/ Register

Learn about Centmin Mod LEMP Stack today
Register Now

OpenSSL [PATCH] Use ChaCha20+Poly1305 if it's the client's most preferred cipher - OpenSSL 1.1

Discussion in 'CentOS, Redhat & Oracle Linux News' started by buik, Sep 6, 2016.

Tags:
Previous Thread Next Thread
Loading...
Page 2 of 3
  1. Dec 9, 2016 #21
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    sweet thanks for the info :D
     
  2. Apr 5, 2017 #22
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
  3. Apr 5, 2017 #23
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    old browsers don't support Chacha20 which need TLS v1.2
     
  4. Apr 5, 2017 #24
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
    No. Not chacha.
    But the entire SSL config using the latest patch.
    It didn't work with IE8
    Or maybe it's something to do with the latest Openssl 1.1.0.
    As it works fine with 1.0.x
    [​IMG]
     
  5. Apr 5, 2017 #25
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    which IE8 ? XP or Win7 ?

    openssl 1.1 disables 3DES ciphers now https://www.openssl.org/news/cl110.txt
     
  6. Jun 7, 2017 #26
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
  7. Jun 7, 2017 #27
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    interesting, wonder if centmin mod should default to openssl 1.1.0 branch for LIBRESSL_SWITCH='n' :)
     
  8. Jun 7, 2017 #28
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
  9. Jun 7, 2017 #29
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yeah that's one of main reasons for openssl 1.1.x native chacha20 support :)
     
  10. Jun 7, 2017 #30
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    6:49 AM
    @eva2000 @RoldanLT Hmm seems that they are using Openssl 1.1 with chacha draft (old cacha) backported.
    As seen in the results below:

    https://www.ssllabs.com/ssltest/analyze.html?d=cloudflare.com&s=2400:cb00:2048:1:0:0:c629:d6a2&latest

    Too bad they only commit the config to GitHub but not the patch.
    Can someone with a GitHub account send a request to release this patch?

    Maybe too many competitors uses their patches.
    They have not released a thing themselves anymore since Jun 10, 2016.
    (Apart from fixes and backports from internal and external non Cloudflare members)
     
    Last edited: Jun 7, 2017
  11. Jun 7, 2017 #31
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    6:49 AM
    @eva2000 as you are using GitHub.
    Willing to ask Cloudflare on GitHub about this ongoing sage?
    Don't use GitHub myself, only Gitlab.
    Thanks.
     
  12. Jun 7, 2017 #32
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    off to bed now, so will have to read up later :)

    You should sign up for Github too ;)
     
  13. Jun 7, 2017 #33
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    6:49 AM
    Ok. Sleep well.
    I won't sign-up for GitHub as i need to pay to start a repo.
    Gitlab is free and works as it should be, so no reason to pay for GitHub.

    Therefore my question to you, to ask Cloudflare for the old chaha draft patch.
    Thank you in advance.
     
    Last edited: Jun 7, 2017
  14. Jun 7, 2017 #34
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    I haven't paid for github repos at all (well public)

    and signing up just to comment and post issues is free
     
  15. Jun 16, 2017 #35
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
  16. Jun 16, 2017 #36
    buik

    buik “The best traveler is one without a camera.”

    2,044
    527
    113
    Apr 29, 2016
    Flanders
    Ratings:
    +1,691
    Local Time:
    6:49 AM
    Don't think so.
    But that's my personal opinion.
    As Cloudflare is using OCSP and BoringSSL won't support OCSP.

    Most likely they back-ported
    equal preference group from BoringSSL to OpenSSL.
    That's a lot less work than bringing OCSP to BoringSSL.

    Equal preference group is a decent solution for the chacha hack they used before.

    Maybe you could ask Cloudflare on GitHub to release the patch.
    Can't do it by myself as i don't use GitHub.
     
    Last edited: Jun 16, 2017
  17. Jun 16, 2017 #37
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    hmm with all these changes going on without documentation by cloudflare's chacha20 patch, maybe time for centmin mod 123.09beta01 to default to openssl 1.1.x branch heh
     
  18. Aug 24, 2017 #38
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
  19. Aug 24, 2017 #39
    eva2000

    eva2000 Administrator Staff Member

    58,893
    12,490
    113
    May 24, 2014
    Brisbane, Australia
    Ratings:
    +19,122
    Local Time:
    2:49 PM
    Nginx 1.31.x
    MariaDB 10.x/11.4+/12.3+
    yeah they did switch to boringssl hence, why centmin mod 123.09beta01 now disables cloudflare patch by default

    though it did patch for me a while back still with openssl for centmin mod nginx - haven't checked lately but should be fine as the patch is against nginx itself not openssl

    edit: nginx 1.13.4 + openssl 1.0.2l with cloudflare patch enabled doesn't seem to work as discussed above no chacha20 ciphers

    upload_2017-8-24_14-3-8.png

    but centmin mod nginx 1.13.4 + openssl 1.1.0f + cloudflare patch shows chacha20 but that might be because openssl 1.1 has native chacha20 support :)

    Code (Text):
    ######################################################################
Patching OpenSSL 1.1.0 branch
######################################################################
Cloudflare Smart ChaCha20 patch
https://community.centminmod.com/posts/35727/
only support ChaCha20 if client's preferred cipher
######################################################################
/usr/local/src/centminmod/patches/openssl/chacha20-smarter.patch
patching file ssl/s3_lib.c
patch unexpectedly ends in middle of line
######################################################################
OpenSSL 1.1.0 branch Smart Chacha20 patched
######################################################################

    upload_2017-8-24_14-9-46.png

    upload_2017-8-24_14-10-57.png

    then wihtout cloudflare patch disabled + nginx 1.13.4 + openssl 1.1.0f

    upload_2017-8-24_14-24-20.png

    upload_2017-8-24_14-24-47.png
     
    Last edited: Aug 24, 2017
  20. Jan 6, 2018 #40
    rdan

    rdan Well-Known Member

    5,452
    1,418
    113
    May 25, 2014
    Ratings:
    +2,212
    Local Time:
    12:49 PM
    Mainline
    10.2
    Seems this is not working anymore?
    "CLOUDFLARE_PATCHSSL".
     
Previous Thread Next Thread
Loading...
Page 2 of 3

.