From 3909a376693893af98bfd4af41bcebb63ff504cf Mon Sep 17 00:00:00 2001
From: Hakase <hakase@hakase.app>
Date: Thu, 27 Sep 2018 02:22:28 +0900
Subject: [PATCH] Secure: Redefine SSL_OP_NO_RENEGOTIATION & Add
 SSL_OP_PRIORITIZE_CHACHA (OpenSSL 1.1.x, Using OpenSSL built-in)

---
 src/event/ngx_event_openssl.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 4f9da0b..f42189c 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -350,6 +350,14 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
     SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
 #endif
 
+#ifdef SSL_OP_NO_RENEGOTIATION
+    SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_RENEGOTIATION);
+#endif
+
+#ifdef SSL_OP_PRIORITIZE_CHACHA
+    SSL_CTX_set_options(ssl->ctx, SSL_OP_PRIORITIZE_CHACHA);
+#endif
+
 #ifdef SSL_OP_NO_COMPRESSION
     SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
 #endif
@@ -1295,9 +1303,6 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
     } else {
         SSL_set_accept_state(sc->connection);
 
-#ifdef SSL_OP_NO_RENEGOTIATION
-        SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
-#endif
     }
 
     if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {