netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/nginx: add server ssl directives to GUI (#2478)

Browse Source
This commit is contained in:
kulikov-a
2021-11-22 20:12:59 +01:00
committed by GitHub
parent a49db75533
commit 486f604a05
4 changed files with 61 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/nginx/pkg-descr
+1
View File
@@ -15,6 +15,7 @@ Plugin Changelog
* Change all Listen Port directives to Listen Address and migrate the Port data to Addresses
* Add default_server option to HTTP Server
* Replace stop action by the reload option in reconfigureForceRestart (#2450)
* Add server ssl_protocols, ssl_ciphers, ssl_prefer_server_ciphers directives to GUI
1.23
www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+29
View File
@@ -143,6 +143,35 @@
<type>checkbox</type>
<help>If you check this box, a TLS encrypted connection is enforced.</help>
</field>
<field>
<id>httpserver.tls_protocols</id>
<label>TLS Protocols</label>
<style>selectpicker</style>
<type>select_multiple</type>
<advanced>true</advanced>
<help>Enable specified protocols. Default: TLSv1.2 TLSv1.3. TLSv1 and TLSv1.1 are insecure and excluded from GUI.</help>
</field>
<field>
<id>httpserver.tls_ciphers</id>
<label>TLS Ciphers</label>
<type>text</type>
<advanced>true</advanced>
<help>Specify enabled ciphers in the TLS library cipher string format. Example: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256. NGINX default (empty field): HIGH:!aNULL:!MD5.</help>
</field>
<field>
<id>httpserver.tls_ecdh_curve</id>
<label>ECDH curve</label>
<type>text</type>
<advanced>true</advanced>
<help>Specify a curve(s) for ECDHE ciphers. NGINX default (empty field): auto.</help>
</field>
<field>
<id>httpserver.tls_prefer_server_ciphers</id>
<label>Prefer server ciphers</label>
<type>checkbox</type>
<advanced>true</advanced>
<help>Prefers server ciphers over client ciphers.</help>
</field>
<field>
<id>httpserver.ocsp_stapling</id>
<label>OCSP Stapling</label>
www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+23
View File
@@ -793,6 +793,29 @@
<default>0</default>
<Required>Y</Required>
</https_only>
<tls_protocols type="OptionField">
<multiple>Y</multiple>
<Sorted>Y</Sorted>
<OptionValues>
<TLSv1_2 value="TLSv1.2">TLSv1.2</TLSv1_2>
<TLSv1_3 value="TLSv1.3">TLSv1.3</TLSv1_3>
</OptionValues>
<Required>Y</Required>
<default>TLSv1.2,TLSv1.3</default>
</tls_protocols>
<tls_ciphers type="TextField">
<default>ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256</default>
<Required>N</Required>
<mask>/^((((!|\+|-)?[A-Z][A-Z\d\+-]+)|(@STRENGTH)):?)*$/i</mask>
</tls_ciphers>
<tls_ecdh_curve type="TextField">
<Required>N</Required>
<mask>/^(([A-Z\d-]+):?)*$/i</mask>
</tls_ecdh_curve>
<tls_prefer_server_ciphers type="BooleanField">
<default>1</default>
<Required>Y</Required>
</tls_prefer_server_ciphers>
<ocsp_stapling type="BooleanField">
<default>0</default>
<Required>Y</Required>
www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+8 -3
View File
@@ -110,13 +110,18 @@ server {
{% endif %}
ssl_certificate_key /usr/local/etc/nginx/key/{{ single_servername }}.key;
ssl_certificate /usr/local/etc/nginx/key/{{ single_servername }}.pem;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_protocols {{ server.tls_protocols.replace(',', ' ') }};
ssl_dhparam /usr/local/etc/dh-parameters.4096;
ssl_ciphers 'ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256';
{% if server.tls_ciphers is defined and server.tls_ciphers != '' %}
ssl_ciphers {{ server.tls_ciphers }};
{% endif %}
{% if server.tls_ecdh_curve is defined and server.tls_ecdh_curve != '' %}
ssl_ecdh_curve {{ server.tls_ecdh_curve }};
{% endif %}
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_prefer_server_ciphers on;
ssl_prefer_server_ciphers {% if server.tls_prefer_server_ciphers is defined and server.tls_prefer_server_ciphers == '0'%}off{% else %}on{% endif %};
{% if server.ocsp_stapling is defined and server.ocsp_stapling == '1'%}
ssl_stapling on;
ssl_stapling_verify {% if server.ocsp_verify is defined and server.ocsp_verify == '1' %}On{% else %}Off{% endif %};