ludra/nginx-build
1
0 Fork 0
forked from Hakase/nginx-build
Code Issues Pull Requests Releases Wiki Activity

Secure: Redefine SSL_OP_NO_RENEGOTIATION & Add SSL_OP_PRIORITIZE_CHACHA (OpenSSL 1.1.x, Using OpenSSL built-in)

Browse Source
This commit is contained in:
Hakase
2018-09-27 02:22:28 +09:00
parent 9763686ccc
commit 3909a37669
1 changed files with 8 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/event/ngx_event_openssl.c
+8 -3
View File
@@ -350,6 +350,14 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION); SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
#endif #endif
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_RENEGOTIATION);
#endif
#ifdef SSL_OP_PRIORITIZE_CHACHA
SSL_CTX_set_options(ssl->ctx, SSL_OP_PRIORITIZE_CHACHA);
#endif
#ifdef SSL_OP_NO_COMPRESSION #ifdef SSL_OP_NO_COMPRESSION
SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION); SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
#endif #endif
@@ -1295,9 +1303,6 @@ ngx_ssl_create_connection(ngx_ssl_t *ssl, ngx_connection_t *c, ngx_uint_t flags)
} else { } else {
SSL_set_accept_state(sc->connection); SSL_set_accept_state(sc->connection);
#ifdef SSL_OP_NO_RENEGOTIATION
SSL_set_options(sc->connection, SSL_OP_NO_RENEGOTIATION);
#endif
} }
if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) { if (SSL_set_ex_data(sc->connection, ngx_ssl_connection_index, c) == 0) {