www/nginx: allow to configure request buffer size (#1556)

* www/nginx: allow to configure request buffer size

* www/nginx: add Units

www/nginx/pkg-descr

@@ -11,6 +11,8 @@ Plugin Changelog
 1.15
 
 * add OCSP stapling and verify
+* fix bug sendfile directive is only applied if TLS is enabled
+* allow to configure the maximum header and request line buffer size HTTP Server advanced option (Issue: 1544)
 
 1.14
 

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml

@@ -204,6 +204,27 @@
     <advanced>true</advanced>
     <help>Allow the daemon to use the sendfile function.</help>
   </field>
+  <field>
+    <id>httpserver.client_header_buffer_size</id>
+    <label>Header Buffer Size (kB)</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>Contains the size of a header Buffer. If a header or the request line does not fit into it, a large header buffer will be used.</help>
+  </field>
+  <field>
+    <id>httpserver.large_client_header_buffers_number</id>
+    <label>Count Of Large Header Buffers</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>This field contains the amount of large header buffers. If there are not enough, the server will respond with an HTTP error.</help>
+  </field>
+  <field>
+    <id>httpserver.large_client_header_buffers_size</id>
+    <label>Size Of Large Header Buffers (kB)</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>This field contains the size of large header buffers. If a header or the request line does not fit into it, the server will respond with an HTTP error.</help>
+  </field>
   <field>
     <id>httpserver.security_header</id>
     <label>Security Header</label>

www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml

@@ -715,6 +715,21 @@
         <default>1</default>
         <Required>Y</Required>
       </sendfile>
+      <client_header_buffer_size type="IntegerField">
+        <Required>Y</Required>
+        <default>1</default>
+        <MinimumValue>1</MinimumValue>
+      </client_header_buffer_size>
+      <large_client_header_buffers_number type="IntegerField">
+        <Required>Y</Required>
+        <default>4</default>
+        <MinimumValue>1</MinimumValue>
+      </large_client_header_buffers_number>
+      <large_client_header_buffers_size type="IntegerField">
+        <Required>Y</Required>
+        <default>8</default>
+        <MinimumValue>1</MinimumValue>
+      </large_client_header_buffers_size>
       <security_header type="ModelRelationField">
         <Model>
           <template>

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf

@@ -121,8 +121,9 @@ server {
 {%     else %}
     ssl_stapling off;
 {%     endif %}
-    sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
 {%   endif %}
+
+    sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
     server_name  {{ server.servername.replace(',', ' ') }};
 {% if server.real_ip_source is defined and server.real_ip_source != '' %}
     real_ip_header {{ server.real_ip_source }};
@@ -131,6 +132,10 @@ server {
     set_real_ip_from {{ trusted_proxy }};
 {%     endfor %}
 {%   endif %}
+{% endif %}
+
+    client_header_buffer_size {{ server.client_header_buffer_size }}k;
+    large_client_header_buffers {{ server.large_client_header_buffers_number }} {{ server.large_client_header_buffers_size }}k;
 {%   if server.trusted_proxies_alias is defined and server.trusted_proxies_alias != '' %}
 {%     for trusted_proxy_uuid in server.trusted_proxies_alias.split(',') %}
 {%       set trusted_proxy_alias = helpers.getUUID(trusted_proxy_uuid) %}
@@ -141,7 +146,6 @@ server {
 {%       endif %}
 {%     endfor %}
 {%   endif %}
-{% endif %}
 {% if server.charset is defined %}
     charset {{ server.charset }};
 {% endif %}