nginx 1.16.0 release

After a year of development represented new stable branch of high performance HTTP server and multiprotocol proxy server nginx 1.16.0, which has absorbed the changes accumulated within the 1.15.x main branch. In the future, all changes in the 1.16 stable branch will be related to the elimination of serious bugs and vulnerabilities. The main branch of nginx 1.17 will soon be formed, within which the development of new features will continue. For ordinary users who do not have the task of ensuring compatibility with third-party modules, recommended use the main branch, on the basis of which releases of the commercial Nginx Plus product are formed every three months.

The most notable improvements added during the formation of the 1.15.x main branch:

• Added the ability to use variables in directives 'ssl_certificate'and'ssl_certificate_key', which can be used to load certificates dynamically;
• Added the ability to load SSL certificates and secret keys from variables without using intermediate files;
• In the block "upstream» new directive implemented «random“, with which you can organize load balancing with a random selection of a server for connection forwarding;
• In the module ngx_stream_ssl_preread variable implemented $ssl_preread_protocol,
  which specifies the largest version of the SSL/TLS protocol that the client supports. Variable allows create configurations for access using various protocols with and without SSL through one network port when proxying traffic using the http and stream modules. For example, to organize access via SSH and HTTPS through one port 443, the default port can be forwarded to SSH, but if the SSL version is defined, forward to HTTPS.

• A new variable has been added to the upstream module "$upstream_bytes_sent“, which displays the number of bytes transferred to the group server;
• To the module stream added the ability to process multiple incoming UDP datagrams from a client within a single session;
• The "stream" directive has been added to the stream module.proxy_requests", which specifies the number of datagrams received from the client, after which the binding between the client and the existing UDP session is removed. After receiving the specified number of datagrams, the next datagram received from the same client starts a new session;
• The listen directive now has the ability to specify port ranges;
• Added directive "ssl_early_data» to enable the mode 0-RTT when using TLSv1.3, which allows you to save previously negotiated TLS connection parameters and reduce the number of RTTs to 2 when resuming a previously established connection;
• New directives have been added to configure keepalive for outgoing connections (enable or disable the SO_KEEPALIVE option for sockets):
  • «proxy_socket_keepalive" - configures the "TCP keepalive" behavior for outgoing connections to the proxied server;
  • «fastcgi_socket_keepalive" - configures the "TCP keepalive" behavior for outgoing connections to the FastCGI server;
  • «grpc_socket_keepalive" - configures the "TCP keepalive" behavior for outgoing connections to the gRPC server;
  • «memcached_socket_keepalive' - configures the "TCP keepalive" behavior for outgoing connections to the memcached server;
  • «scgi_socket_keepalive" - configures the "TCP keepalive" behavior for outgoing connections to the SCGI server;
  • «uwsgi_socket_keepalive' - configures the 'TCP keepalive' behavior for outgoing connections to the uwsgi server.
• In the directivelimit_req" added a new "delay" parameter that sets the limit upon reaching which excessive requests are delayed;
• New "keepalive_timeout" and "keepalive_requests" directives have been added to the "upstream" block to set limits for Keepalive;
• The "ssl" directive has been deprecated, replaced by the "ssl" parameter in the "listen" directive. Missing SSL certificates are now detected at the configuration testing stage when using the "listen" directive with the "ssl" parameter in the settings;
• When using the reset_timedout_connection directive, when the timeout expires, the connections are now closed with the code 444;
• SSL errors "http request", "https proxy request", "unsupported protocol" and "version too low" are now displayed in the log with the level "info" instead of "crit";
• Added support for the poll method on Windows systems using Windows Vista and newer;
• Provided the ability to use TLSv1.3 when building with the BoringSSL library, and not just with OpenSSL.

Source: opennet.ru