Mercurial > hg > nginx
changeset 8152:d1cf09451ae8
SSL: enabled TLSv1.3 by default.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Fri, 24 Mar 2023 02:57:43 +0300 |
parents | a5e6e8510634 |
children | fcb2333c9982 |
files | src/http/modules/ngx_http_grpc_module.c src/http/modules/ngx_http_proxy_module.c src/http/modules/ngx_http_ssl_module.c src/http/modules/ngx_http_uwsgi_module.c src/mail/ngx_mail_ssl_module.c src/stream/ngx_stream_proxy_module.c src/stream/ngx_stream_ssl_module.c |
diffstat | 7 files changed, 21 insertions(+), 14 deletions(-) [+] |
line wrap: on
line diff
--- a/src/http/modules/ngx_http_grpc_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_grpc_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -4473,8 +4473,9 @@ prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
--- a/src/http/modules/ngx_http_proxy_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_proxy_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -3734,8 +3734,9 @@ prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
--- a/src/http/modules/ngx_http_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -632,8 +632,9 @@ ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, NGX_SSL_BUFSIZE);
--- a/src/http/modules/ngx_http_uwsgi_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/http/modules/ngx_http_uwsgi_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -1875,8 +1875,9 @@ prev->upstream.ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
--- a/src/mail/ngx_mail_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/mail/ngx_mail_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -360,8 +360,9 @@ prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
--- a/src/stream/ngx_stream_proxy_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/stream/ngx_stream_proxy_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -2163,8 +2163,9 @@ prev->ssl_session_reuse, 1); ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, "DEFAULT");
--- a/src/stream/ngx_stream_ssl_module.c Fri Mar 24 02:53:21 2023 +0300 +++ b/src/stream/ngx_stream_ssl_module.c Fri Mar 24 02:57:43 2023 +0300 @@ -703,8 +703,9 @@ prev->prefer_server_ciphers, 0); ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); + (NGX_CONF_BITMASK_SET + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);