Ticket #642: nginx-ssl_protocols-blacklist.patch

File nginx-ssl_protocols-blacklist.patch, 5.9 KB (added by Anders Kaseorg, 12 years ago)

[PATCH] Allow specifying ssl_protocols as a blacklist (ticket #642).

  • src/event/ngx_event_openssl.c 

    From 8581de7dc1af6d6443642f67c0fcc2846467021c Mon Sep 17 00:00:00 2001
From: Anders Kaseorg <andersk@mit.edu>
Date: Sat, 18 Oct 2014 19:48:07 -0400
Subject: [PATCH] Allow specifying ssl_protocols as a blacklist (ticket #642).

This allows the administrator to specify a minimum SSL/TLS version
without also specifying a maximum.  For example, instead of
  ssl_protocols TLSv1.0 TLSv1.1 TLSv1.2;
one can now write
  ssl_protocols all -SSLv2 -SSLv3;
which will not need to be updated when future versions of TLS become
supported.

Signed-off-by: Anders Kaseorg <andersk@mit.edu>
---
 src/event/ngx_event_openssl.c            | 10 +++++-----
 src/event/ngx_event_openssl.h            |  7 +++++++
 src/http/modules/ngx_http_proxy_module.c |  6 ++++++
 src/http/modules/ngx_http_ssl_module.c   |  6 ++++++
 src/http/modules/ngx_http_uwsgi_module.c |  6 ++++++
 src/mail/ngx_mail_ssl_module.c           |  6 ++++++
 6 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 975a8e0..dc21850 100644
    a b ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)  
    249249
    250250    SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_DH_USE);
    251251
    252     if (!(protocols & NGX_SSL_SSLv2)) {
     252    if (!(protocols & NGX_SSL_SSLv2) || (protocols & NGX_SSL_NO_SSLv2)) {
    253253        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv2);
    254254    }
    255     if (!(protocols & NGX_SSL_SSLv3)) {
     255    if (!(protocols & NGX_SSL_SSLv3) || (protocols & NGX_SSL_NO_SSLv3)) {
    256256        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_SSLv3);
    257257    }
    258     if (!(protocols & NGX_SSL_TLSv1)) {
     258    if (!(protocols & NGX_SSL_TLSv1) || (protocols & NGX_SSL_NO_TLSv1)) {
    259259        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1);
    260260    }
    261261#ifdef SSL_OP_NO_TLSv1_1
    262     if (!(protocols & NGX_SSL_TLSv1_1)) {
     262    if (!(protocols & NGX_SSL_TLSv1_1) || (protocols & NGX_SSL_NO_TLSv1_1)) {
    263263        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_1);
    264264    }
    265265#endif
    266266#ifdef SSL_OP_NO_TLSv1_2
    267     if (!(protocols & NGX_SSL_TLSv1_2)) {
     267    if (!(protocols & NGX_SSL_TLSv1_2) || (protocols & NGX_SSL_NO_TLSv1_2)) {
    268268        SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_TLSv1_2);
    269269    }
    270270#endif

  • src/event/ngx_event_openssl.h 

    diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 4086940..b1a7ba0 100644
    a b typedef struct {  
    113113#define NGX_SSL_TLSv1_1  0x0010
    114114#define NGX_SSL_TLSv1_2  0x0020
    115115
     116#define NGX_SSL_ALL      (NGX_SSL_SSLv2 | NGX_SSL_SSLv3 | NGX_SSL_TLSv1 | NGX_SSL_TLSv1_1 | NGX_SSL_TLSv1_2)
     117
     118#define NGX_SSL_NO_SSLv2    (NGX_SSL_SSLv2 << 16)
     119#define NGX_SSL_NO_SSLv3    (NGX_SSL_SSLv3 << 16)
     120#define NGX_SSL_NO_TLSv1    (NGX_SSL_TLSv1 << 16)
     121#define NGX_SSL_NO_TLSv1_1  (NGX_SSL_TLSv1_1 << 16)
     122#define NGX_SSL_NO_TLSv1_2  (NGX_SSL_TLSv1_2 << 16)
    116123
    117124#define NGX_SSL_BUFFER   1
    118125#define NGX_SSL_CLIENT   2

  • src/http/modules/ngx_http_proxy_module.c 

    diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 9a85973..4f91590 100644
    a b static ngx_conf_bitmask_t ngx_http_proxy_ssl_protocols[] = {  
    203203    { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
    204204    { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
    205205    { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
     206    { ngx_string("all"), NGX_SSL_ALL },
     207    { ngx_string("-SSLv2"), NGX_SSL_NO_SSLv2 },
     208    { ngx_string("-SSLv3"), NGX_SSL_NO_SSLv3 },
     209    { ngx_string("-TLSv1"), NGX_SSL_NO_TLSv1 },
     210    { ngx_string("-TLSv1.1"), NGX_SSL_NO_TLSv1_1 },
     211    { ngx_string("-TLSv1.2"), NGX_SSL_NO_TLSv1_2 },
    206212    { ngx_null_string, 0 }
    207213};
    208214

  • src/http/modules/ngx_http_ssl_module.c 

    diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index 4c69091..9173049 100644
    a b static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = {  
    5757    { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
    5858    { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
    5959    { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
     60    { ngx_string("all"), NGX_SSL_ALL },
     61    { ngx_string("-SSLv2"), NGX_SSL_NO_SSLv2 },
     62    { ngx_string("-SSLv3"), NGX_SSL_NO_SSLv3 },
     63    { ngx_string("-TLSv1"), NGX_SSL_NO_TLSv1 },
     64    { ngx_string("-TLSv1.1"), NGX_SSL_NO_TLSv1_1 },
     65    { ngx_string("-TLSv1.2"), NGX_SSL_NO_TLSv1_2 },
    6066    { ngx_null_string, 0 }
    6167};
    6268

  • src/http/modules/ngx_http_uwsgi_module.c 

    diff --git a/src/http/modules/ngx_http_uwsgi_module.c b/src/http/modules/ngx_http_uwsgi_module.c
index 151d76c..c47bc1d 100644
    a b static ngx_conf_bitmask_t ngx_http_uwsgi_ssl_protocols[] = {  
    108108    { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
    109109    { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
    110110    { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
     111    { ngx_string("all"), NGX_SSL_ALL },
     112    { ngx_string("-SSLv2"), NGX_SSL_NO_SSLv2 },
     113    { ngx_string("-SSLv3"), NGX_SSL_NO_SSLv3 },
     114    { ngx_string("-TLSv1"), NGX_SSL_NO_TLSv1 },
     115    { ngx_string("-TLSv1.1"), NGX_SSL_NO_TLSv1_1 },
     116    { ngx_string("-TLSv1.2"), NGX_SSL_NO_TLSv1_2 },
    111117    { ngx_null_string, 0 }
    112118};
    113119

  • src/mail/ngx_mail_ssl_module.c 

    diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
index f864d99..125ad2a 100644
    a b static ngx_conf_bitmask_t ngx_mail_ssl_protocols[] = {  
    4242    { ngx_string("TLSv1"), NGX_SSL_TLSv1 },
    4343    { ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
    4444    { ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
     45    { ngx_string("all"), NGX_SSL_ALL },
     46    { ngx_string("-SSLv2"), NGX_SSL_NO_SSLv2 },
     47    { ngx_string("-SSLv3"), NGX_SSL_NO_SSLv3 },
     48    { ngx_string("-TLSv1"), NGX_SSL_NO_TLSv1 },
     49    { ngx_string("-TLSv1.1"), NGX_SSL_NO_TLSv1_1 },
     50    { ngx_string("-TLSv1.2"), NGX_SSL_NO_TLSv1_2 },
    4551    { ngx_null_string, 0 }
    4652};
    4753