From dcfcd41c036464dbd505c3fd48c680cadc061395 Mon Sep 17 00:00:00 2001 From: Fabian Franz Date: Fri, 19 Oct 2018 19:18:24 +0200 Subject: [PATCH 1/2] www/nginx: fix upstream header issue reported at https://forum.opnsense.org/index.php?topic=9977.0 --- .../service/templates/OPNsense/Nginx/http.conf | 15 --------------- .../templates/OPNsense/Nginx/location.conf | 14 ++++++++++++++ 2 files changed, 14 insertions(+), 15 deletions(-) diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf index 38ba09e09..02a4bc5f9 100644 --- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf +++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf @@ -81,22 +81,7 @@ server { ssl_prefer_server_ciphers on; add_header Strict-Transport-Security max-age=15768000; sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %}; - proxy_set_header X-TLS-Cipher $ssl_cipher; - proxy_set_header X-TLS-Protocol $ssl_protocol; - proxy_set_header X-TLS-SNI-Host $ssl_server_name; {% endif %} - # proxy headers for backend server -{% if server.verify_client != 'off' %} - proxy_set_header X-Client-Dn $ssl_client_s_dn; - proxy_set_header X-Client-Verify $ssl_client_verify; -{% endif %} -{% if server.verify_client == 'optional_no_ca' %} - proxy_set_header X-Client-Certificate $ssl_client_escaped_cert; -{% endif %} - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; server_name {{ server.servername.replace(',', ' ') }}; charset {{ server.charset }}; access_log /var/log/nginx/{{ server.servername }}.access.log {{ server.access_log_format }}; diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf index a65450f1b..c4388e768 100644 --- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf +++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf @@ -108,6 +108,20 @@ location {{ location.matchtype }} {{ location.urlpattern }} { proxy_cache_revalidate {% if location.cache_revalidate is defined and location.cache_revalidate == '1' %}on{% else %}off{% endif %}; proxy_cache_methods GET HEAD{% if location.cache_methods is defined and location.cache_methods != '' %} {{ location.cache_methods.replace(',', ' ') }}{% endif %}; {% endif %} + proxy_set_header X-TLS-Cipher $ssl_cipher; + proxy_set_header X-TLS-Protocol $ssl_protocol; + proxy_set_header X-TLS-SNI-Host $ssl_server_name; + # proxy headers for backend server +{% if server.verify_client != 'off' %} + proxy_set_header X-Client-Dn $ssl_client_s_dn; + proxy_set_header X-Client-Verify $ssl_client_verify; +{% endif %} +{% if server.verify_client == 'optional_no_ca' %} + proxy_set_header X-Client-Certificate $ssl_client_escaped_cert; +{% endif %} + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; {% if location.path_prefix is defined and location.path_prefix != '' %} proxy_pass http{% if upstream.tls_enable == '1' %}s{% endif %}://upstream{{ location.upstream.replace('-','') }}{{ location.path_prefix }}; {% else %} From 88bf869f0baab6ec212a6895a33774bb96032310 Mon Sep 17 00:00:00 2001 From: Fabian Franz Date: Fri, 19 Oct 2018 19:19:38 +0200 Subject: [PATCH 2/2] www/nginx: version bump --- www/nginx/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/www/nginx/Makefile b/www/nginx/Makefile index bacd8eb2c..8c403128c 100644 --- a/www/nginx/Makefile +++ b/www/nginx/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= nginx -PLUGIN_VERSION= 1.2 +PLUGIN_VERSION= 1.3 PLUGIN_COMMENT= Nginx HTTP server and reverse proxy PLUGIN_DEPENDS= nginx PLUGIN_MAINTAINER= franz.fabian.94@gmail.com