Hello! On Tue, Mar 21, 2023 at 05:13:45PM +0400, Roman Arutyunyan wrote:
> Hi, > > On Mon, Mar 20, 2023 at 04:19:54PM +0300, Maxim Dounin wrote: > > # HG changeset patch > > # User Maxim Dounin <mdou...@mdounin.ru> > > # Date 1678891161 -10800 > > # Wed Mar 15 17:39:21 2023 +0300 > > # Node ID 3496c963b43636104fa794e84969eb077abec6b0 > > # Parent b97f2b983d1564d29280d03828503edca21a79ee > > SSL: enabled TLSv1.3 by default. > > > > diff --git a/src/http/modules/ngx_http_grpc_module.c > > b/src/http/modules/ngx_http_grpc_module.c > > --- a/src/http/modules/ngx_http_grpc_module.c > > +++ b/src/http/modules/ngx_http_grpc_module.c > > @@ -4473,8 +4473,9 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/http/modules/ngx_http_proxy_module.c > > b/src/http/modules/ngx_http_proxy_module.c > > --- a/src/http/modules/ngx_http_proxy_module.c > > +++ b/src/http/modules/ngx_http_proxy_module.c > > @@ -3734,8 +3734,9 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/http/modules/ngx_http_ssl_module.c > > b/src/http/modules/ngx_http_ssl_module.c > > --- a/src/http/modules/ngx_http_ssl_module.c > > +++ b/src/http/modules/ngx_http_ssl_module.c > > @@ -632,8 +632,9 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t * > > ngx_conf_merge_value(conf->reject_handshake, prev->reject_handshake, > > 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_size_value(conf->buffer_size, prev->buffer_size, > > NGX_SSL_BUFSIZE); > > diff --git a/src/http/modules/ngx_http_uwsgi_module.c > > b/src/http/modules/ngx_http_uwsgi_module.c > > --- a/src/http/modules/ngx_http_uwsgi_module.c > > +++ b/src/http/modules/ngx_http_uwsgi_module.c > > @@ -1875,8 +1875,9 @@ ngx_http_uwsgi_merge_loc_conf(ngx_conf_t > > prev->upstream.ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c > > --- a/src/mail/ngx_mail_ssl_module.c > > +++ b/src/mail/ngx_mail_ssl_module.c > > @@ -360,8 +360,9 @@ ngx_mail_ssl_merge_conf(ngx_conf_t *cf, > > prev->prefer_server_ciphers, 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > > diff --git a/src/stream/ngx_stream_proxy_module.c > > b/src/stream/ngx_stream_proxy_module.c > > --- a/src/stream/ngx_stream_proxy_module.c > > +++ b/src/stream/ngx_stream_proxy_module.c > > @@ -2163,8 +2163,9 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf > > prev->ssl_session_reuse, 1); > > > > ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers, > > "DEFAULT"); > > > > diff --git a/src/stream/ngx_stream_ssl_module.c > > b/src/stream/ngx_stream_ssl_module.c > > --- a/src/stream/ngx_stream_ssl_module.c > > +++ b/src/stream/ngx_stream_ssl_module.c > > @@ -703,8 +703,9 @@ ngx_stream_ssl_merge_conf(ngx_conf_t *cf > > prev->prefer_server_ciphers, 0); > > > > ngx_conf_merge_bitmask_value(conf->protocols, prev->protocols, > > - (NGX_CONF_BITMASK_SET|NGX_SSL_TLSv1 > > - |NGX_SSL_TLSv1_1|NGX_SSL_TLSv1_2)); > > + (NGX_CONF_BITMASK_SET > > + |NGX_SSL_TLSv1|NGX_SSL_TLSv1_1 > > + |NGX_SSL_TLSv1_2|NGX_SSL_TLSv1_3)); > > > > ngx_conf_merge_uint_value(conf->verify, prev->verify, 0); > > ngx_conf_merge_uint_value(conf->verify_depth, prev->verify_depth, 1); > > _______________________________________________ > > nginx-devel mailing list > > nginx-devel@nginx.org > > https://mailman.nginx.org/mailman/listinfo/nginx-devel > > Looks fine Thanks for the review, pushed to http://mdounin.ru/hg/nginx. -- Maxim Dounin http://mdounin.ru/ _______________________________________________ nginx-devel mailing list nginx-devel@nginx.org https://mailman.nginx.org/mailman/listinfo/nginx-devel
