Enable TLS 1.3 by default in NGINX configs for Cosmic

Hello Thomas, or anyone else affected,

Accepted nginx into cosmic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/nginx/1.15.5-0ubuntu2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested and change the tag from verification-needed-cosmic to verification-done-cosmic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-cosmic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Confirmed in testing with a Cosmic container that this enables TLS 1.3 as well as 1.2, 1.1, and 1.0 in the default configuration change.

TESTERS:

(0) Start with the NGINX in main, not in proposed, for this test. (`sudo apt install nginx-core nginx`)

(1) In /etc/nginx/sites-available/default, uncomment these lines:

 # listen 443 ssl default_server;
 # listen [::]:443 ssl default_server;

 # include snippets/snakeoil.conf;

(2) Install the `ssl-cert` package which creates local dummy certs that you can use for testing.

(3) Once installed, restart the NGINX process `sudo systemctl restart nginx`

(4) Using a browser with TLS 1.3 enabled and available (I used Chrome so I can see advanced data even on a 16.04 machine, and an OpenSSL binary as well), open the test nginx site in HTTPS mode. Accept any warnings about self-signed certificates, they're not relevant for this test, the protocols are. You will see the negotiated protocol being TLS 1.2/

(5) Run the apt-get commands to install from proposed. (`sudo apt install -t cosmic-proposed nginx-core nginx`).

(6) Check your /etc/nginx/nginx.conf for the "ssl_protocols" line - it should look like this now:

 ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE

(7) Refresh the connection in your browser (purge cache if necessary), and connect to the NGINX site again. TLS 1.3 should show as the negotiated protocol instead of TLS 1.2.

This worked with a pure NGINX installation without any revisions to nginx.conf, including during the upgrade process. This should enable TLS 1.3 by default as a supported protocol for other users who are using NGINX in Cosmic Proposed.

***Please test if you can to confirm this works or doesn't work for you.*** If I don't hear back after a while, I'll mark this as verification-done myself.

This is in disco already, right:
nginx (1.15.5-0ubuntu3) disco; urgency=medium

  * No-change rebuild for the perl 5.28 transition.

 -- Adam Conrad <email address hidden> Fri, 02 Nov 2018 19:02:18 -0600

nginx (1.15.5-0ubuntu2) cosmic; urgency=medium

  * d/conf/nginx.conf: Enable TLSv1.3 by default by adding TLSv1.3 to
    the ssl_protocols line. (SRU, LP: #1800214)

 -- Thomas Ward <email address hidden> Fri, 26 Oct 2018 15:25:59 -0400

Can the main task be marked as "fix released"?

Additional testing was completed by myself and I haven't seen any TLS related regressions (running this on two production sites currently for my business and my personal).

I'm marking this as verification-done.

Looks like Adam Conrad included the SRU within Disco's no change rebuild for perl, marking as Fix Committed for Disco as that hasn't landed out of proposed yet.

Released by the security team while handing USN-3812-1 and three CVEs into Cosmic. Marking "Fix Released" for Cosmic as this is now in the repositories.

This bug was fixed in the package nginx - 1.15.5-0ubuntu3

---------------
nginx (1.15.5-0ubuntu3) disco; urgency=medium

  * No-change rebuild for the perl 5.28 transition.

 -- Adam Conrad <email address hidden> Fri, 02 Nov 2018 19:02:18 -0600