After 13 months of development, a new stable branch of the high-performance HTTP server and multi-protocol proxy server nginx 1.22.0 has been released, incorporating changes accumulated in the main branch 1.21.x. Moving forward, all changes in the stable branch 1.22 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.23 will be formed, where the development of new features will continue. For regular users who do not need to maintain compatibility with third-party modules, it is recommended to use the main branch, which forms releases of the commercial product Nginx Plus every three months.
According to the April report from Netcraft, nginx is used on 20.08% of all active sites (20.15% a year ago, 19.56% two years ago), ranking second in popularity in this category (Apache's share is 22.58% (25.38% a year ago), Cloudflare ā 10.42% (8.51%), Google ā 8.89% (10.09%). Meanwhile, when considering all websites, nginx maintains leadership, holding 31.13% of the market (35.34% a year ago, 36.91% two years ago), while Apacheās share is 23.08% (25.98%), OpenResty (a platform based on nginx and LuaJIT) ā 8.01% (6.55%), Cloudflare ā 5.49%, and Microsoft IIS ā 4% (5.96%).
Among the million most visited websites in the world, nginx accounts for 21.79% (23.06% a year ago, 25.54% two years ago). Currently, approximately 361 million websites are powered by nginx (419 million a year ago). According to W3Techs, nginx is used on 33.5% of the million most visited sites, down from 33.8% in May of last year and 31.9% two years ago. Apache's share has decreased from 33.8% to 31.5% over the past year, while Microsoft IIS's share has fallen from 7% to 6%. LiteSpeed's share has increased from 8.5% to 12.1%, and Node.js from 1.2% to 1.9%. In Russia, nginx is used on 79.8% of the most visited sites (79.1% a year ago).
The most notable improvements added during the formation of the main branch 1.21.x:
- Support for variables has been added in the directives 'proxy_ssl_certificate', 'proxy_ssl_certificate_key', 'grpc_ssl_certificate', 'grpc_ssl_certificate_key', 'uwsgi_ssl_certificate', and 'uwsgi_ssl_certificate_key'.
- The mail proxy module has added support for the 'pipelining' mode to transmit multiple POP3 or IMAP requests over a single connection, as well as a new directive 'max_errors' that defines the maximum number of protocol errors after which the connection will be closed.
- Headers 'Auth-SSL-Protocol' and 'Auth-SSL-Cipher' have been implemented. server for mail proxy authentication.
- The stream module has added support for the TLS extension ALPN. The ssl_alpn directive is proposed to determine the list of supported ALPN protocols (h2, http/1.1), and the variable $ssl_alpn_protocol is provided to obtain information about the ALPN protocol agreed upon with the client.
- A parameter 'fastopen' has been added to the stream module, enabling 'TCP Fast Open' mode for listening sockets.
- Character escaping for symbols Ā«Ā»Ā», Ā«Ā», Ā«\Ā», Ā«^Ā», Ā«`Ā», Ā«{Ā«, Ā«|Ā» and Ā«}Ā» has been established when proxying with URI modification.
- The stream module has added the proxy_half_close directive, which allows configuring behavior when closing a proxied TCP connection on one side (TCP half-close).
- The ngx_http_mp4_module has introduced a new directive mp4_start_key_frame for streaming video from the keyframe.
- The variable $ssl_curve has been added, which returns the type of elliptic curve chosen for key agreement in the TLS session.
- In the 'sendfile_max_chunk' directive, the default value has been changed to 2 megabytes;
- Compatibility with OpenSSL 3.0 is ensured. Support for calling SSL_sendfile() when using OpenSSL 3.0 has been added.
- By default, the build now includes the PCRE2 library, which provides functions for regular expression processing.
- During certificate loading server the use of security levels supported from OpenSSL 1.1.0 and specified through the parameter ā@SECLEVEL=Nā in the ssl_ciphers directive has been established.
- Support for the export cipher suite has been discontinued.
- Buffering of processed data has been allowed in the request body filtering API.
- On the FreeBSD platform, support for the sendfile system call has been improved, designed for direct data transfer between a file descriptor and a socket. The sendfile(SF_NODISKIO) mode is always enabled, and support for sendfile(SF_NOCACHE) mode has been added.
- Support for establishing HTTP/2 connections using the NPN (Next Protocol Negotiation) extension instead of ALPN has been discontinued.
- Blocking of HTTP/1.0 requests that include the HTTP header āTransfer-Encodingā (which appeared in HTTP/1.1 protocol version) has been ensured.
- Protection against HTTP Request Smuggling attacks on frontend-backend systems has been strengthened, preventing interference with the content of requests from other users being processed in the same stream between the frontend and backend. Nginx now always returns an error when using the CONNECT method; when both āContent-Lengthā and āTransfer-Encodingā headers are specified simultaneously; and when there are spaces or control characters in the request line, HTTP header name, or value of the āHostā header.
Source: opennet.ru
