Beta Branch update Nginx dynamic TLS & HPACK patch support in 123.09beta01

update Nginx dynamic TLS & HPACK patch support in 123.09beta01

- Update optional HTTP/2 HPACK full encoding & TLS dynamic record size patch support for Nginx 1.21.5 and 1.21.6
- Added 2 variables to control the max Nginx version supported for patching to control any future breakage in Nginx new versions

NGINX_HPACK_ALLOWED_VER='1021006' # Max allowed Nginx version for Nginx HTTP/2 HPACK full encoding patch support
NGINX_DYNAMICTLS_ALLOWED_VER='1021006' # Max allowed Nginx version for Nginx Dynamic TLS patch support

These 2 variables can also be set in persistent config file /etc/centminmod/custom_config.inc to override the defaults to enable newer Nginx versions to at least try to patch HTTP/2 HPACK and TLS dynamic record size patches. i.e. setting below will allow Nginx 1.21.7 to try patching

NGINX_HPACK_ALLOWED_VER='1021007' # Max allowed Nginx version for Nginx HTTP/2 HPACK full encoding patch support
NGINX_DYNAMICTLS_ALLOWED_VER='1021007' # Max allowed Nginx version for Nginx Dynamic TLS patch support

Though if Nginx 1.21.7 has breaking code changes that break patch support, the Nginx will fail to patch and Nginx server may not start properly. Hence, why optional HTTP/2 HPACK full encoding & TLS dynamic record size patch support is always incrementally tested and enabled with each Nginx version. You can use these 2 new variables to control this before Centmin Mod's official updates.

Continue reading...

---

123.09beta01 branch

• Branch: https://github.com/centminmod/centminmod/tree/123.09beta01
• Commit History: https://github.com/centminmod/centminmod/commits/123.09beta01

 

Thanks for the confirmation!

 

True haven't checked in wireshark but it does patch on latest Nginx versions.

The original discussions at https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32112 and https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32120 and https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32129 might shed more light on checking if it's still effective from end users perspective.

And impact over mobile speed connections https://community.centminmod.com/th...-dynamic-record-sizing.7592/page-2#post-32167

Though these days there's so many optimisations (from Cloudflare as well) that can effect TTFB improvements too. So if you have Cloudflare in front, Cloudflare serving visitors wouldn't factor in Centmin Mod Nginx dynamic TLS record size patch on that end but will for connection between Cloudflare and Centmin Mod Nginx origin server. But Cloudflare to Centmin Mod Nginx origin connection wouldn't be on slow mobile but fast networks so the benefits of dynamic TLS record size patch might be a lot less. Round trip times on mobile devices can be between 300-800ms while round trip times between Cloudflare Edge servers and Centmin Mod Nginx would be between 50-150ms due to CF having closer datacenters, so saving round trip times with Nginx dynamic TLS record size patch won't have that big of an impact between CF and Centmin Mod Nginx origin servers.

But I don't see any negatives in enabling dynamic TLS record size patches.