After a year of development, a new stable branch of the high-performance HTTP server and multi-protocol proxy server nginx 1.28.0 has been released, incorporating changes accumulated in the main branch 1.27.x. In the future, all changes in the stable branch 1.28 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.29 will be formed, in which the development of new features will continue. For regular users who do not need to ensure compatibility with third-party modules, it is recommended to use the main branch, based on which commercial product Nginx Plus releases are created every three months.
According to the March report by Netcraft, approximately 245 million sites operate under nginx (240 million a year ago, 289 million two years ago). Nginx is used on 17.89% of all active sites (18.15% a year ago, 18.94% two years ago), which corresponds to the first place in popularity in this category (the share of Apache is 16.03% (20.09% a year ago, 20.52% two years ago), Cloudflare — 17.81% (14.12%, 11.32%), Google — 9.89% (10.41%, 9.89%).
When considering all sites, nginx maintains its leadership with a market share of 20.48% (22.31% a year ago, 25.94% two years ago), while Apache's share is 16.03% (20.17%, 20.58%), Cloudflare — 12.87% (11.24%, 10.17%), OpenResty (a platform based on nginx and LuaJIT) — 9.36% (7.93%, 7.94%).
Among the million most visited sites in the world, nginx holds the second place with a share of 20.37% (20.63% a year ago, 21.37% two years ago). Cloudflare holds the first place — 22.32% (22.59% a year ago, 21.62% two years ago). The share of Apache httpd is 17.95% (20.09%, 21.18%).
According to W3Techs, nginx is used on 33.8% of the million most visited sites (this figure was 34.3% last April, and 34.5% the year before). The share of Apache declined from 30.1% to 26.3% over the year, and the share of Microsoft IIS decreased from 5% to 4%. The share of Node.js increased from 3.2% to 4.4%, while LiteSpeed's share rose from 12.9% to 14.6%.
The most notable improvements added during the formation of the main branch 1.27.x:
- Support for the CUBIC congestion control algorithm (RFC 9438) has been added for connections using the QUIC protocol. CUBIC works by gradually increasing the congestion window size until packet loss occurs, at which point the window size reverts to the value before the loss. In conducted tests, using CUBIC reduced the transfer time of a 500MB file by 24% at 40ms latency and BDP 750K (Bandwidth Delay Product), and by 73% at 100ms latency and BDP 9M.
- The stream module now includes support for client certificate revocation checking using the OCSP (Online Certificate Status Protocol).
- The stream module implements OCSP Stapling, which allows the server serving the website to send the OCSP response, signed by a certification authority, during the TLS handshake without requiring a direct request to the certification authority.
- Caching has been implemented during the startup and configuration update. SSL certificates, of keys and CRL (Certificate Revocation List).
- Features have been added to reduce resource consumption and decrease CPU load when using TLS in configurations with a large number of server and location blocks. The changes allow for instead of creating a separate SSL context (SSL_CTX in OpenSSL) for each configuration block, to use the existing SSL context from the parent block.
- The "ssl_client_certificate" directive now supports certificates with additional information.
- For verifying client SSL certificates, the "ssl_client_certificate" directive is no longer mandatory.
- Support for SmarterMail-specific IMAP LOGIN mode with untagged CAPABILITY response has been added to the ngx_mail_proxy_module.
- The "proxy_pass_trailers" directive has been added to the ngx_http_proxy_module, allowing header fields to be passed at the end of the response from the proxied server to the client.
- The "resolve" parameter has been added to the "server" directive used in the upstream block, enabling tracking changes an IP address to the used domain name and automatic updating of the upstream block configuration without the need to restart nginx when the address changes.
- The ability to use variables in the "proxy_limit_rate", "fastcgi_limit_rate", "scgi_limit_rate", and "uwsgi_limit_rate" directives has been added.
- In the directives "proxy_bind", "fastcgi_bind", "grpc_bind", "memcached_bind", "scgi_bind", and "uwsgi_bind", as well as in the client address for the ngx_http_realip_module, specifying IPv6 addresses in square brackets without a port number is now permitted.
- The directive "keepalive_min_timeout" has been added, defining the timeout during which nginx will not close the keep-alive connection with the client.
- TLSv1 and TLSv1.1 protocols are disabled by default.
- Resolved issues with slow loading of configuration files due to the re-parsing of the same set of TLS certificates, keys, and certificate authority lists. The configuration reload speed has been increased by reusing unchanged TLS objects such as certificates, keys, and CRLs. The directive 'ssl_object_cache_inheritable' has been added to disable object inheritance when updating configuration.
- Caching has been added for certificates and keys loaded using variables in directives (e.g., "ssl_certificate /etc/ssl/$ssl_server_name.crt"). Directives for managing the cache, such as "ssl_certificate_cache", "proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache", and "uwsgi_ssl_certificate_cache", have been added. Through these directives, you can configure the maximum cache size, record expiration time, and the time to clean up unused records. For example: "ssl_certificate_cache max=1000 inactive=20s valid=1m;".
- Reduced memory consumption when handling long-lived requests in configurations using the 'gzip', 'gunzip', 'ssi', 'sub_filter', or 'grpc_pass' directives.
- The maximum size of SSL sessions cacheable in shared memory has been increased to 8192.
- Established a build with the Musl C library.
- Work has been done to optimize performance and fix bugs in the HTTP/3 implementation.
Additionally, we can note the release of FreeNginx 1.28.0, a fork of Nginx being developed by Maxim Dunin, one of the key Nginx developers. FreeNginx is positioned as a non-commercial project that ensures the development of the Nginx codebase without corporate interference. Among the specific changes in the FreeNginx 1.28 branch:
- The 'off' parameter in the 'pid' directive, which disables PID file creation.
- Limiting the intensity of message logging to avoid log fill-up with routine messages.
- Implementation of the multipath parameter in the listen directive to support Multipath TCP.
- Support for the HTTP 'Age' header to determine the lifetime of cache entries.
- Addition of XOAUTH2 and OAUTHBEARER authentication methods in the mail_proxy module.
Source: opennet.ru
