local/zlib-cf/include -I/usr/local/include -m64 -march=native -DTCP_FASTOPEN=23 -g -O3 -fstack-protector-strong -flto --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wimplicit-fallthrough=0 -fcode-hoisting -Wp,-D_FORTIFY_SOURCE=2 -Wno-deprecated-declarations -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --build=220519-162634-centos7-kvm --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --add-dynamic-module=../ngx_brotli --add-dynamic-module=../ngx_http_geoip2_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.2 --add-module=../ngx_cache_purge-2.5 --add-dynamic-module=../ngx_devel_kit-0.3.0 --add-dynamic-module=../set-misc-nginx-module-0.32 --add-dynamic-module=../echo-nginx-module-0.61 --add-module=../redis2-nginx-module-0.15 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-dynamic-module=../headers-more-nginx-module-0.33 --with-pcre-jit --with-zlib=../zlib-cloudflare-1.3.0 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.1.1b --with-openssl-opt='enable-ec_nistp_64_gcc_128 enable-tls1_3'
Click to expand...

negative · May 23, 2019

@Sunka Did you upgrade it directly (without any comment out or extra configuration) on centminmod beta?

Sunka · May 23, 2019

I upgrade centmin, then nginx. I did that always

Code:

# cat /etc/centminmod/custom_config.inc
NGINX_LIBBROTLI=y # Brotly extension
NGXDYNAMIC_BROTLI=y # Brotly dynamic module extension
NGINX_BROTLIDEP_UPDATE='y' # use the latest tagged version of Google Brotli - http://bit.ly/2S9y3tI
PHP_MEMCACHE=n # memcache PHP extension
PHP_MEMCACHED=n # memcached PHP extension
PHP_PGO='y' # PGO Let It Go - Profile Guided Optimizations for PHP 7
PHPPGO_INDEXPATH='/home/nginx/domains/pijanitvor.com/public/index.php' # path for PGO training
AUDITD_ENABLE='y' # Auditd skripta
RCLONE_ENABLE='y' # Rclone skripta
NGINX_DEVTOOLSETGCC='y' # umjesto clang ide gcc kompilacija kod nginx
DEVTOOLSETEIGHT='y' # ide 8.x verzija gcc kompilacije umjesto defaultne 5.x ili 6.x ili 7.x
#CRYPTO_DEVTOOLSETGCC='y' # newer Intel GCC
#NGINX_HPACK='y' # enabling HPACK for Nginx
NGINX_DYNAMICTLS='y' # add Nginx Dynamic TLS Cloudflare Patch - http://bit.ly/2EYzhk7
NGINXPATCH='y' # add Nginx Dynamic TLS Cloudflare Patch - http://bit.ly/2EYzhk7
NGINX_GEOIPTWOLITE='y' # GeoIP2 Lite nginx module
NGXDYNAMIC_GEOIPTWOLITE='y' # GeoIP2 Lite nginx module
ENABLE_MARIADBTENTHREEUPGRADE='y' # enabling upgrade MariaDB from 10.2.x to 10.3.x
#MARCH_TARGETNATIVE='n' # potrebno da ne zblesira nginx kod reboota servera - http://bit.ly/2SlX3hd
MARCH_TARGETNATIVE_ALWAYS='y' #za sada ovo gore disableano a ovo omoguceno - http://bit.ly/2VODBHf
PHP_ARGON='y' # potrebno za bolji hash algoritam passworda na xenforu
PHP_BROTLI='y' # brotli php extension https://github.com/kjdev/php-ext-brotli
PHP_LZFOUR='y' # lz4 php extension https://github.com/kjdev/php-ext-lz4
PHP_LZF='y' # lzf php extension https://github.com/php/pecl-file_formats-lzf php-ext-lzf
PHP_ZSTD='y' # zstd php extension https://github.com/kjdev/php-ext-zstd
#AUTODETECPHP_OVERRIDE='y' # recompile php exensions on minor php (aka 7.3.x) upgrade

pamamolf · May 23, 2019

Dynamic TLS and hpack for this version ?

Log in / Register

Forums

Discover Centmin Mod today

Nginx [nginx-announce] nginx-1.17.0

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

negative Active Member

Sunka Well-Known Member

negative Active Member

Sunka Well-Known Member

pamamolf Well-Known Member

.

Log in / Register

Useful Searches

Discover Centmin Mod today

Nginx [nginx-announce] nginx-1.17.0

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

eva2000 Administrator Staff Member

negative Active Member

Sunka Well-Known Member

negative Active Member

Sunka Well-Known Member

pamamolf Well-Known Member

.