Version bump.

README

@@ -119,10 +119,6 @@ Experimental QUIC support for nginx
 
         ssl_early_data on;
 
-    Make sure that TLS 1.3 is configured which is required for QUIC:
-
-        ssl_protocols TLSv1.3;
-
     To enable GSO (Generic Segmentation Offloading):
 
         quic_gso on;
@@ -135,6 +131,8 @@ Experimental QUIC support for nginx
 
         quic_host_key <filename>;
 
+    QUIC requires TLSv1.3 protocol, which is enabled by the default
+    by "ssl_protocols" directive.
 
     By default, GSO Linux-specific optimization [10] is disabled.
     Enable it in case a corresponding network interface is configured to
@@ -175,7 +173,6 @@ Example configuration:
 
             ssl_certificate     certs/example.com.crt;
             ssl_certificate_key certs/example.com.key;
-            ssl_protocols       TLSv1.3;
 
             location / {
                 # required for browsers to direct them into quic port

src/core/nginx.h

@@ -9,8 +9,8 @@
 #define _NGINX_H_INCLUDED_
 
 
-#define nginx_version      1023003
-#define NGINX_VERSION      "1.23.3"
+#define nginx_version      1025000
+#define NGINX_VERSION      "1.25.0"
 #define NGINX_VER          "nginx/" NGINX_VERSION " by Hakase"
 
 #ifndef NGINX_SERVER

src/http/modules/ngx_http_ssl_module.c

@@ -19,7 +19,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
 
 
 #define NGX_DEFAULT_CIPHERS     "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
-#define NGX_DEFAULT_ECDH_CURVE  "X25519:P-256:P-384:P-521"
+#define NGX_DEFAULT_ECDH_CURVE  "X25519KYBER:X25519:P-256:P-384:P-521"
 
 #define NGX_HTTP_ALPN_PROTOS    "\x08http/1.1\x08http/1.0\x08http/0.9"
 

src/mail/ngx_mail_ssl_module.c

@@ -11,7 +11,7 @@
 
 
 #define NGX_DEFAULT_CIPHERS     "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
-#define NGX_DEFAULT_ECDH_CURVE  "X25519:P-256:P-384:P-521"
+#define NGX_DEFAULT_ECDH_CURVE  "X25519KYBER:X25519:P-256:P-384:P-521"
 
 
 

src/stream/ngx_stream_ssl_module.c

@@ -19,7 +19,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
 
 
 #define NGX_DEFAULT_CIPHERS     "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA"
-#define NGX_DEFAULT_ECDH_CURVE  "X25519:P-256:P-384:P-521"
+#define NGX_DEFAULT_ECDH_CURVE  "X25519KYBER:X25519:P-256:P-384:P-521"
 
 
 static ngx_int_t ngx_stream_ssl_handler(ngx_stream_session_t *s);