Latest update - v1.1.1c

README.md

@@ -70,6 +70,7 @@ Example of setting TLS 1.3 cipher in nginx:
 | nginx_hpack_remove_server_header_1.15.3.patch | HPACK + Remove nginx server header. (http2, http1.1) |
 | nginx_strict-sni.patch | Enable **Strict-SNI**. Thanks [@JemmyLoveJenny](https://github.com/JemmyLoveJenny). [View issue](https://github.com/hakasenyang/openssl-patch/issues/1#issuecomment-421551872) |
 | nginx_openssl-1.1.x_renegotiation_bugfix.patch | Bugfix **Secure Client-Initiated Renegotiation**. (Check testssl.sh) OpenSSL >= 1.1.x, nginx = 1.15.4<br>[Patched nginx 1.15.5](https://github.com/nginx/nginx/commit/53803b4780be15d8014be183d4161091fd5f3376) |
+| nginx_ocsp.sh | Some of the parts that can not get OCSP Stapling value at nginx start or reload are solved.<br>OCSP stapling in nginx is made up of a callback, so you only need to connect at least once to get the value.<br>This file is a temporary file and may not work normally. |
 
 ## How To Use?
 

nginx_ocsp.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+
+gets() {
+  if [ ! -z "$2" ]; then
+    port=$2
+  else
+    port=443
+  fi
+  echo QUIT | openssl s_client -connect 127.0.0.1:${2} -servername ${1} -tls1_2 -cipher ECDH -status > /dev/null 2>&1
+  echo QUIT | openssl s_client -connect 127.0.0.1:${2} -servername ${1} -tls1_2 -cipher aRSA:RSA -status > /dev/null 2>&1
+}
+
+file=`find /etc/nginx -name "*.conf"`
+
+for names in $file; do
+  # csplit source : https://stackoverflow.com/questions/9634953/how-to-split-a-nginx-virtual-host-config-file-into-small-ones-using-shell/38635284
+  rm /tmp/ngx_ocsp*.tmp > /dev/null 2>&1
+  csplit -z -f /tmp/ngx_ocsp -b %d.tmp $names '/^\s*server\s*{*$/' {*} > /dev/null 2>&1
+
+  for i in /tmp/ngx_ocsp*.tmp; do
+    result=`grep -oP '(?<=server_name ).+(?=;)' $i`
+    if [ ! -z "$result" ]; then
+      port=`grep -oP '(?<=listen ).+(?=ssl).+(?=;)' $i`
+      new_name=`echo $result|awk '{print $1}'`
+      new_name=${new_name%';'}
+      port=`echo $port|sed 's/[^0-9]/ /g'|awk '{print $1}'`
+      port=${port%';'}
+      if [ ! -z "$port" ]; then
+        hosts=(${hosts[@]} $new_name:$port)
+      fi
+    fi
+  done
+done
+
+rm /rmp/ocsp*.tmp > /dev/null 2>&1
+
+FINALS=`echo ${hosts[@]} | tr " " "\n" | sed -e "s/^*//g" | sed -e "s/*/wildcards/g" | sort -u`
+
+for conn in $FINALS; do
+  data1=`echo $conn | awk -F: '{print $1}'`
+  data2=`echo $conn | awk -F: '{print $2}'`
+  echo OCSP : $data1 - $data2
+  gets $data1 $data2
+done

openssl-1.1.1c-chacha_draft.patch

@@ -11,7 +11,7 @@ index 086b3c4d51..5699901f7d 100644
  #endif
  }
 diff --git a/crypto/evp/e_chacha20_poly1305.c b/crypto/evp/e_chacha20_poly1305.c
-index d3e2c622a1..ef679522d1 100644
+index d3e2c622a1..e61c9e1bea 100644
 --- a/crypto/evp/e_chacha20_poly1305.c
 +++ b/crypto/evp/e_chacha20_poly1305.c
 @@ -156,6 +156,7 @@ typedef struct {
@@ -194,7 +194,7 @@ index d3e2c622a1..ef679522d1 100644
 +    NID_chacha20_poly1305_draft,
 +    1,                  /* block_size */
 +    CHACHA_KEY_SIZE,    /* key_len */
-+    0,                 /* iv_len, none */
++    0,                  /* iv_len, none */
 +    EVP_CIPH_FLAG_AEAD_CIPHER | EVP_CIPH_CUSTOM_IV |
 +    EVP_CIPH_ALWAYS_CALL_INIT | EVP_CIPH_CTRL_INIT |
 +    EVP_CIPH_CUSTOM_COPY | EVP_CIPH_FLAG_CUSTOM_CIPHER,
@@ -431,7 +431,7 @@ index 99ae48199c..7e36a0d7ea 100644
       1,
       TLS1_TXT_PSK_WITH_CHACHA20_POLY1305,
 diff --git a/ssl/ssl_ciph.c b/ssl/ssl_ciph.c
-index b60d67aa0d..ce750c4425 100644
+index b60d67aa0d..7dac0053a2 100644
 --- a/ssl/ssl_ciph.c
 +++ b/ssl/ssl_ciph.c
 @@ -43,7 +43,8 @@
@@ -460,17 +460,7 @@ index b60d67aa0d..ce750c4425 100644
  
      {0, SSL_TXT_ARIA, NULL, 0, 0, 0, SSL_ARIA},
      {0, SSL_TXT_ARIA_GCM, NULL, 0, 0, 0, SSL_ARIA128GCM | SSL_ARIA256GCM},
-@@ -1791,6 +1794,9 @@ char *SSL_CIPHER_description(const SSL_CIPHER *cipher, char *buf, int len)
+@@ -2115,7 +2118,7 @@ int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead,
-     case SSL_CHACHA20POLY1305:
-         enc = "CHACHA20/POLY1305(256)";
-         break;
-+    case SSL_CHACHA20POLY1305_D:
-+        enc = "CHACHA20/POLY1305-Draft(256)";
-+        break;
-     default:
-         enc = "unknown";
-         break;
-@@ -2115,7 +2121,7 @@ int ssl_cipher_get_overhead(const SSL_CIPHER *c, size_t *mac_overhead,
          out = EVP_CCM_TLS_EXPLICIT_IV_LEN + 16;
      } else if (c->algorithm_enc & (SSL_AES128CCM8 | SSL_AES256CCM8)) {
          out = EVP_CCM_TLS_EXPLICIT_IV_LEN + 8;
@@ -499,11 +489,11 @@ index 33db1460ab..00c5ee4cff 100644
  # define SSL_ARIA                (SSL_ARIAGCM)
  
 diff --git a/util/libcrypto.num b/util/libcrypto.num
-index 32c64cb2c7..86cb7a994b 100644
+index 32c64cb2c7..9574117daa 100644
 --- a/util/libcrypto.num
 +++ b/util/libcrypto.num
 @@ -4579,3 +4579,4 @@ EVP_PKEY_meth_set_digest_custom         4532	1_1_1	EXIST::FUNCTION:
  EVP_PKEY_meth_get_digest_custom         4533	1_1_1	EXIST::FUNCTION:
  OPENSSL_INIT_set_config_filename        4534	1_1_1b	EXIST::FUNCTION:STDIO
  OPENSSL_INIT_set_config_file_flags      4535	1_1_1b	EXIST::FUNCTION:STDIO
-+EVP_chacha20_poly1305_draft             4536	1_1_0	EXIST::FUNCTION:CHACHA,POLY1305
++EVP_chacha20_poly1305_draft             4536	1_1_1c	EXIST::FUNCTION:CHACHA,POLY1305