view auto/cc/icc @ 8185:59e1c73fe02b

SSL: ssl_reject_handshake directive (ticket #195). In some cases it might be needed to reject SSL handshake based on SNI server name provided, for example, to make sure an invalid certificate is not returned to clients trying to contact a name-based virtual server without SSL configured. Previously, a "ssl_ciphers aNULL;" was used for this. This workaround, however, is not compatible with TLSv1.3, in particular, when using BoringSSL, where it is not possible to configure TLSv1.3 ciphers at all. With this change, the ssl_reject_handshake directive is introduced, which instructs nginx to reject SSL handshakes with an "unrecognized_name" alert in a particular server block. For example, to reject handshake with names other than example.com, one can use the following configuration: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name example.com; ssl_certificate example.com.crt; ssl_certificate_key example.com.key; } The following configuration can be used to reject all SSL handshakes without SNI server name provided: server { listen 443 ssl; ssl_reject_handshake on; } server { listen 443 ssl; server_name ~^; ssl_certificate example.crt; ssl_certificate_key example.key; } Additionally, the ssl_reject_handshake directive makes configuring certificates for the default server block optional. If no certificates are configured in the default server for a given listening socket, certificates must be defined in all non-default server blocks with the listening socket in question.
author Maxim Dounin <mdounin@mdounin.ru>
date Thu, 22 Oct 2020 18:02:28 +0300
parents 9eefb38f0005
children
line wrap: on
line source


# Copyright (C) Igor Sysoev
# Copyright (C) Nginx, Inc.


# Intel C++ compiler 7.1, 8.0, 8.1, 9.0, 11.1

NGX_ICC_VER=`$CC -V 2>&1 | grep 'Version' 2>&1 \
                         | sed -e 's/^.* Version \([^ ]*\) *Build.*$/\1/'`

echo " + icc version: $NGX_ICC_VER"

have=NGX_COMPILER value="\"Intel C Compiler $NGX_ICC_VER\"" . auto/define


# optimizations

CFLAGS="$CFLAGS -O"

CORE_LINK="$CORE_LINK -opt_report_file=$NGX_OBJS/opt_report_file"


case $CPU in
    pentium)
        # optimize for Pentium and Athlon
        CPU_OPT="-march=pentium"
    ;;

    pentiumpro)
        # optimize for Pentium Pro, Pentium II and Pentium III
        CPU_OPT="-mcpu=pentiumpro -march=pentiumpro"
    ;;

    pentium4)
        # optimize for Pentium 4, default
        CPU_OPT="-march=pentium4"
    ;;
esac

CFLAGS="$CFLAGS $CPU_OPT"

if [ ".$PCRE_OPT" = "." ]; then
    PCRE_OPT="-O $CPU_OPT"
fi

if [ ".$ZLIB_OPT" = "." ]; then
    ZLIB_OPT="-O $CPU_OPT"
fi


# warnings

CFLAGS="$CFLAGS -w2"

# disable some warnings

# invalid type conversion: "int" to "char *"
CFLAGS="$CFLAGS -wd171"
# argument is incompatible with corresponding format string conversion
CFLAGS="$CFLAGS -wd181"
# zero used for undefined preprocessing identifier
CFLAGS="$CFLAGS -wd193"
# the format string ends before this argument
CFLAGS="$CFLAGS -wd268"
# invalid format string conversion
CFLAGS="$CFLAGS -wd269"
# conversion from "long long" to "size_t" may lose significant bits
CFLAGS="$CFLAGS -wd810"
# parameter was never referenced
CFLAGS="$CFLAGS -wd869"
# attribute "unused" is only allowed in a function definition, warning on pTHX_
CFLAGS="$CFLAGS -wd1301"

# STUB
# enumerated type mixed with another type
CFLAGS="$CFLAGS -wd188"
# controlling expression is constant
CFLAGS="$CFLAGS -wd279"
# operands are evaluated in unspecified order
CFLAGS="$CFLAGS -wd981"
# external definition with no prior declaration
CFLAGS="$CFLAGS -wd1418"
# external declaration in primary source file
CFLAGS="$CFLAGS -wd1419"

case "$NGX_ICC_VER" in
    9.*)
        # "cc" clobber ignored, warnings for Linux's htonl()/htons()
        CFLAGS="$CFLAGS -wd1469"
        # explicit conversion of a 64-bit integral type to a smaller
        # integral type
        CFLAGS="$CFLAGS -wd1683"
        # conversion from pointer to same-sized integral type,
        # warning on offsetof()
        CFLAGS="$CFLAGS -wd1684"
        # floating-point equality and inequality comparisons are unreliable,
        # warning on SvTRUE()
        CFLAGS="$CFLAGS -wd1572"
    ;;

    8.*)
        # "cc" clobber ignored, warnings for Linux's htonl()/htons()
        CFLAGS="$CFLAGS -wd1469"
        # floating-point equality and inequality comparisons are unreliable,
        # warning on SvTRUE()
        CFLAGS="$CFLAGS -wd1572"
    ;;

    *)
    ;;
esac

# stop on warning
CFLAGS="$CFLAGS -Werror"

# debug
CFLAGS="$CFLAGS -g"