Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
home:efellows
nginx
0007-Enable-TLSv1.3-by-default.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File 0007-Enable-TLSv1.3-by-default.patch of Package nginx
From cc7b92c61a2833ff9dc2b4dfba4591966769da78 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Lubo=C5=A1=20Uhliarik?= <luhliari@redhat.com> Date: Tue, 21 Jun 2022 13:55:04 +0200 Subject: [PATCH] Enable TLSv1.3 by default in nginx --- src/event/ngx_event_openssl.c | 77 ++++++++++++++------------ src/event/ngx_event_openssl.h | 1 + src/http/modules/ngx_http_ssl_module.c | 3 +- src/mail/ngx_mail_ssl_module.c | 3 +- src/stream/ngx_stream_ssl_module.c | 3 +- 5 files changed, 46 insertions(+), 41 deletions(-) diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c index f813458..2e6a6c0 100644 --- a/src/event/ngx_event_openssl.c +++ b/src/event/ngx_event_openssl.c @@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log) ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) { + ngx_uint_t prot = NGX_SSL_NO_PROT; + ssl->ctx = SSL_CTX_new(SSLv23_method()); if (ssl->ctx == NULL) { @@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data) SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE); -#if OPENSSL_VERSION_NUMBER >= 0x009080dfL - /* only in 0.9.8m+ */ - SSL_CTX_clear_options(ssl->ctx, - SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1); -#endif - - if (!(protocols & NGX_SSL_SSLv2)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2); - } - if (!(protocols & NGX_SSL_SSLv3)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3); - } - if (!(protocols & NGX_SSL_TLSv1)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1); - } -#ifdef SSL_OP_NO_TLSv1_1 - SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1); - if (!(protocols & NGX_SSL_TLSv1_1)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1); - } + if (protocols){ +#ifdef SSL_OP_NO_TLSv1_3 + if (protocols & NGX_SSL_TLSv1_3) { + prot = TLS1_3_VERSION; + } else #endif #ifdef SSL_OP_NO_TLSv1_2 - SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2); - if (!(protocols & NGX_SSL_TLSv1_2)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2); - } + if (protocols & NGX_SSL_TLSv1_2) { + prot = TLS1_2_VERSION; + } else #endif -#ifdef SSL_OP_NO_TLSv1_3 - SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3); - if (!(protocols & NGX_SSL_TLSv1_3)) { - SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3); - } +#ifdef SSL_OP_NO_TLSv1_1 + if (protocols & NGX_SSL_TLSv1_1) { + prot = TLS1_1_VERSION; + } else #endif + if (protocols & NGX_SSL_TLSv1) { + prot = TLS1_VERSION; + } + + if (prot == NGX_SSL_NO_PROT) { + ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, + "No SSL protocols available [hint: ssl_protocols]"); + return NGX_ERROR; + } -#ifdef SSL_CTX_set_min_proto_version - SSL_CTX_set_min_proto_version(ssl->ctx, 0); - SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION); + SSL_CTX_set_max_proto_version(ssl->ctx, prot); + + /* Now, we have to scan for minimal protocol version, + *without allowing holes between min and max*/ +#ifdef SSL_OP_NO_TLSv1_3 + if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) { + prot = TLS1_2_VERSION; + } #endif -#ifdef TLS1_3_VERSION - SSL_CTX_set_min_proto_version(ssl->ctx, 0); - SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); +#ifdef SSL_OP_NO_TLSv1_1 + if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) { + prot = TLS1_1_VERSION; + } +#endif +#ifdef SSL_OP_NO_TLSv1_2 + if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) { + prot = TLS1_VERSION; + } #endif + SSL_CTX_set_min_proto_version(ssl->ctx, prot); + } #ifdef SSL_OP_NO_COMPRESSION SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h index 329760d..5cee113 100644 --- a/src/event/ngx_event_openssl.h +++ b/src/event/ngx_event_openssl.h @@ -152,6 +152,7 @@ typedef struct { #endif +#define NGX_SSL_NO_PROT 0x0000 #define NGX_SSL_SSLv2 0x0002 #define NGX_SSL_SSLv3 0x0004 #define NGX_SSL_TLSv1 0x0008 diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index a47d696..94f30db 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child) ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + 0) ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, NGX_SSL_BUFSIZE); diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c index 7eae83e..8328560 100644 --- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c @@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c index d8c0471..cef590d 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c @@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child) prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + 0); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); -- 2.31.1
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor
