ignatenkobrain / rpms / nginx

Forked from rpms/nginx 2 years ago
Clone
0bbbd2
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
0bbbd2
index 2b0c5e6..9278087 100644
0bbbd2
--- a/src/event/ngx_event_openssl.c
0bbbd2
+++ b/src/event/ngx_event_openssl.c
0bbbd2
@@ -258,6 +258,8 @@ ngx_ssl_init(ngx_log_t *log)
0bbbd2
 ngx_int_t
0bbbd2
 ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
0bbbd2
 {
0bbbd2
+    ngx_uint_t prot = NGX_SSL_NO_PROT;
0bbbd2
+
0bbbd2
     ssl->ctx = SSL_CTX_new(SSLv23_method());
0bbbd2
 
0bbbd2
     if (ssl->ctx == NULL) {
0bbbd2
@@ -322,49 +324,54 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
0bbbd2
 
0bbbd2
     SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
0bbbd2
 
0bbbd2
-#if OPENSSL_VERSION_NUMBER >= 0x009080dfL
0bbbd2
-    /* only in 0.9.8m+ */
0bbbd2
-    SSL_CTX_clear_options(ssl->ctx,
0bbbd2
-                          SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_TLSv1);
0bbbd2
-#endif
0bbbd2
-
0bbbd2
-    if (!(protocols & NGX_SSL_SSLv2)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
0bbbd2
-    }
0bbbd2
-    if (!(protocols & NGX_SSL_SSLv3)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
0bbbd2
-    }
0bbbd2
-    if (!(protocols & NGX_SSL_TLSv1)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
0bbbd2
-    }
0bbbd2
-#ifdef SSL_OP_NO_TLSv1_1
0bbbd2
-    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
0bbbd2
-    if (!(protocols & NGX_SSL_TLSv1_1)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
0bbbd2
-    }
0bbbd2
+    if (protocols){
0bbbd2
+#ifdef SSL_OP_NO_TLSv1_3
0bbbd2
+        if (protocols & NGX_SSL_TLSv1_3) {
0bbbd2
+            prot = TLS1_3_VERSION;
0bbbd2
+        } else
0bbbd2
 #endif
0bbbd2
 #ifdef SSL_OP_NO_TLSv1_2
0bbbd2
-    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
0bbbd2
-    if (!(protocols & NGX_SSL_TLSv1_2)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
0bbbd2
-    }
0bbbd2
+        if (protocols & NGX_SSL_TLSv1_2) {
0bbbd2
+            prot =  TLS1_2_VERSION;
0bbbd2
+        } else
0bbbd2
 #endif
0bbbd2
-#ifdef SSL_OP_NO_TLSv1_3
0bbbd2
-    SSL_CTX_clear_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
0bbbd2
-    if (!(protocols & NGX_SSL_TLSv1_3)) {
0bbbd2
-        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_3);
0bbbd2
-    }
0bbbd2
+#ifdef SSL_OP_NO_TLSv1_1
0bbbd2
+        if (protocols & NGX_SSL_TLSv1_1) {
0bbbd2
+            prot = TLS1_1_VERSION;
0bbbd2
+        } else
0bbbd2
 #endif
0bbbd2
+        if (protocols & NGX_SSL_TLSv1) {
0bbbd2
+            prot = TLS1_VERSION;
0bbbd2
+        }
0bbbd2
+
0bbbd2
+        if (prot == NGX_SSL_NO_PROT) {
0bbbd2
+                    ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
0bbbd2
+                      "No SSL protocols available [hint: ssl_protocols]");
0bbbd2
+            return NGX_ERROR;
0bbbd2
+        }
0bbbd2
 
0bbbd2
-#ifdef SSL_CTX_set_min_proto_version
0bbbd2
-    SSL_CTX_set_min_proto_version(ssl->ctx, 0);
0bbbd2
-    SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
0bbbd2
+        SSL_CTX_set_max_proto_version(ssl->ctx, prot);
0bbbd2
+
0bbbd2
+        /* Now, we have to scan for minimal protocol version,
0bbbd2
+         *without allowing holes between min and max*/
0bbbd2
+#if SSL_OP_NO_TLSv1_3
0bbbd2
+        if ((prot == TLS1_3_VERSION) && (protocols & NGX_SSL_TLSv1_2)) {
0bbbd2
+            prot = TLS1_2_VERSION;
0bbbd2
+        }
0bbbd2
 #endif
0bbbd2
 
0bbbd2
-#ifdef TLS1_3_VERSION
0bbbd2
-    SSL_CTX_set_min_proto_version(ssl->ctx, 0);
0bbbd2
-    SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
0bbbd2
+#ifdef SSL_OP_NO_TLSv1_1
0bbbd2
+        if ((prot == TLS1_2_VERSION) && (protocols & NGX_SSL_TLSv1_1)) {
0bbbd2
+            prot = TLS1_1_VERSION;
0bbbd2
+        }
0bbbd2
+#endif
0bbbd2
+#ifdef SSL_OP_NO_TLSv1_2
0bbbd2
+        if ((prot == TLS1_1_VERSION) && (protocols & NGX_SSL_TLSv1)) {
0bbbd2
+            prot = TLS1_VERSION;
0bbbd2
+        }
0bbbd2
 #endif
0bbbd2
+        SSL_CTX_set_min_proto_version(ssl->ctx, prot);
0bbbd2
+    }
0bbbd2
 
0bbbd2
 #ifdef SSL_OP_NO_COMPRESSION
0bbbd2
     SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
0bbbd2
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
0bbbd2
index 329760d..5cee113 100644
0bbbd2
--- a/src/event/ngx_event_openssl.h
0bbbd2
+++ b/src/event/ngx_event_openssl.h
0bbbd2
@@ -152,6 +152,7 @@ typedef struct {
0bbbd2
 #endif
0bbbd2
 
0bbbd2
 
0bbbd2
+#define NGX_SSL_NO_PROT  0x0000
0bbbd2
 #define NGX_SSL_SSLv2    0x0002
0bbbd2
 #define NGX_SSL_SSLv3    0x0004
0bbbd2
 #define NGX_SSL_TLSv1    0x0008
0bbbd2
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
0bbbd2
index a47d696..94f30db 100644
0bbbd2
--- a/src/http/modules/ngx_http_ssl_module.c
0bbbd2
+++ b/src/http/modules/ngx_http_ssl_module.c
0bbbd2
@@ -671,8 +671,7 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
0bbbd2
     ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, 0);
0bbbd2
 
0bbbd2
     ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
0bbbd2
-                         (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
0bbbd2
-                          |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
0bbbd2
+                         0)
0bbbd2
 
0bbbd2
     ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size,
0bbbd2
                          NGX_SSL_BUFSIZE);
0bbbd2
diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
0bbbd2
index 7eae83e..8328560 100644
0bbbd2
--- a/src/mail/ngx_mail_ssl_module.c
0bbbd2
+++ b/src/mail/ngx_mail_ssl_module.c
0bbbd2
@@ -306,8 +306,7 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
0bbbd2
                          prev->prefer_server_ciphers, 0);
0bbbd2
 
0bbbd2
     ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
0bbbd2
-                         (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
0bbbd2
-                          |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
0bbbd2
+                         0);
0bbbd2
 
0bbbd2
     ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
0bbbd2
     ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);
0bbbd2
diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
0bbbd2
index d8c0471..cef590d 100644
0bbbd2
--- a/src/stream/ngx_stream_ssl_module.c
0bbbd2
+++ b/src/stream/ngx_stream_ssl_module.c
0bbbd2
@@ -641,8 +641,7 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf, void *parent, void *child)
0bbbd2
                          prev->prefer_server_ciphers, 0);
0bbbd2
 
0bbbd2
     ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols,
0bbbd2
-                         (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1
0bbbd2
-                          |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2));
0bbbd2
+                         0);
0bbbd2
 
0bbbd2
     ngx_conf_merge_uint_value(conf->verify, prev->verify, 0);
0bbbd2
     ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1);