From 46165c9ad7f4d6ac674e92a29b260f70c8c892a6 Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Mon, 15 Jul 2024 13:17:15 +0300
Subject: [PATCH] www/nginx: 1.34 (#4092)

* server handshakes log opt out

* http2 server push have been made obsolete

from nginx 1.25.1 (https://nginx.org/en/CHANGES)
    *) Feature: the "http2" directive, which enables HTTP/2 on a per-server basis; the "http2" parameter of the "listen" directive is now deprecated.
    *) Change: HTTP/2 server push support has been removed.

* 'listen ... http2' directive is deprecated

migrate to http2 directive

* ver bump and descr
---
 www/nginx/Makefile                                     |  2 +-
 www/nginx/pkg-descr                                    |  6 ++++++
 .../controllers/OPNsense/Nginx/forms/httpserver.xml    |  7 +++++++
 .../app/controllers/OPNsense/Nginx/forms/location.xml  |  6 ------
 .../opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml   | 10 +++++-----
 .../service/templates/OPNsense/Nginx/http.conf         |  6 ++++--
 .../service/templates/OPNsense/Nginx/location.conf     |  1 -
 .../service/templates/OPNsense/Nginx/webgui.conf       |  4 ++--
 8 files changed, 25 insertions(+), 17 deletions(-)

diff --git a/www/nginx/Makefile b/www/nginx/Makefile
index 0b76a782f..5309f48ac 100644
--- a/www/nginx/Makefile
+++ b/www/nginx/Makefile
@@ -1,5 +1,5 @@
 PLUGIN_NAME=		nginx
-PLUGIN_VERSION=		1.33
+PLUGIN_VERSION=		1.34
 PLUGIN_COMMENT=		Nginx HTTP server and reverse proxy
 PLUGIN_DEPENDS=		nginx
 PLUGIN_MAINTAINER=	franz.fabian.94@gmail.com
diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index 661bb49eb..476eb0962 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -10,6 +10,12 @@ WWW: https://nginx.org/
 Plugin Changelog
 ================
 
+1.34
+
+* Add the option to not log TLS handshakes
+* Remove obsolete http2_push_preload directive
+* Migrate from the deprecated 'listen … http2' directive to the 'http2' directive
+
 1.33
 
 * Add the "resolver" directive support
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
index b3ad13528..33cf1ce52 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
@@ -142,6 +142,13 @@
     <help>Select Error Log Level. Log levels are listed in the order of increasing verbosity. Setting a certain log level will cause all messages of the specified and more severe log levels to be logged.</help>
     <advanced>true</advanced>
   </field>
+  <field>
+    <id>httpserver.log_handshakes</id>
+    <label>Enable TLS handshakes logging</label>
+    <type>checkbox</type>
+    <help>Log TLS handshakes to fill the User Agent fingerprint database and detect MITM attacks.</help>
+    <advanced>true</advanced>
+  </field>
   <field>
     <id>httpserver.enable_acme_support</id>
     <label>Enable Let's Encrypt Plugin Support</label>
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml
index 25c998c75..c5ad99827 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/location.xml
@@ -206,12 +206,6 @@
     <type>checkbox</type>
     <help>If the request scheme is not HTTPS, redirect to use HTTPS for this location.</help>
   </field>
-  <field>
-    <id>location.http2_push_preload</id>
-    <label>Enable HTTP/2 Preloading</label>
-    <type>checkbox</type>
-    <help>If you check this box, you can use the link header to send resources to the client before they are requested. You can boost your performance with this setting. This requires that your application sets the "Link" header correctly.</help>
-  </field>
   <field>
     <id>location.php_enable</id>
     <label>Pass Request To Local PHP Interpreter / Threat Upstream As FastCGI</label>
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index 81f686682..6921fbacd 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -1,6 +1,6 @@
 <model>
   <mount>//OPNsense/Nginx</mount>
-  <version>1.33</version>
+  <version>1.34</version>
   <description>nginx web server, reverse proxy and waf</description>
   <items>
     <general>
@@ -515,10 +515,6 @@
         <Required>N</Required>
         <minValue>1</minValue>
       </proxy_send_timeout>
-      <http2_push_preload type="BooleanField">
-        <Required>Y</Required>
-        <default>0</default>
-      </http2_push_preload>
       <ip_acl type="ModelRelationField">
         <Model>
           <template>
@@ -863,6 +859,10 @@
         <Required>Y</Required>
         <default>error</default>
       </error_log_level>
+      <log_handshakes type="BooleanField">
+        <default>1</default>
+        <Required>Y</Required>
+      </log_handshakes>
       <enable_acme_support type="BooleanField">
         <Required>Y</Required>
         <default>1</default>
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index 86b1586ab..c6e47f4fa 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -115,9 +115,9 @@ server {
 
 {%   if server.listen_https_address is defined and server.listen_https_address != '' %}
 {%     for listen_address in server.listen_https_address.split(',') %}
-    listen {{ listen_address }} http2 ssl{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %}{% if server.default_server is defined and server.default_server == '1' %} default_server{% endif %};
+    listen {{ listen_address }} ssl{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %}{% if server.default_server is defined and server.default_server == '1' %} default_server{% endif %};
 {%     endfor %}
-
+    http2 on;
 {%     if server.tls_reject_handshake is defined and server.tls_reject_handshake == '1'%}
     ssl_reject_handshake on;
 {%     endif %}
@@ -197,7 +197,9 @@ server {
 {%   set syslog_targets = server.syslog_targets.split(',') %}
 {%   include "OPNsense/Nginx/syslog_targets.conf" %}
 {% endif %}
+{% if server.log_handshakes|default("1") == "1" %}
     access_log  /var/log/nginx/tls_handshake.log handshake;
+{% endif %}
     error_log  /var/log/nginx/{{ server.servername }}.error.log{% if server.error_log_level is defined %} {{ server.error_log_level }}{% endif %};
 {% if server.root is defined and server.root != '' %}
     root "{{server.root}}";
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
index 1d0adc6dc..0bb464d3d 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/location.conf
@@ -88,7 +88,6 @@ location {{ location.matchtype }} {{ location.urlpattern }} {
     auth_request /opnsense-auth-request;
 {%   endif %}
 {% endif %}
-    http2_push_preload {% if location.http2_push_preload is defined and location.http2_push_preload == '1' %}on{% else %}off{% endif %};
 {% if location.php_enable is defined and location.php_enable == '1' %}
     fastcgi_split_path_info ^(.+\.php)(/.+)$;
     include        fastcgi_params;
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/webgui.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/webgui.conf
index 8a14feeb1..f3be95044 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/webgui.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/webgui.conf
@@ -9,7 +9,8 @@ server {
       return 302 https://$host$request_uri;
   }
   listen 80 default_server; # if redirect is enabled
-  listen {% if system.webgui.port is defined and system.webgui.port != '' %}{{ system.webgui.port }}{% else %}443{% endif %} ssl http2 default_server;
+  listen {% if system.webgui.port is defined and system.webgui.port != '' %}{{ system.webgui.port }}{% else %}443{% endif %} ssl default_server;
+  http2 on;
   ## TLS configuration
   ssl_dhparam /usr/local/opnsense/data/OPNsense/Nginx/dh-parameters.4096.rfc7919;
   ssl_ecdh_curve secp384r1;
@@ -27,7 +28,6 @@ server {
 {% endif %}
 
   autoindex off;
-  http2_push_preload on;
 
   # gzip compression
   gzip_static on;