From 4bfd3bb69e605fab380821ff3477cd20c8c08cbf Mon Sep 17 00:00:00 2001 From: Hakase Date: Wed, 30 May 2018 15:02:28 +0900 Subject: [PATCH] Update OpenSSL 1.1.1-pre8, SSL Ciphers, submodule. --- README.md | 14 +++++++------- lib/openssl | 2 +- lib/zlib | 2 +- src/http/modules/ngx_http_ssl_module.c | 2 +- src/mail/ngx_mail_ssl_module.c | 3 ++- src/stream/ngx_stream_ssl_module.c | 2 +- 6 files changed, 13 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index d1feae1..ad79592 100644 --- a/README.md +++ b/README.md @@ -21,15 +21,15 @@ - Auto SSL Cipher settings - **The following information is preset. Do not set it yourself unless you need it.** - ssl_protocols : TLSv1.2 TLSv1.3 - - ssl_ciphers : [EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA - - ssl_prefer_server_ciphers : on + - ssl_ciphers : [TLS13+AESGCM+AES128|TLS13+CHACHA20]:TLS13+AESGCM+AES256:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA + - ssl_prefer_server_ciphers : On - ssl_ecdh_curve : X25519:P-256:P-384 - - DO NOT USE **ssl_dhparam**. not required. + - DO NOT USE **ssl_dhparam**. Not required. - TLS v1.3 (draft 23, 28) - - Use OpenSSL-1.1.1-pre7-dev (**draft 23, 28**) - - Use OpenSSL Equal Preference Patch ([BoringSSL](https://github.com/google/boringssl) & [CentminMod](https://centminmod.com/)) - - My Equal Preference Patch is [here](https://git.hakase.app/Hakase/openssl-patch/src/branch/master/openssl-equal-pre7-draft23_28.patch) -- Prefers ChaCha20 suites with clients that don't have AES-NI (e.g., Android devices) + - Use OpenSSL-1.1.1-pre8-dev (**draft 23, 28**) + - Use OpenSSL equal preference patch ([BoringSSL](https://github.com/google/boringssl) & [CentminMod](https://centminmod.com/)) + - My equal preference patch is [here](https://git.hakase.app/Hakase/openssl-patch/src/branch/master/openssl-equal-pre8_ciphers.patch) +- Prefers ChaCha20 suites with clients that don't have AES-NI(AES hardware acceleration) (e.g., Android devices) - More library! - headers_more_nginx_module - Google PageSpeed for nginx diff --git a/lib/openssl b/lib/openssl index dd5f37f..9335fb2 160000 --- a/lib/openssl +++ b/lib/openssl @@ -1 +1 @@ -Subproject commit dd5f37f94922809c5722d2af83e5da916b392f9c +Subproject commit 9335fb2e1926e0c351b6f4d17673c8a77b7829ea diff --git a/lib/zlib b/lib/zlib index 9465261..0c6bb2b 160000 --- a/lib/zlib +++ b/lib/zlib @@ -1 +1 @@ -Subproject commit 94652610e8cb2334440f03b4248ed26b53322d3d +Subproject commit 0c6bb2be0fe760b1a9beda50183b69968f85143c diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index 26f0b9f..352bbc1 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" +#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+AESGCM+AES256|TLS13+CHACHA20]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384" #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c index 2fdf835..b841f08 100644 --- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c @@ -10,7 +10,8 @@ #include -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" +#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+AESGCM+AES256|TLS13+CHACHA20]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" + #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384" diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c index de38a75..48c549c 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c @@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" +#define NGX_DEFAULT_CIPHERS "[TLS13+AESGCM+AES128|TLS13+AESGCM+AES256|TLS13+CHACHA20]:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA" #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384"