Mercurial > hg > nginx-quic
annotate misc/GNUmakefile @ 8185:59e1c73fe02b
SSL: ssl_reject_handshake directive (ticket #195).
In some cases it might be needed to reject SSL handshake based on SNI
server name provided, for example, to make sure an invalid certificate
is not returned to clients trying to contact a name-based virtual server
without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for
this. This workaround, however, is not compatible with TLSv1.3, in
particular, when using BoringSSL, where it is not possible to configure
TLSv1.3 ciphers at all.
With this change, the ssl_reject_handshake directive is introduced,
which instructs nginx to reject SSL handshakes with an "unrecognized_name"
alert in a particular server block.
For example, to reject handshake with names other than example.com,
one can use the following configuration:
server {
listen 443 ssl;
ssl_reject_handshake on;
}
server {
listen 443 ssl;
server_name example.com;
ssl_certificate example.com.crt;
ssl_certificate_key example.com.key;
}
The following configuration can be used to reject all SSL handshakes
without SNI server name provided:
server {
listen 443 ssl;
ssl_reject_handshake on;
}
server {
listen 443 ssl;
server_name ~^;
ssl_certificate example.crt;
ssl_certificate_key example.key;
}
Additionally, the ssl_reject_handshake directive makes configuring
certificates for the default server block optional. If no certificates
are configured in the default server for a given listening socket,
certificates must be defined in all non-default server blocks with
the listening socket in question.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Thu, 22 Oct 2020 18:02:28 +0300 |
parents | 5975be6c97f8 |
children | 7d6ba2a00e2f |
rev | line source |
---|---|
681 | 1 |
2725 | 2 VER = $(shell grep 'define NGINX_VERSION' src/core/nginx.h \ |
5147
864030a4ff2a
Configure: unified nginx version computation constructs.
Ruslan Ermilov <ru@nginx.com>
parents:
5131
diff
changeset
|
3 | sed -e 's/^.*"\(.*\)".*/\1/') |
2725 | 4 NGINX = nginx-$(VER) |
5 TEMP = tmp | |
6 | |
6855
c2c13f1f47fd
Win32: added a variable to specify compiler.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6738
diff
changeset
|
7 CC = cl |
2725 | 8 OBJS = objs.msvc8 |
8124
5975be6c97f8
Updated OpenSSL used for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7903
diff
changeset
|
9 OPENSSL = openssl-1.1.1h |
6877
8acc44141e44
Updated zlib and PCRE used for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6855
diff
changeset
|
10 ZLIB = zlib-1.2.11 |
7798
ac52638cd269
Updated PCRE used for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7572
diff
changeset
|
11 PCRE = pcre-8.44 |
681 | 12 |
13 | |
5131
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
14 release: export |
681 | 15 |
16 mv $(TEMP)/$(NGINX)/auto/configure $(TEMP)/$(NGINX) | |
17 | |
18 # delete incomplete sources | |
19 rm $(TEMP)/$(NGINX)/src/event/ngx_event_acceptex.c | |
20 rm $(TEMP)/$(NGINX)/src/event/ngx_event_connectex.c | |
21 rm $(TEMP)/$(NGINX)/src/event/modules/ngx_iocp_module.* | |
22 rm -r $(TEMP)/$(NGINX)/src/os/win32 | |
23 | |
24 mv $(TEMP)/$(NGINX)/docs/text/LICENSE $(TEMP)/$(NGINX) | |
25 mv $(TEMP)/$(NGINX)/docs/text/README $(TEMP)/$(NGINX) | |
26 mv $(TEMP)/$(NGINX)/docs/html $(TEMP)/$(NGINX) | |
3801
569716d0e447
add man page in release tarball and fix man building procedure
Igor Sysoev <igor@sysoev.ru>
parents:
3717
diff
changeset
|
27 mv $(TEMP)/$(NGINX)/docs/man $(TEMP)/$(NGINX) |
681 | 28 |
29 $(MAKE) -f docs/GNUmakefile changes | |
30 | |
31 rm -r $(TEMP)/$(NGINX)/docs | |
32 rm -r $(TEMP)/$(NGINX)/misc | |
33 | |
704
58bd27d72519
fix bug introduced with snapshot support
Igor Sysoev <igor@sysoev.ru>
parents:
701
diff
changeset
|
34 tar -c -z -f $(NGINX).tar.gz --directory $(TEMP) $(NGINX) |
58bd27d72519
fix bug introduced with snapshot support
Igor Sysoev <igor@sysoev.ru>
parents:
701
diff
changeset
|
35 |
701 | 36 |
5131
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
37 export: |
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
38 rm -rf $(TEMP) |
5212 | 39 hg archive -X '.hg*' $(TEMP)/$(NGINX) |
5131
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
40 |
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
41 |
4211
effc7962aebe
Moving RELEASE target in more safe place.
Igor Sysoev <igor@sysoev.ru>
parents:
4181
diff
changeset
|
42 RELEASE: |
5131
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
43 hg ci -m nginx-$(VER)-RELEASE |
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
44 hg tag -m "release-$(VER) tag" release-$(VER) |
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
45 |
5212 | 46 $(MAKE) -f misc/GNUmakefile release |
4211
effc7962aebe
Moving RELEASE target in more safe place.
Igor Sysoev <igor@sysoev.ru>
parents:
4181
diff
changeset
|
47 |
effc7962aebe
Moving RELEASE target in more safe place.
Igor Sysoev <igor@sysoev.ru>
parents:
4181
diff
changeset
|
48 |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
49 win32: |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
50 ./auto/configure \ |
6855
c2c13f1f47fd
Win32: added a variable to specify compiler.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6738
diff
changeset
|
51 --with-cc=$(CC) \ |
4894
0156fd6f48fa
Style, parentheses instead of braces in misc/GNUMakefile.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4843
diff
changeset
|
52 --builddir=$(OBJS) \ |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
53 --with-debug \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
54 --prefix= \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
55 --conf-path=conf/nginx.conf \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
56 --pid-path=logs/nginx.pid \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
57 --http-log-path=logs/access.log \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
58 --error-log-path=logs/error.log \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
59 --sbin-path=nginx.exe \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
60 --http-client-body-temp-path=temp/client_body_temp \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
61 --http-proxy-temp-path=temp/proxy_temp \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
62 --http-fastcgi-temp-path=temp/fastcgi_temp \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
63 --http-scgi-temp-path=temp/scgi_temp \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
64 --http-uwsgi-temp-path=temp/uwsgi_temp \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
65 --with-cc-opt=-DFD_SETSIZE=1024 \ |
4894
0156fd6f48fa
Style, parentheses instead of braces in misc/GNUMakefile.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4843
diff
changeset
|
66 --with-pcre=$(OBJS)/lib/$(PCRE) \ |
0156fd6f48fa
Style, parentheses instead of braces in misc/GNUMakefile.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4843
diff
changeset
|
67 --with-zlib=$(OBJS)/lib/$(ZLIB) \ |
6936
0d4f602dc927
Added HTTP/2 to win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6884
diff
changeset
|
68 --with-http_v2_module \ |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
69 --with-http_realip_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
70 --with-http_addition_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
71 --with-http_sub_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
72 --with-http_dav_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
73 --with-http_stub_status_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
74 --with-http_flv_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
75 --with-http_mp4_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
76 --with-http_gunzip_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
77 --with-http_gzip_static_module \ |
5335
1d0523f54a9f
Added auth request to win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5236
diff
changeset
|
78 --with-http_auth_request_module \ |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
79 --with-http_random_index_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
80 --with-http_secure_link_module \ |
6318
3250a5783787
Added slice module to win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6231
diff
changeset
|
81 --with-http_slice_module \ |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
82 --with-mail \ |
6134
96e22e4f1b03
Added stream module to win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6037
diff
changeset
|
83 --with-stream \ |
4894
0156fd6f48fa
Style, parentheses instead of braces in misc/GNUMakefile.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4843
diff
changeset
|
84 --with-openssl=$(OBJS)/lib/$(OPENSSL) \ |
7489
af8abe105348
Win32: avoid using CFLAGS, just add define instead.
Maxim Dounin <mdounin@mdounin.ru>
parents:
7487
diff
changeset
|
85 --with-openssl-opt="no-asm no-tests -D_WIN32_WINNT=0x0501" \ |
4842
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
86 --with-http_ssl_module \ |
d59fff553840
Helper target "win32" to run configure for win32 builds.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4779
diff
changeset
|
87 --with-mail_ssl_module \ |
6724
a6d116645c51
Configure: removed the --with-ipv6 option.
Maxim Dounin <mdounin@mdounin.ru>
parents:
6613
diff
changeset
|
88 --with-stream_ssl_module |
681 | 89 |
5131
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
90 |
566cd32d8bac
Misc: support for Mercurial repositories.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5130
diff
changeset
|
91 zip: export |
2725 | 92 rm -f $(NGINX).zip |
93 | |
5129
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
94 mkdir -p $(TEMP)/$(NGINX)/docs.new |
2725 | 95 mkdir -p $(TEMP)/$(NGINX)/logs |
96 mkdir -p $(TEMP)/$(NGINX)/temp | |
97 | |
4779
117f3284e0de
Removed the need in Perl to generate ZIP archive of nginx/Windows.
Ruslan Ermilov <ru@nginx.com>
parents:
4774
diff
changeset
|
98 sed -i '' -e "s/$$/`printf '\r'`/" $(TEMP)/$(NGINX)/conf/* |
2725 | 99 |
5129
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
100 mv $(TEMP)/$(NGINX)/docs/text/LICENSE $(TEMP)/$(NGINX)/docs.new |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
101 mv $(TEMP)/$(NGINX)/docs/text/README $(TEMP)/$(NGINX)/docs.new |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
102 mv $(TEMP)/$(NGINX)/docs/html $(TEMP)/$(NGINX) |
2725 | 103 |
5129
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
104 rm -r $(TEMP)/$(NGINX)/docs |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
105 mv $(TEMP)/$(NGINX)/docs.new $(TEMP)/$(NGINX)/docs |
2725 | 106 |
107 cp -p $(OBJS)/nginx.exe $(TEMP)/$(NGINX) | |
108 | |
5129
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
109 $(MAKE) -f docs/GNUmakefile changes |
2725 | 110 mv $(TEMP)/$(NGINX)/CHANGES* $(TEMP)/$(NGINX)/docs/ |
111 | |
112 cp -p $(OBJS)/lib/$(OPENSSL)/LICENSE \ | |
113 $(TEMP)/$(NGINX)/docs/OpenSSL.LICENSE | |
114 | |
2871
c7fe4b9118d2
fix "make zip", the bug has been introduced in r2841
Igor Sysoev <igor@sysoev.ru>
parents:
2734
diff
changeset
|
115 cp -p $(OBJS)/lib/$(PCRE)/LICENCE \ |
c7fe4b9118d2
fix "make zip", the bug has been introduced in r2841
Igor Sysoev <igor@sysoev.ru>
parents:
2734
diff
changeset
|
116 $(TEMP)/$(NGINX)/docs/PCRE.LICENCE |
2725 | 117 |
4779
117f3284e0de
Removed the need in Perl to generate ZIP archive of nginx/Windows.
Ruslan Ermilov <ru@nginx.com>
parents:
4774
diff
changeset
|
118 sed -ne '/^ (C) 1995-20/,/^ jloup@gzip\.org/p' \ |
2725 | 119 $(OBJS)/lib/$(ZLIB)/README \ |
120 > $(TEMP)/$(NGINX)/docs/zlib.LICENSE | |
121 | |
122 touch -r $(OBJS)/lib/$(ZLIB)/README \ | |
123 $(TEMP)/$(NGINX)/docs/zlib.LICENSE | |
124 | |
5129
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
125 rm -r $(TEMP)/$(NGINX)/auto |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
126 rm -r $(TEMP)/$(NGINX)/misc |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
127 rm -r $(TEMP)/$(NGINX)/src |
96ee76fda991
Misc: switch to single export operation in "zip" target.
Maxim Dounin <mdounin@mdounin.ru>
parents:
5065
diff
changeset
|
128 |
2725 | 129 cd $(TEMP) && zip -r ../$(NGINX).zip $(NGINX) |
130 | |
131 | |
132 icons: src/os/win32/nginx.ico | |
681 | 133 |
2734 | 134 # 48x48, 32x32 and 16x16 icons |
681 | 135 |
2734 | 136 src/os/win32/nginx.ico: src/os/win32/nginx_icon48.xpm \ |
137 src/os/win32/nginx_icon32.xpm \ | |
681 | 138 src/os/win32/nginx_icon16.xpm |
139 | |
140 test -d $(TEMP) || mkdir $(TEMP) | |
141 | |
2734 | 142 xpmtoppm --alphaout=$(TEMP)/nginx48.pbm \ |
143 src/os/win32/nginx_icon48.xpm > $(TEMP)/nginx48.ppm | |
144 | |
681 | 145 xpmtoppm --alphaout=$(TEMP)/nginx32.pbm \ |
146 src/os/win32/nginx_icon32.xpm > $(TEMP)/nginx32.ppm | |
147 | |
148 xpmtoppm --alphaout=$(TEMP)/nginx16.pbm \ | |
149 src/os/win32/nginx_icon16.xpm > $(TEMP)/nginx16.ppm | |
150 | |
151 ppmtowinicon -output src/os/win32/nginx.ico -andpgms \ | |
2734 | 152 $(TEMP)/nginx48.ppm $(TEMP)/nginx48.pbm \ |
681 | 153 $(TEMP)/nginx32.ppm $(TEMP)/nginx32.pbm \ |
154 $(TEMP)/nginx16.ppm $(TEMP)/nginx16.pbm |