After a year of development, a new stable branch of the high-performance HTTP server and multiprotocol proxy server nginx 1.26.0 has been released, incorporating changes accumulated in the main branch 1.25.x. Going forward, all changes in the stable branch 1.26 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.27 will be formed, where the development of new features will continue. For regular users who do not need to ensure compatibility with third-party modules, it is recommended to use the main branch, on the basis of which commercial product Nginx Plus releases are formed every three months.
According to the March report from Netcraft, approximately 243 million sites are running on nginx (down from 289 million a year ago). Nginx is used on 18.15% of all active sites (down from 18.94% a year ago, 20.08% two years ago), making it the second most popular option in this category (Apache's share is 20.09% (down from 20.52% last year, 22.58% two years ago), Cloudflare — 14.12% (up from 11.32%, 10.42%), Google — 10.41% (up from 9.89%, 8.89%). When considering all websites, nginx maintains its lead with a 22.31% market share (down from 25.94% last year, 31.13% two years ago), while Apache holds 20.17% (down from 20.58%, 23.08%), Cloudflare — 11.24% (up from 10.17%, 5.49%), and OpenResty (a platform based on nginx and LuaJIT) — 7.93% (down from 7.94%, 8.01%).
Among the million most visited websites in the world, nginx's share stands at 20.63% (down from 21.37% a year ago, and 21.79% two years ago), Cloudflare at 22.59% (up from 21.62% last year), and Apache httpd at 20.09% (down from 21.18%). According to W3Techs, nginx is used on 34.3% of the million most visited sites, a slight decrease from 34.5% in April of last year and from 33.1% two years prior. Apache's share has dropped from 32.2% to 30.1% over the past year, while Microsoft IIS's share declined from 5.6% to 4.8%. Node.js's share increased from 2.4% to 3.2%, and LiteSpeed's share rose from 11.8% to 12.9%.
The most notable improvements added during the formation of the main branch 1.25.x:
- The ngx_http_v3 module has been added with experimental support for the HTTP/3 protocol. To build the module, the option "--with-http_v3_module" is provided. HTTP/3 defines the use of the QUIC (Quick UDP Internet Connections) protocol as the transport for HTTP/2. QUIC is a layer built on top of the UDP protocol, supporting multiplexing of multiple connections while providing encryption methods equivalent to TLS/SSL. This protocol was created in 2013 by Google as an alternative to the TCP+TLS combination for the Web, addressing issues with long setup and handshake times in TCP and eliminating delays caused by packet loss during data transmission.
- A separate directive "http2" has been added for selectively enabling the HTTP/2 protocol linked to servers (it can be used in individual "server" blocks). The "http2" parameter in the "listen" directive has been deprecated.
- Protection against abnormal HTTP/2 client activity has been enhanced, particularly against "Rapid Reset" DoS attacks, which create a large number of simultaneously reset streams within a single HTTP/2 connection. In the default configuration, such attacks hit the limit on the number of requests per connection with "keepalive_requests" (after every 1000 requests, the connection will be reset) and the "limit_req" constraints. To react more quickly to request flooding through a large number of streams, an additional restriction has been added, preventing by default the creation of more than 256 (2 * max_concurrent_streams) new streams for each event handling cycle. This new limit allows for request blocking to begin before reaching the overall limit on the number of concurrent streams, for example, when streams are processed asynchronously or reset.
- Support for the stream module has been added of virtual servers, the configuration of which is defined in the "server { … }" block using the server_name directive. server { server_name ~^(www\.)?(.+)$; proxy_pass www.$2:12345; }
- A new ngx_stream_pass_module has been added, designed to pass accepted connections directly to any listening socket associated with modules like http, stream, and mail. stream { server { listen 12345 ssl; ssl_certificate domain.crt; ssl_certificate_key domain.key; pass 127.0.0.1:8000; } }
- Support for the parameters "deferred" (enables deferred accept), "accept_filter" (filter for incoming connections applied before the accept function is called), and "setfib" (specifies the routing table) has been implemented in the listen directive of the stream module.
- Support for determining the block size (cache line) used for data transmission between the CPU cache and memory has been implemented for some architectures.
- Buffer management used for automatic detection of HTTP/2 connections has been improved.
- Performance of configurations with a large number of 'location' directives has been enhanced.
- Support for Server Push technology in HTTP/2 has been removed.
- Support for the 'ssl' directive, which was previously deprecated, has been discontinued.
The stable release of the FreeNginx project 1.26.0, which develops a fork of Nginx, was published two weeks ago. The fork is developed by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project that ensures the development of the Nginx codebase without corporate interference.
Source: opennet.ru
