Skip to content

Commit 2c785fe

Browse files
kulikov-akulikov-a
committed
nginx_1.35
proxy_intercept_errors support (opnsense#4224) multiple client auth CA support (opnsense#4421) HTTP/2 server checkbox (opnsense#4272) sendfile form typo (opnsense#4436) variables hashes (opnsense#4360) proxy_cache_valid (opnsense#4481)
1 parent 50c9cb0 commit 2c785fe

File tree

15 files changed

+228
-17
lines changed

15 files changed

+228
-17
lines changed

‎www/nginx/Makefile

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
PLUGIN_NAME= nginx
2-
PLUGIN_VERSION= 1.34
3-
PLUGIN_REVISION= 6
2+
PLUGIN_VERSION= 1.35
43
PLUGIN_COMMENT= Nginx HTTP server and reverse proxy
54
PLUGIN_DEPENDS= nginx
65
PLUGIN_MAINTAINER= [email protected]

‎www/nginx/pkg-descr

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,15 @@ WWW: https://nginx.org/
1010
Plugin Changelog
1111
================
1212

13+
1.35
14+
15+
* Global options sendfile directive typo fix
16+
* Add HTTP/2 option to GUI
17+
* Add multiple client authentication trusted CA support
18+
* Add proxy_intercept_errors directive support
19+
* Add Variables hashes size support
20+
* Add proxy_cache_valid directive support with response codes and multiple selection options
21+
1322
1.34
1423

1524
* Add the option to not log TLS handshakes

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,32 @@ public function setresolverAction($uuid)
249249
return $this->setBase('resolver', 'resolver', $uuid);
250250
}
251251

252+
// proxy_cache_valid
253+
public function searchproxyCacheValidAction()
254+
{
255+
return $this->searchBase('proxy_cache_valid', array('uuid', 'description', 'code', 'valid'));
256+
}
257+
258+
public function getproxyCacheValidAction($uuid = null)
259+
{
260+
return $this->getBase('proxy_cache_valid', 'proxy_cache_valid', $uuid);
261+
}
262+
263+
public function addproxyCacheValidAction()
264+
{
265+
return $this->addBase('proxy_cache_valid', 'proxy_cache_valid');
266+
}
267+
268+
public function delproxyCacheValidAction($uuid)
269+
{
270+
return $this->delBase('proxy_cache_valid', $uuid);
271+
}
272+
273+
public function setproxyCacheValidAction($uuid)
274+
{
275+
return $this->setBase('proxy_cache_valid', 'proxy_cache_valid', $uuid);
276+
}
277+
252278
// http server
253279
public function searchhttpserverAction()
254280
{

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ public function indexAction()
6464
$this->view->errorpage = $this->getForm("errorpage");
6565
$this->view->tls_fingerprint = $this->getForm("tls_fingerprint");
6666
$this->view->resolver = $this->getForm("resolver");
67+
$this->view->proxy_cache_valid = $this->getForm("proxy_cache_valid");
6768
$this->view->syslog_target = $this->getForm("syslog_target");
6869
$nginx = new Nginx();
6970
$this->view->show_naxsi_download_button =

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,8 @@
113113
<field>
114114
<id>httpserver.ca</id>
115115
<label>Client CA Certificate</label>
116-
<type>dropdown</type>
116+
<type>select_multiple</type>
117+
<help>Trusted CA certificates</help>
117118
</field>
118119
<field>
119120
<id>httpserver.verify_client</id>
@@ -165,6 +166,13 @@
165166
<type>checkbox</type>
166167
<help>If the request scheme is not HTTPS, redirect to use HTTPS for this server.</help>
167168
</field>
169+
<field>
170+
<id>httpserver.http2</id>
171+
<label>HTTP/2</label>
172+
<type>checkbox</type>
173+
<help>Enable the HTTP/2 protocol.</help>
174+
<advanced>true</advanced>
175+
</field>
168176
<field>
169177
<id>httpserver.tls_protocols</id>
170178
<label>TLS Protocols</label>
@@ -320,4 +328,11 @@
320328
<type>select_multiple</type>
321329
<help>Select custom error pages to display instead of the default builtin error pages. If at least one error page is selected here, all default error pages will be disabled.</help>
322330
</field>
331+
<field>
332+
<id>httpserver.proxy_intercept_errors</id>
333+
<label>Intercept errors</label>
334+
<type>checkbox</type>
335+
<help>Intercept responses with codes greater than or equal to 300 and redirect to processing with custom error pages.</help>
336+
<advanced>true</advanced>
337+
</field>
323338
</form>

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,11 +98,19 @@
9898
</field>
9999
<field>
100100
<id>location.cache_valid</id>
101-
<label>Cache: Force caching time</label>
101+
<label>Cache: Force basic caching time</label>
102102
<type>text</type>
103103
<advanced>true</advanced>
104104
<help>Force caching of 200, 301 and 302 responses according to the request methods enabled for caching. Given in minutes; leave empty to rely on request/response headers from client and upstream.</help>
105105
</field>
106+
<field>
107+
<id>location.proxy_cache_valid</id>
108+
<label>Cache: Force custom caching times</label>
109+
<type>select_multiple</type>
110+
<style>selectpicker</style>
111+
<advanced>true</advanced>
112+
<help>Force caching of response codes specified at Response Code Caching page.</help>
113+
</field>
106114
<field>
107115
<id>location.cache_background_update</id>
108116
<label>Cache: Background Update</label>
@@ -335,4 +343,12 @@
335343
<type>select_multiple</type>
336344
<help>Select custom error pages to display instead of the default builtin error pages. Selection will override error pages configured on HTTP server.</help>
337345
</field>
346+
<field>
347+
<id>location.proxy_intercept_errors</id>
348+
<label>Intercept errors</label>
349+
<type>dropdown</type>
350+
<style>selectpicker</style>
351+
<help>Intercept responses with codes greater than or equal to 300 and redirect to processing with custom error pages.</help>
352+
<advanced>true</advanced>
353+
</field>
338354
</form>

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/proxy_cache_valid.xml

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
<form>
2+
<field>
3+
<id>proxy_cache_valid.description</id>
4+
<label>Description</label>
5+
<type>text</type>
6+
<help>Brief description for reference.</help>
7+
</field>
8+
<field>
9+
<id>proxy_cache_valid.code</id>
10+
<label>Code(s)</label>
11+
<allownew>true</allownew>
12+
<style>tokenize</style>
13+
<type>select_multiple</type>
14+
<help>Enter a Respone codes or use "any" to cache any responses.</help>
15+
</field>
16+
<field>
17+
<id>proxy_cache_valid.valid</id>
18+
<label>Caching Time</label>
19+
<type>text</type>
20+
<help>Specify caching time in minutes.</help>
21+
</field>
22+
</form>

‎www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/settings.xml

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@
3131
<advanced>true</advanced>
3232
</field>
3333
<field>
34-
<id>nginx.http.enabled</id>
34+
<id>nginx.http.sendfile</id>
3535
<label>Enable sendfile</label>
3636
<type>checkbox</type>
3737
<help>Enable sendfile support (faster).</help>
@@ -56,7 +56,7 @@
5656
</field>
5757
<field>
5858
<id>nginx.http.server_names_hash_bucket_size</id>
59-
<label>Hash Bucket Size</label>
59+
<label>Server Names Hash Bucket Size</label>
6060
<type>text</type>
6161
<advanced>true</advanced>
6262
</field>
@@ -66,6 +66,18 @@
6666
<type>text</type>
6767
<advanced>true</advanced>
6868
</field>
69+
<field>
70+
<id>nginx.http.variables_hash_bucket_size</id>
71+
<label>Variables Hash Bucket Size</label>
72+
<type>text</type>
73+
<advanced>true</advanced>
74+
</field>
75+
<field>
76+
<id>nginx.http.variables_hash_max_size</id>
77+
<label>Variables Hash Max Size</label>
78+
<type>text</type>
79+
<advanced>true</advanced>
80+
</field>
6981
<field>
7082
<id>nginx.http.bots_ua</id>
7183
<label>Bots User Agents</label>

‎www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml

Lines changed: 57 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
<model>
22
<mount>//OPNsense/Nginx</mount>
3-
<version>1.34</version>
3+
<version>1.35</version>
44
<description>nginx web server, reverse proxy and waf</description>
55
<items>
66
<general>
@@ -56,6 +56,14 @@
5656
<Required>N</Required>
5757
<MinimumValue>1</MinimumValue>
5858
</server_names_hash_max_size>
59+
<variables_hash_max_size type="IntegerField">
60+
<Required>N</Required>
61+
<MinimumValue>1</MinimumValue>
62+
</variables_hash_max_size>
63+
<variables_hash_bucket_size type="IntegerField">
64+
<Required>N</Required>
65+
<MinimumValue>1</MinimumValue>
66+
</variables_hash_bucket_size>
5967
<ban_response type="OptionField">
6068
<multiple>N</multiple>
6169
<OptionValues>
@@ -352,6 +360,18 @@
352360
<cache_valid type="IntegerField">
353361
<Required>N</Required>
354362
</cache_valid>
363+
<proxy_cache_valid type="ModelRelationField">
364+
<Model>
365+
<template>
366+
<source>OPNsense.Nginx.Nginx</source>
367+
<items>proxy_cache_valid</items>
368+
<display>description</display>
369+
</template>
370+
</Model>
371+
<ValidationMessage>Selected caching time settings not found</ValidationMessage>
372+
<Required>N</Required>
373+
<multiple>Y</multiple>
374+
</proxy_cache_valid>
355375
<cache_background_update type="BooleanField">
356376
<Required>Y</Required>
357377
<default>0</default>
@@ -557,6 +577,15 @@
557577
<Required>N</Required>
558578
<multiple>Y</multiple>
559579
</errorpages>
580+
<proxy_intercept_errors type="OptionField">
581+
<default>Inherit</default>
582+
<Required>Y</Required>
583+
<OptionValues>
584+
<Inherit>Inherit</Inherit>
585+
<on>On</on>
586+
<off>Off</off>
587+
</OptionValues>
588+
</proxy_intercept_errors>
560589
</location>
561590

562591
<custom_policy type="ArrayField">
@@ -827,6 +856,7 @@
827856
<ca type="CertificateField">
828857
<Type>ca</Type>
829858
<Required>N</Required>
859+
<multiple>Y</multiple>
830860
</ca>
831861
<verify_client type="OptionField">
832862
<default>Off</default>
@@ -881,6 +911,10 @@
881911
<default>0</default>
882912
<Required>Y</Required>
883913
</https_only>
914+
<http2 type="BooleanField">
915+
<default>1</default>
916+
<Required>Y</Required>
917+
</http2>
884918
<tls_protocols type="OptionField">
885919
<multiple>Y</multiple>
886920
<Sorted>Y</Sorted>
@@ -1038,6 +1072,10 @@
10381072
<Required>N</Required>
10391073
<multiple>Y</multiple>
10401074
</errorpages>
1075+
<proxy_intercept_errors type="BooleanField">
1076+
<default>0</default>
1077+
<Required>Y</Required>
1078+
</proxy_intercept_errors>
10411079
</http_server>
10421080

10431081
<stream_server type="ArrayField">
@@ -1955,6 +1993,24 @@
19551993
</max_size>
19561994
</cache_path>
19571995

1996+
<proxy_cache_valid type="ArrayField">
1997+
<description type="TextField">
1998+
<Required>Y</Required>
1999+
<mask>/^[^" \t]+$/i</mask>
2000+
</description>
2001+
<code type="CSVListField">
2002+
<Required>Y</Required>
2003+
<default>any</default>
2004+
<multiple>Y</multiple>
2005+
<mask>/(^\d{3}(,\d{3})*$)|(^any$)/</mask>
2006+
<ValidationMessage>Please use three digit response code(s) or use "any" word.</ValidationMessage>
2007+
</code>
2008+
<valid type="IntegerField">
2009+
<MinimumValue>1</MinimumValue>
2010+
<Required>Y</Required>
2011+
</valid>
2012+
</proxy_cache_valid>
2013+
19582014
<syslog_target type="ArrayField">
19592015
<description type="TextField">
19602016
<Required>Y</Required>

‎www/nginx/src/opnsense/mvc/app/views/OPNsense/Nginx/index.volt

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,9 @@
193193
<li>
194194
<a data-toggle="tab" id="subtab_item_nginx-http-cache_path" href="#subtab_nginx-http-cache_path">{{ lang._('Cache Path')}}</a>
195195
</li>
196+
<li>
197+
<a data-toggle="tab" id="subtab_item_nginx-http-proxy_cache_valid" href="#subtab_nginx-http-proxy_cache_valid">{{ lang._('Response Code Caching')}}</a>
198+
</li>
196199
<li>
197200
<a data-toggle="tab" id="subtab_item_nginx-http-errorpages" href="#subtab_nginx-http-errorpages">{{ lang._('Error Pages')}}</a>
198201
</li>
@@ -603,6 +606,30 @@
603606
</tfoot>
604607
</table>
605608
</div>
609+
<div id="subtab_nginx-http-proxy_cache_valid" class="tab-pane fade">
610+
<table id="grid-proxy_cache_valid" class="table table-condensed table-hover table-striped table-responsive" data-editDialog="proxy_cache_validdlg">
611+
<thead>
612+
<tr>
613+
<th data-column-id="uuid" data-type="string" data-sortable="true" data-visible="false">{{ lang._('ID') }}</th>
614+
<th data-column-id="description" data-type="string" data-sortable="true" data-visible="true">{{ lang._('Description') }}</th>
615+
<th data-column-id="code" data-type="string" data-sortable="true" data-visible="true">{{ lang._('Codes') }}</th>
616+
<th data-column-id="valid" data-type="numeric" data-sortable="true" data-visible="true">{{ lang._('Time') }}</th>
617+
<th data-column-id="commands" data-width="10em" data-formatter="commands" data-sortable="false">{{ lang._('Commands') }}</th>
618+
</tr>
619+
</thead>
620+
<tbody>
621+
</tbody>
622+
<tfoot>
623+
<tr>
624+
<td></td>
625+
<td>
626+
<button data-action="add" type="button" class="btn btn-xs btn-default"><span class="fa fa-plus"></span></button>
627+
<button type="button" class="btn btn-xs reload_btn btn-primary"><span class="fa fa-refresh reloadAct_progress"></span></button>
628+
</td>
629+
</tr>
630+
</tfoot>
631+
</table>
632+
</div>
606633
<div id="subtab_nginx-access-request-limit" class="tab-pane fade">
607634
<table id="grid-limit_zone" class="table table-condensed table-hover table-striped table-responsive" data-editDialog="limit_zonedlg">
608635
<thead>
@@ -825,6 +852,7 @@
825852
{{ partial("layout_partials/base_dialog",['fields': limit_request_connection,'id':'limit_request_connectiondlg', 'label':lang._('Edit Request Connection Limit')]) }}
826853
{{ partial("layout_partials/base_dialog",['fields': limit_zone,'id':'limit_zonedlg', 'label':lang._('Edit Limit Zone')]) }}
827854
{{ partial("layout_partials/base_dialog",['fields': cache_path,'id':'cache_pathdlg', 'label':lang._('Edit Cache Path')]) }}
855+
{{ partial("layout_partials/base_dialog",['fields': proxy_cache_valid,'id':'proxy_cache_validdlg', 'label':lang._('Edit Response Code Caching')]) }}
828856
{{ partial("layout_partials/base_dialog",['fields': sni_hostname_map,'id':'sni_hostname_mapdlg', 'label':lang._('Edit SNI Hostname Mapping')]) }}
829857
{{ partial("layout_partials/base_dialog",['fields': ipacl,'id':'ipacl_dlg', 'label':lang._('Edit IP ACL')]) }}
830858
{{ partial("layout_partials/base_dialog",['fields': errorpage,'id':'errorpage_dlg', 'label':lang._('Edit Error Page')]) }}

‎www/nginx/src/opnsense/scripts/nginx/setup.php

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -120,15 +120,25 @@ function find_ca($refid)
120120
$cert['prv']
121121
);
122122
if (!empty($http_server['ca'])) {
123-
foreach ($http_server['ca'] as $caref) {
124-
$ca = find_ca($caref);
125-
if (isset($ca)) {
126-
export_pem_file(
127-
KEY_DIRECTORY . $hostname . '_ca.pem',
128-
$ca['crt']
129-
);
123+
syslog(LOG_DEBUG, "NGINX setup: Setting up the CA certs for {$hostname}.");
124+
$ca_certs = [];
125+
foreach ($http_server['ca'] as $carefs) {
126+
foreach(explode(',', $carefs) as $caref) {
127+
syslog(LOG_DEBUG, "NGINX setup: Searching for {$caref} CA data");
128+
$ca = find_ca($caref);
129+
if (isset($ca)) {
130+
syslog(LOG_DEBUG, "NGINX setup: client auth CA found. Adding to the list");
131+
$ca_certs[] = base64_decode($ca['crt']);
132+
}
130133
}
131134
}
135+
if (count($ca_certs) > 0) {
136+
export_pem_file(
137+
KEY_DIRECTORY . $hostname . '_ca.pem',
138+
'',
139+
implode("\n", $ca_certs)
140+
);
141+
}
132142
}
133143
}
134144
}

0 commit comments

Comments
 (0)