Release of nginx 1.16.0

After a year of development it has been presented A new stable branch of the high-performance HTTP server and multi-protocol proxy server nginx 1.16.0, which incorporates the changes accumulated in the main branch 1.15.x. In the future, all changes in the stable branch 1.16 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.17 will be formed, where the development of new features will continue. For regular users who do not have the task of ensuring compatibility with third-party modules, it is recommended it is recommended to use the main branch, based on which commercial product Nginx Plus releases are generated every three months.

The most noticeable improvements added during the formation of the main branch 1.15.x include:

• The ability to use variables in the directives ‘ssl_certificate‘ and ‘ssl_certificate_key‘, which can be used for dynamic loading of certificates;
• The ability to load SSL certificates and secret keys from variables without using intermediate files;
• In the block ‘upstream‘, a new directive ‘random‘ has been implemented, which can organize load balancing with random server selection for connection forwarding;
• In the module ngx_stream_ssl_preread a variable $ssl_preread_protocol,
  has been implemented, which determines the highest version of the SSL/TLS protocol supported by the client. The variable allows to create configurations for access using various protocols with and without SSL through a single network port when proxying traffic using http and stream modules. For example, to allow access over SSH and HTTPS through a single default port 443, it can be forwarded to SSH, but if the SSL version is defined, it can be forwarded to HTTPS.
• A new variable ‘$upstream_bytes_sent‘ has been added to the upstream module, which displays the number of bytes sent to the server group;
• In the module stream within a single session, the ability to process multiple incoming UDP datagrams from the client has been added;
• In the stream module, a directive ‘proxy_requests‘ has been added, which sets the number of datagrams received from the client, after which the binding between the client and the existing UDP session is removed. After receiving the specified number of datagrams, the next datagram received from the same client starts a new session;
• The listen directive now allows specifying port ranges;
• Added the directive "ssl_early_data" to enable the 0-RTT mode when using TLSv1.3, which retains previously negotiated TLS connection parameters and reduces the number of RTTs to 2 when resuming an established connection;
• New directives have been added for configuring keepalive for outgoing connections (enabling or disabling the SO_KEEPALIVE option for sockets):
  • «proxy_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the proxied server;
  • «fastcgi_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the FastCGI server;
  • «grpc_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the gRPC server;
  • «memcached_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the memcached server;
  • «scgi_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the SCGI server;
  • «uwsgi_socket_keepalive" — configures "TCP keepalive" behavior for outgoing connections to the uwsgi server.
• A new parameter "delay" has been added to the "limit_req " directive, which sets a limit beyond which excessive requests are delayed;
• The "upstream" block has new directives "keepalive_timeout" and "keepalive_requests" added to set limits for Keepalive;
• The "ssl" directive has been deprecated, replaced by the "ssl" parameter in the "listen" directive. Missing SSL certificates are now identified during the configuration testing phase when using the "listen" directive with the "ssl" parameter;
• When using the reset_timedout_connection directive, connections are now closed with code 444 upon timeout;
• SSL errors "http request", "https proxy request", "unsupported protocol", and "version too low" are now logged with the "info" level instead of "crit";
• Support for the poll method on Windows systems is now available when using Windows Vista and later;
• It is now possible to use TLSv1.3 when compiled with the BoringSSL library, not just with OpenSSL.

Source: opennet.ru