From f1d407ab1d57ff9f116fc4022a496b8bc1d8df7c Mon Sep 17 00:00:00 2001 From: Hakase Date: Sat, 7 Apr 2018 17:34:19 +0900 Subject: [PATCH] OpenSSL 1.1.1-pre2 patch --- auto.sh | 2 +- lib/openssl | 2 +- src/http/modules/ngx_http_ssl_module.c | 2 +- src/mail/ngx_mail_ssl_module.c | 2 +- src/stream/ngx_stream_ssl_module.c | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) diff --git a/auto.sh b/auto.sh index f9d2017..adfd4bf 100755 --- a/auto.sh +++ b/auto.sh @@ -40,7 +40,7 @@ fi auto/configure \ --with-cc-opt='-DTCP_FASTOPEN=23 -m64 -g -O3 -march=native -fstack-protector-strong -fuse-ld=gold -fuse-linker-plugin --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wno-strict-aliasing -Wp,-D_FORTIFY_SOURCE=2 -gsplit-dwarf -DNGX_HTTP_HEADERS' \ --with-ld-opt='-ljemalloc -Wl,-z,relro' \ ---with-openssl-opt="enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers no-ssl3-method -DCFLAGS='-march=native -O3 -fuse-linker-plugin'" \ +--with-openssl-opt="enable-tls13downgrade enable-ec_nistp_64_gcc_128 enable-weak-ssl-ciphers no-ssl3-method -DCFLAGS='-march=native -O3 -fuse-linker-plugin'" \ --builddir=objs --prefix=/usr/local/nginx \ --conf-path=/etc/nginx/nginx.conf \ --pid-path=/var/run/nginx.pid \ diff --git a/lib/openssl b/lib/openssl index 82a44d2..bbac8ca 160000 --- a/lib/openssl +++ b/lib/openssl @@ -1 +1 @@ -Subproject commit 82a44d248311b408a10e30fa809df307efb5c216 +Subproject commit bbac8ca55dff1d376493e25ad529a617088fc759 diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c index 1ac20db..c700c40 100644 --- a/src/http/modules/ngx_http_ssl_module.c +++ b/src/http/modules/ngx_http_ssl_module.c @@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" +#define NGX_DEFAULT_CIPHERS "[TLS13-AES-128-GCM-SHA256|TLS13-CHACHA20-POLY1305-SHA256]:TLS13-AES-256-GCM-SHA384:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521" #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c index 71ed651..f5fafbb 100644 --- a/src/mail/ngx_mail_ssl_module.c +++ b/src/mail/ngx_mail_ssl_module.c @@ -10,7 +10,7 @@ #include -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" +#define NGX_DEFAULT_CIPHERS "[TLS13-AES-128-GCM-SHA256|TLS13-CHACHA20-POLY1305-SHA256]:TLS13-AES-256-GCM-SHA384:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521" diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c index da6a47c..31c6146 100644 --- a/src/stream/ngx_stream_ssl_module.c +++ b/src/stream/ngx_stream_ssl_module.c @@ -14,7 +14,7 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); -#define NGX_DEFAULT_CIPHERS "[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" +#define NGX_DEFAULT_CIPHERS "[TLS13-AES-128-GCM-SHA256|TLS13-CHACHA20-POLY1305-SHA256]:TLS13-AES-256-GCM-SHA384:[EECDH+ECDSA+AESGCM+AES128|EECDH+ECDSA+CHACHA20]:EECDH+ECDSA+AESGCM+AES256:EECDH+ECDSA+AES128+SHA:EECDH+ECDSA+AES256+SHA:[EECDH+aRSA+AESGCM+AES128|EECDH+aRSA+CHACHA20]:EECDH+aRSA+AESGCM+AES256:EECDH+aRSA+AES128+SHA:EECDH+aRSA+AES256+SHA:RSA+AESGCM+AES128:RSA+AESGCM+AES256:RSA+AES128+SHA:RSA+AES256+SHA:RSA+3DES" #define NGX_DEFAULT_ECDH_CURVE "X25519:P-256:P-384:P-224:P-521"