Hakase/nginx-build
2
1 Fork 1
Code Issues Pull Requests Releases Activity

Changes in session time between TLS 1.3 and TLS 1.3 when using sessions, Disabling TLSv1.1 and TLSv1

Browse Source
This commit is contained in:
Hakase
2019-04-13 23:15:49 +09:00
parent 08dd8bbd68
commit 0118903869
8 changed files with 51 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/event/ngx_event_openssl.c
+2 -1
View File
@@ -3109,11 +3109,12 @@ ngx_ssl_error(ngx_uint_t level, ngx_log_t *log, ngx_err_t err, char *fmt, ...)
ngx_int_t
ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
ngx_array_t *certificates, ssize_t builtin_session_cache,
ngx_shm_zone_t *shm_zone, time_t timeout)
ngx_shm_zone_t *shm_zone, time_t timeout, time_t timeout_tls13)
{
long cache_mode;
SSL_CTX_set_timeout(ssl->ctx, (long) timeout);
SSL_CTX_set_timeout_tls13(ssl->ctx, (long) timeout_tls13);
if (ngx_ssl_session_id_context(ssl, sess_ctx, certificates) != NGX_OK) {
return NGX_ERROR;
src/event/ngx_event_openssl.h
+1 -1
View File
@@ -206,7 +206,7 @@ ngx_int_t ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_uint_t enable);
ngx_int_t ngx_ssl_session_cache(ngx_ssl_t *ssl, ngx_str_t *sess_ctx,
ngx_array_t *certificates, ssize_t builtin_session_cache,
ngx_shm_zone_t *shm_zone, time_t timeout);
ngx_shm_zone_t *shm_zone, time_t timeout, time_t timeout_tls13);
ngx_int_t ngx_ssl_session_ticket_keys(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_array_t *paths);
ngx_int_t ngx_ssl_session_cache_init(ngx_shm_zone_t *shm_zone, void *data);
src/http/modules/ngx_http_ssl_module.c
+15 -5
View File
@@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
ngx_pool_t *pool, ngx_str_t *s);
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES"
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
@@ -207,6 +207,13 @@ static ngx_command_t ngx_http_ssl_commands[] = {
offsetof(ngx_http_ssl_srv_conf_t, session_timeout),
NULL },
{ ngx_string("ssl_session_timeout_tls13"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_sec_slot,
NGX_HTTP_SRV_CONF_OFFSET,
offsetof(ngx_http_ssl_srv_conf_t, session_timeout_tls13),
NULL },
{ ngx_string("ssl_crl"),
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_str_slot,
@@ -611,6 +618,7 @@ ngx_http_ssl_create_srv_conf(ngx_conf_t *cf)
sscf->passwords = NGX_CONF_UNSET_PTR;
sscf->builtin_session_cache = NGX_CONF_UNSET;
sscf->session_timeout = NGX_CONF_UNSET;
sscf->session_timeout_tls13 = NGX_CONF_UNSET;
sscf->session_tickets = NGX_CONF_UNSET;
sscf->session_ticket_keys = NGX_CONF_UNSET_PTR;
sscf->stapling = NGX_CONF_UNSET;
@@ -645,7 +653,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
}
ngx_conf_merge_value(conf->session_timeout,
prev->session_timeout, 86400);
prev->session_timeout, 64800);
ngx_conf_merge_value(conf->session_timeout_tls13,
prev->session_timeout_tls13, 172800);
ngx_conf_merge_value(conf->prefer_server_ciphers,
prev->prefer_server_ciphers, 1);
@@ -653,8 +664,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
ngx_conf_merge_value(conf->early_data, prev->early_data, 1);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
NGX_SSL_BUFSIZE);
@@ -873,7 +883,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
if (ngx_ssl_session_cache(&conf->ssl, &ngx_http_ssl_sess_id_ctx,
conf->certificates, conf->builtin_session_cache,
conf->shm_zone, conf->session_timeout)
conf->shm_zone, conf->session_timeout, conf->session_timeout_tls13)
!= NGX_OK)
{
return NGX_CONF_ERROR;
src/http/modules/ngx_http_ssl_module.h
+1
View File
@@ -32,6 +32,7 @@ typedef struct {
ssize_t builtin_session_cache;
time_t session_timeout;
time_t session_timeout_tls13;
ngx_array_t *certificates;
ngx_array_t *certificate_keys;
src/mail/ngx_mail_ssl_module.c
+15 -5
View File
@@ -10,7 +10,7 @@
#include <ngx_mail.h>
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES"
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521"
@@ -161,6 +161,13 @@ static ngx_command_t ngx_mail_ssl_commands[] = {
offsetof(ngx_mail_ssl_conf_t, session_timeout),
NULL },
{ ngx_string("ssl_session_timeout_tls13"),
NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_sec_slot,
NGX_MAIL_SRV_CONF_OFFSET,
offsetof(ngx_mail_ssl_conf_t, session_timeout_tls13),
NULL },
{ ngx_string("ssl_verify_client"),
NGX_MAIL_MAIN_CONF|NGX_MAIL_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_enum_slot,
@@ -264,6 +271,7 @@ ngx_mail_ssl_create_conf(ngx_conf_t *cf)
scf->verify_depth = NGX_CONF_UNSET_UINT;
scf->builtin_session_cache = NGX_CONF_UNSET;
scf->session_timeout = NGX_CONF_UNSET;
scf->session_timeout_tls13 = NGX_CONF_UNSET;
scf->session_tickets = NGX_CONF_UNSET;
scf->session_ticket_keys = NGX_CONF_UNSET_PTR;
@@ -285,14 +293,16 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
NGX_MAIL_STARTTLS_OFF);
ngx_conf_merge_value(conf->session_timeout,
prev->session_timeout, 300);
prev->session_timeout, 64800);
ngx_conf_merge_value(conf->session_timeout_tls13,
prev->session_timeout_tls13, 172800);
ngx_conf_merge_value(conf->prefer_server_ciphers,
prev->prefer_server_ciphers, 1);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
@@ -437,7 +447,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
if (ngx_ssl_session_cache(&conf->ssl, &ngx_mail_ssl_sess_id_ctx,
conf->certificates, conf->builtin_session_cache,
conf->shm_zone, conf->session_timeout)
conf->shm_zone, conf->session_timeout, conf->session_timeout_tls13)
!= NGX_OK)
{
return NGX_CONF_ERROR;
src/mail/ngx_mail_ssl_module.h
+1
View File
@@ -35,6 +35,7 @@ typedef struct {
ssize_t builtin_session_cache;
time_t session_timeout;
time_t session_timeout_tls13;
ngx_array_t *certificates;
ngx_array_t *certificate_keys;
src/stream/ngx_stream_ssl_module.c
+15 -5
View File
@@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
ngx_pool_t *pool, ngx_str_t *s);
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES"
#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
#define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521"
@@ -189,6 +189,13 @@ static ngx_command_t ngx_stream_ssl_commands[] = {
offsetof(ngx_stream_ssl_conf_t, session_timeout),
NULL },
{ ngx_string("ssl_session_timeout_tls13"),
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_sec_slot,
NGX_STREAM_SRV_CONF_OFFSET,
offsetof(ngx_stream_ssl_conf_t, session_timeout_tls13),
NULL },
{ ngx_string("ssl_crl"),
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
ngx_conf_set_str_slot,
@@ -600,6 +607,7 @@ ngx_stream_ssl_create_conf(ngx_conf_t *cf)
scf->verify_depth = NGX_CONF_UNSET_UINT;
scf->builtin_session_cache = NGX_CONF_UNSET;
scf->session_timeout = NGX_CONF_UNSET;
scf->session_timeout_tls13 = NGX_CONF_UNSET;
scf->session_tickets = NGX_CONF_UNSET;
scf->session_ticket_keys = NGX_CONF_UNSET_PTR;
@@ -619,14 +627,16 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
prev->handshake_timeout, 60000);
ngx_conf_merge_value(conf->session_timeout,
prev->session_timeout, 300);
prev->session_timeout, 64800);
ngx_conf_merge_value(conf->session_timeout,
prev->session_timeout, 172800);
ngx_conf_merge_value(conf->prefer_server_ciphers,
prev->prefer_server_ciphers, 1);
ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
|NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
(NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3));
ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
@@ -787,7 +797,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
if (ngx_ssl_session_cache(&conf->ssl, &ngx_stream_ssl_sess_id_ctx,
conf->certificates, conf->builtin_session_cache,
conf->shm_zone, conf->session_timeout)
conf->shm_zone, conf->session_timeout, conf->session_timeout_tls13)
!= NGX_OK)
{
return NGX_CONF_ERROR;
src/stream/ngx_stream_ssl_module.h
+1
View File
@@ -30,6 +30,7 @@ typedef struct {
ssize_t builtin_session_cache;
time_t session_timeout;
time_t session_timeout_tls13;
ngx_array_t *certificates;
ngx_array_t *certificate_keys;