Welcome to Centmin Mod Community
Become a Member

Beta Branch update Nginx dynamic TLS & HPACK patch support in 123.09beta01

Discussion in 'Centmin Mod Github Commits' started by eva2000, Jan 27, 2022.

  1. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    4:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    update Nginx dynamic TLS & HPACK patch support in 123.09beta01

    - Update optional HTTP/2 HPACK full encoding & TLS dynamic record size patch support for Nginx 1.21.5 and 1.21.6
    - Added 2 variables to control the max Nginx version supported for patching to control any future breakage in Nginx new versions

    NGINX_HPACK_ALLOWED_VER='1021006' # Max allowed Nginx version for Nginx HTTP/2 HPACK full encoding patch support
    NGINX_DYNAMICTLS_ALLOWED_VER='1021006' # Max allowed Nginx version for Nginx Dynamic TLS patch support

    These 2 variables can also be set in persistent config file /etc/centminmod/custom_config.inc to override the defaults to enable newer Nginx versions to at least try to patch HTTP/2 HPACK and TLS dynamic record size patches. i.e. setting below will allow Nginx 1.21.7 to try patching

    NGINX_HPACK_ALLOWED_VER='1021007' # Max allowed Nginx version for Nginx HTTP/2 HPACK full encoding patch support
    NGINX_DYNAMICTLS_ALLOWED_VER='1021007' # Max allowed Nginx version for Nginx Dynamic TLS patch support

    Though if Nginx 1.21.7 has breaking code changes that break patch support, the Nginx will fail to patch and Nginx server may not start properly. Hence, why optional HTTP/2 HPACK full encoding & TLS dynamic record size patch support is always incrementally tested and enabled with each Nginx version. You can use these 2 new variables to control this before Centmin Mod's official updates.

    Continue reading...


    123.09beta01 branch
     
  2. happyhacking

    happyhacking Member

    111
    18
    18
    Apr 23, 2021
    Ratings:
    +61
    Local Time:
    1:34 AM
    1.22.0
    MariadDB 10.4.25
    Confirmed to work properly with Nginx 1.22.0:
    Code:
    NGINX_HPACK_ALLOWED_VER='1022000'
    NGINX_DYNAMICTLS_ALLOWED_VER='1022000'
    
     
  3. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    4:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    Thanks for the confirmation!
     
  4. buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    8:34 AM
    Nginx TLS dynamic record sizing is almost 6 and a half years old.
    Is this patch code still effective vs. upstream?
     
  5. eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    4:34 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    True haven't checked in wireshark but it does patch on latest Nginx versions.

    The original discussions at https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32112 and https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32120 and https://community.centminmod.com/th...cy-tls-dynamic-record-sizing.7592/#post-32129 might shed more light on checking if it's still effective from end users perspective.

    And impact over mobile speed connections https://community.centminmod.com/th...-dynamic-record-sizing.7592/page-2#post-32167

    Though these days there's so many optimisations (from Cloudflare as well) that can effect TTFB improvements too. So if you have Cloudflare in front, Cloudflare serving visitors wouldn't factor in Centmin Mod Nginx dynamic TLS record size patch on that end but will for connection between Cloudflare and Centmin Mod Nginx origin server. But Cloudflare to Centmin Mod Nginx origin connection wouldn't be on slow mobile but fast networks so the benefits of dynamic TLS record size patch might be a lot less. Round trip times on mobile devices can be between 300-800ms while round trip times between Cloudflare Edge servers and Centmin Mod Nginx would be between 50-150ms due to CF having closer datacenters, so saving round trip times with Nginx dynamic TLS record size patch won't have that big of an impact between CF and Centmin Mod Nginx origin servers.

    But I don't see any negatives in enabling dynamic TLS record size patches.