Kutulutsidwa kwa nginx 1.28.0 ndi foloko FreeNginx 1.28.0

Pambuyo pa chaka cha chitukuko, nthambi yatsopano yokhazikika ya seva yapamwamba ya HTTP ndi seva ya protocol multi-protocol nginx 1.28.0 yasindikizidwa, yomwe imaphatikizapo kusintha komwe kunapezeka mu nthambi yaikulu 1.27.x. M'tsogolomu, kusintha konse mu nthambi yokhazikika 1.28 kudzakhudzana ndi kuthetsa zolakwika zazikulu ndi zofooka. Posachedwa nthambi yayikulu ya nginx 1.29 idzapangidwa, momwe chitukuko cha zinthu zatsopano chidzapitirira. Kwa ogwiritsa ntchito wamba omwe alibe ntchito yowonetsetsa kuti akugwirizana ndi ma module a chipani chachitatu, tikulimbikitsidwa kugwiritsa ntchito nthambi yayikulu, pamaziko omwe kutulutsidwa kwa malonda a Nginx Plus kumapangidwa miyezi itatu iliyonse.

Malinga ndi lipoti la Marichi lochokera ku Netcraft, pafupifupi masamba 245 miliyoni akuyenda pansi pa nginx (243 miliyoni pachaka chapitacho, 289 miliyoni zaka ziwiri zapitazo). Nginx imagwiritsidwa ntchito pa 17.89% ya malo onse ogwira ntchito (18.15% chaka chapitacho, 18.94% zaka ziwiri zapitazo), zomwe zimagwirizana ndi malo oyamba kutchuka m'gululi (gawo la Apache likufanana ndi 16.03% (20.09% chaka chapitacho, 20.52% zaka ziwiri zapitazo), Cloudflare - 17.81% 14.12%, 11.32%. Google - 9.89% (10.41%, 9.89%).

Poganizira malo onse, nginx imasunga utsogoleri wake ndipo imakhala 20.48% ya msika (chaka chapitacho 22.31%, zaka ziwiri zapitazo - 25.94%), pamene gawo la Apache ndi 16.03% (20.17%, 20.58%), Cloudflare - 12.87% (11.24, 10.17. ndi LuaJIT) - 9.36% (7.93%, 7.94%).

Pakati pa miliyoni miliyoni omwe adachezeredwa kwambiri padziko lonse lapansi, nginx imakhala yachiwiri ndi gawo la 20.37% (chaka chapitacho 20.63%, zaka ziwiri zapitazo 21.37%). Cloudflare ili ndi malo oyamba ndi 22.32% (22.59% chaka chapitacho, 21.62% zaka ziwiri zapitazo). Apache httpd gawo ndi 17.95% (20.09%, 21.18%).

Malinga ndi W3Techs, nginx imagwiritsidwa ntchito pa 33.8% ya malo ochezera mamiliyoni ambiri (mu April chaka chatha chiwerengerochi chinali 34.3%, chaka chatha - 34.5%). Gawo la Apache lidatsika kuchokera ku 30.1% mpaka 26.3% pachaka, pomwe gawo la Microsoft IIS lidatsika kuchokera ku 5% mpaka 4%. Gawo la Node.js lidakwera kuchokera 3.2% mpaka 4.4%, ndipo gawo la LiteSpeed ​​​​kuchokera 12.9% mpaka 14.6%.

Zowoneka bwino zomwe zidawonjezedwa pakukula kwa nthambi yakumtunda kwa 1.27.x:

• Kwa maulumikizidwe pogwiritsa ntchito protocol ya QUIC, chithandizo chawonjezeredwa kwa CUBIC network congestion control algorithm (RFC 9438), yomwe imagwira ntchito pang'onopang'ono kuwonjezera kukula kwazenera mpaka kutayika kwa paketi, pambuyo pake kukula kwazenera kumabwereranso kumtengo kusanayambe kutayika. M'mayesero omwe adachitidwa, kugwiritsa ntchito CUBIC kunapangitsa kuti kuchepetsa nthawi yotumizira fayilo ya 500MB ndi 24% ndi kuchedwa kwa 40ms ndi BDP 750K (Bandwidth Delay Product) ndi 73% ndi kuchedwa kwa 100ms ndi BDP 9M.
• Gawo la stream lawonjezera chithandizo chowunikira kuthetsedwa kwa ziphaso za kasitomala pogwiritsa ntchito OCSP (Online Certificate Status Protocol).
• Gawo la stream limagwiritsa ntchito njira yowunikira kuchotsera satifiketi ya OCSP Stapling, chomwe chimati mukakambirana ndi TLS, yankho la OCSP lotsimikiziridwa ndi oyang'anira certification limaperekedwa ndi seva yomwe imathandizira tsambalo, popanda kufunika kolumikizana mwachindunji ndi certification Authority).
• Kusunga deta kumachitika panthawi yoyambira ndi kusintha kwa zosintha. Zikalata za SSL, makiyi ndi CRL (Mndandanda Wochotsera Satifiketi).
• Kuthekera kowonjezera kuti muchepetse kugwiritsa ntchito zida ndi kuchuluka kwa CPU mukamagwiritsa ntchito TLS pamasinthidwe okhala ndi ma seva ambiri ndi midadada yamalo. Zosintha zowonjezeredwa zimalola, m'malo mopanga mawonekedwe osiyana a SSL (SSL_CTX mu OpenSSL) pa block iliyonse yosinthira, kugwiritsa ntchito zomwe zilipo za SSL kuchokera pa block ya makolo.
• Lamulo la "ssl_client_certificate" limapereka chithandizo pamasatifiketi okhala ndi zambiri.
• Kuti mutsimikizire ziphaso za kasitomala SSL, malangizo a "ssl_client_certificate" sakufunikanso.
• Thandizo lowonjezera la SmarterMail-specific IMAP LOGIN mode ndi yankho losatchulidwa la CAPABILITY ku ngx_mail_proxy_module module.
• Lamulo la "proxy_pass_trailers" lawonjezedwa ku ngx_http_proxy_module module, kulola kufalitsa minda yamutu kumapeto kwa yankho kuchokera ku seva ya proxied kupita kwa kasitomala.
• Lamulo la "seva" lomwe limagwiritsidwa ntchito mu block ya "upstream" lasinthidwa kuti lithandizire gawo la "resolve", lomwe limalola kutsatira kusintha. IP ma adilesi pa dzina la domain lomwe lagwiritsidwa ntchito komanso kusinthidwa kwa "upstream" block configuration popanda kufunikira kuyambitsanso nginx ngati adilesi yasintha.
• Anawonjezera kuthekera kogwiritsa ntchito zosinthika mu "proxy_limit_rate", "fastcgi_limit_rate", "scgi_limit_rate" ndi "uwsgi_limit_rate" malangizo.
• Mu "proxy_bind", "fastcgi_bind", "grpc_bind", "memcached_bind", "scgi_bind" ndi "uwsgi_bind" malangizo, komanso adilesi yamakasitomala mu ngx_http_realip_module, ma adilesi a IPv6 m'mabulaketi sikweya opanda nambala ya doko amaloledwa.
• Onjezani malangizo a "keepalive_min_timeout", omwe amatanthauzira nthawi yomwe nginx sidzatseka kulumikizidwa kwamoyo ndi kasitomala.
• Mwachisawawa, ma protocol a TLSv1 ndi TLSv1.1 azimitsidwa.
• Nkhani zokhazikika ndikutsitsa kwanthawi yayitali kwamafayilo osinthika chifukwa chakubwereza mobwerezabwereza ma satifiketi a TLS, makiyi ndi mndandanda wa maulamuliro a certification. Kongoletsani kukwezanso magwiridwe antchito pogwiritsa ntchitonso zinthu zomwe sizinasinthidwe za TLS monga masatifiketi, makiyi, ndi ma CRL. Kuti mulepheretse cholowa cha zinthu mukasintha kasinthidwe, malangizo a "ssl_object_cache_inheritable" awonjezedwa.
• Chosungira chowonjezera cha ziphaso ndi makiyi omwe adayikidwa pogwiritsa ntchito zosinthika (monga "ssl_certificate /etc/ssl/$ssl_server_name.crt"). Malangizo a "ssl_certificate_cache", "proxy_ssl_certificate_cache", "grpc_ssl_certificate_cache" ndi "uwsgi_ssl_certificate_cache" awonjezedwa kuti azisamalira cache. Malangizo omwe atchulidwa amakulolani kuti musinthe kukula kwa cache, nthawi yovomerezeka ya zolemba, ndi nthawi yoyeretsa zolemba zomwe sizinagwiritsidwe ntchito. Mwachitsanzo: "ssl_certificate_cache max=1000 inactive=20s valid=1m;".
• Kuchepetsa kukumbukira kukumbukira pamene mukukonza mafunso omwe akhalapo nthawi yayitali pamasinthidwe omwe amagwiritsa ntchito "gzip", "gunzip", "ssi", "sub_filter", kapena "grpc_pass" malangizo.
• Kukula kwakukulu kwa magawo a SSL osungidwa mumakumbukidwe omwe adagawana nawo akwezedwa mpaka 8192.
• Msonkhano wokhala ndi laibulale ya Musl C wakhazikitsidwa.
• Ntchito yachitika pofuna kukhathamiritsa magwiridwe antchito ndikuchotsa zolakwika pakukhazikitsa kwa HTTP/3.

Kuphatikiza apo, ndikofunikira kuzindikira kutulutsidwa kwa pulojekiti ya FreeNginx 1.28.0, yomwe imapanga foloko ya Nginx. Foloko ikupangidwa ndi a Maxim Dunin, m'modzi mwa oyambitsa ma Nginx. FreeNginx imadziyika yokha ngati projekiti yopanda phindu yomwe imapereka chitukuko cha Nginx codebase popanda kusokonezedwa ndi makampani. Mwa zosintha zenizeni mu nthambi ya FreeNginx 1.28:

• Gawo la "off" mu "pid" malangizo limalepheretsa kupanga fayilo ya PID.
• Kuchepetsa kuchulukira kwa kulemba mauthenga ku chipika cholemba zolakwika kuti chipikacho chisadzaze ndi mauthenga wamba.
• Kukhazikitsa kwa parameter ya multipath mu malangizo omvera kuti athandizire Multipath TCP.
• Kuthandizira pamutu wa "Age" wa HTTP kuti mufotokozere moyo wazomwe zasungidwa.
• Kuwonjezera XOAUTH2 ndi njira za OAUTHBEARER zotsimikizira ku gawo la mail_proxy.

Source: opennet.ru