Release of nginx 1.30.0 and fork of FreeNginx 1.30.0.

After a year of development, a new stable branch of the high-performance HTTP server and multi-protocol proxy server nginx 1.30.0 has been released, incorporating changes accumulated in the main branch 1.29.x. Moving forward, all changes in the stable branch 1.30 will focus on fixing serious bugs and vulnerabilities. Soon, the main branch nginx 1.31 will be formed, continuing the development of new features. For regular users who do not need to ensure compatibility with third-party modules, it is recommended to use the main branch, on the basis of which releases of the commercial product Nginx Plus are produced every three months. The nginx code is written in C and distributed under the BSD license.

According to the February report by Netcraft, approximately 321 million sites are run on nginx (245 million a year ago, 243 million two years ago, and 289 million three years ago). Nginx is used on 16.08% of all active sites (17.89% a year ago, 18.15% two years ago, and 18.94% three years ago), making it the second most popular in this category (Apache holds 13.27% (16.03% a year ago, 20.09% two years ago, and 20.52% three years ago), Cloudflare — 20.62% (17.81%, 14.12%, 11.32%), Google — 10.65% (9.89%, 10.41%, 9.89%).

When considering all sites, nginx retains the lead with 22.65% of the market share (20.48% a year ago, 22.31% two years ago, and 25.94% three years ago), while Apache's share is 12.19% (16.03%, 20.17%, 20.58%), Cloudflare — 15.27% (12.87%, 11.24%, 10.17%), and OpenResty (a platform based on nginx and LuaJIT) — 8.01% (9.36%, 7.93%, 7.94%).

Among the million most visited sites in the world, nginx ranks second with a share of 19.85% (20.37% a year ago, 20.63% two years ago, and 21.37% three years ago). Cloudflare holds the top spot — 26.84% (22.32%, 22.59%, 21.62%). Apache httpd's share is 15.84% (17.95%, 20.09%, 21.18%).

According to W3Techs, nginx is used on 32.8% of the million most visited sites (this figure was 33.8% in April last year, and 34.3% the year before). Apache's share decreased over the year from 26.3% to 23.9%, Microsoft IIS's share dropped from 4% to 3.4%, and Caddy's share fell from 0.3% to 0.2%. Node.js's share increased from 4.4% to 6.0%, while LiteSpeed's share grew from 14.6% to 15.2%.

The most notable improvements added during the formation of the main branch 1.29.x:

• Support for the TLS extension ECH (Encrypted ClientHello) has been added, further developing the ESNI (Encrypted Server Name Indication) extension. This is used to encrypt information about TLS session parameters, such as the requested domain name. The key difference between ECH and ESNI is that in ECH, instead of encrypting specific fields, the entire TLS ClientHello message is encrypted. This helps to prevent leaks through fields not covered by ESNI, such as the PSK (Pre-Shared Key) field. ECH support is enabled by specifying the «ssl_ech_file» directive in the ECHConfig configuration file in PEM format. Support is available with OpenSSL builds that include ECH.
• Support for Multipath TCP (MPTCP) has been added, allowing packets to be delivered simultaneously over multiple routes through different network interfaces. A 'multipath' parameter has been added to the 'listen' directive to enable this.
• The ability to bind client sessions to the same servers in a group has been added. Three methods are available: «cookie» — transmitting data about the selected server through the specified Cookie; «route» — the proxy server assigns a route to the client upon receiving the first request; «learn» — nginx analyzes responses from the upstream server and memorizes sessions initiated by the server. To configure binding, the «sticky» directive has been added to the «upstream» block of the «http» module, while the «server» directive has been enhanced with «route» and «drain» parameters.
• The «early_hints» directive has been added, and support for HTTP status code 103 in responses from proxy and gRPC backends has been implemented. Code 103 allows the server to inform the client about certain HTTP headers immediately after the request, without waiting for the server to complete all associated operations and start delivering content. Similarly, hints about elements related to the page being served can be communicated, which may be preloaded (for example, links to CSS and JavaScript used on the page). Upon receiving information about such resources, the browser will begin loading them without waiting for the main page to finish delivering, thereby reducing the overall request processing time.
• The directives add_header_inherit and add_trailer_inherit have been added, allowing changes to the inheritance rules of values specified in the add_header and add_trailer directives. The «off» parameter disables the inheritance of values, while the «merge» parameter enables the addition of values from the previous level to the values at the current level.
• The 'ssl_certificate_compression' directive has been added to control compression. for TLS certificates.
• A max_headers directive has been added to limit the maximum number of HTTP headers in a request. If the limit is exceeded, a 400 (Bad Request) error is returned. This feature has been migrated from FreeNginx.
• Two variables $request_port and $is_request_port have been added. The first variable contains the port number from the URI component or from the 'Host' header, and the second contains ':' if the $request_port variable is not empty.
• Two variables $ssl_sigalg and $ssl_client_sigalg have been added, containing the name of the digital signature algorithm for the TLS connection.
• The 'geo' directive has been enhanced with the 'volatile' parameter, which disables the caching of the variable. It is now allowed to use masks in the 'include' directive specified within the 'geo' block.
• In the 'upstream' block, the 'keepalive' directive is enabled by default. The 'local' parameter has been added to the 'keepalive' directive used in the 'upstream' block. With this parameter, instead of sharing a single connection to a common upstream server mentioned in different location and server blocks, a separate connection to the upstream is maintained for each block.
• When operating in proxy mode, the HTTP protocol version is set to HTTP/1.1 by default with keep-alive mode enabled (the ngx_http_proxy_module has keep-alive support enabled by default and sets the 'proxy_http_version' directive value to '1.1', stopping the default sending of the 'Connection' header).
• Support for the HTTP/2 protocol has been added to the ngx_http_proxy module, allowing the use of HTTP/2 when accessing backends.
• Support has been provided for loading cryptographic keys from hardware tokens, using the OpenSSL library as the provider.
• Support for 0-RTT mode has been added to the QUIC protocol implementation, available on systems with OpenSSL 3.5.1 and newer releases.
• The ability to build with the AWS-LC cryptographic library, developed by Amazon, has been added.
• Certificate compression for TLSv1.3 is disabled by default.
• Compatibility with OpenSSL 4.0 has been ensured.

Additionally, the release of FreeNginx 1.30.0 has been published, developing the Nginx fork. The fork is being developed by Maxim Dunin, one of the key developers of Nginx. FreeNginx is positioned as a non-commercial project that ensures the development of the Nginx codebase without corporate interference. The FreeNginx code continues to be provided under the BSD license. Changes in the FreeNginx 1.30 branch include: support for the TLS extension ECH (Encrypted Client Hello) has been added; improved handling of the limit_rate directive; new directives send_min_rate and client_body_min_rate have been introduced; functionality for limiting the number of connections and request intensity in the mail proxy has been implemented; support for GeoIP2 DB has been added in the GeoIP module; and stronger protection has been added to the XSLT module.

Source: opennet.ru