From 486f604a0594452f7bad6e438a04adec9e5d6901 Mon Sep 17 00:00:00 2001
From: kulikov-a <36099472+kulikov-a@users.noreply.github.com>
Date: Mon, 22 Nov 2021 22:12:59 +0300
Subject: [PATCH] www/nginx: add server ssl directives to GUI (#2478)
---
www/nginx/pkg-descr | 1 +
.../OPNsense/Nginx/forms/httpserver.xml | 29 +++++++++++++++++++
.../mvc/app/models/OPNsense/Nginx/Nginx.xml | 23 +++++++++++++++
.../templates/OPNsense/Nginx/http.conf | 11 +++++--
4 files changed, 61 insertions(+), 3 deletions(-)
diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index 6f59a18a0..3afedea29 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -15,6 +15,7 @@ Plugin Changelog
* Change all Listen Port directives to Listen Address and migrate the Port data to Addresses
* Add default_server option to HTTP Server
* Replace stop action by the reload option in reconfigureForceRestart (#2450)
+* Add server ssl_protocols, ssl_ciphers, ssl_prefer_server_ciphers directives to GUI
1.23
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
index 2809f56c9..533f4d743 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
@@ -143,6 +143,35 @@
checkbox
If you check this box, a TLS encrypted connection is enforced.
+
+ httpserver.tls_protocols
+
+
+ select_multiple
+ true
+ Enable specified protocols. Default: TLSv1.2 TLSv1.3. TLSv1 and TLSv1.1 are insecure and excluded from GUI.
+
+
+ httpserver.tls_ciphers
+
+ text
+ true
+ Specify enabled ciphers in the TLS library cipher string format. Example: ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256. NGINX default (empty field): HIGH:!aNULL:!MD5.
+
+
+ httpserver.tls_ecdh_curve
+
+ text
+ true
+ Specify a curve(s) for ECDHE ciphers. NGINX default (empty field): auto.
+
+
+ httpserver.tls_prefer_server_ciphers
+
+ checkbox
+ true
+ Prefers server ciphers over client ciphers.
+
httpserver.ocsp_stapling
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index 0bea091e0..07411f856 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -793,6 +793,29 @@
0
Y
+
+ Y
+ Y
+
+ TLSv1.2
+ TLSv1.3
+
+ Y
+ TLSv1.2,TLSv1.3
+
+
+ ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256
+ N
+ /^((((!|\+|-)?[A-Z][A-Z\d\+-]+)|(@STRENGTH)):?)*$/i
+
+
+ N
+ /^(([A-Z\d-]+):?)*$/i
+
+
+ 1
+ Y
+
0
Y
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index 243777d2e..287b6893a 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -110,13 +110,18 @@ server {
{% endif %}
ssl_certificate_key /usr/local/etc/nginx/key/{{ single_servername }}.key;
ssl_certificate /usr/local/etc/nginx/key/{{ single_servername }}.pem;
- ssl_protocols TLSv1.2 TLSv1.3;
+ ssl_protocols {{ server.tls_protocols.replace(',', ' ') }};
ssl_dhparam /usr/local/etc/dh-parameters.4096;
- ssl_ciphers 'ECDHE-ECDSA-CAMELLIA256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-CAMELLIA256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-CAMELLIA128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-CAMELLIA128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-CAMELLIA256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-CAMELLIA256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-CAMELLIA128-SHA256:ECDHE-RSA-AES128-SHA256';
+{% if server.tls_ciphers is defined and server.tls_ciphers != '' %}
+ ssl_ciphers {{ server.tls_ciphers }};
+{% endif %}
+{% if server.tls_ecdh_curve is defined and server.tls_ecdh_curve != '' %}
+ ssl_ecdh_curve {{ server.tls_ecdh_curve }};
+{% endif %}
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
- ssl_prefer_server_ciphers on;
+ ssl_prefer_server_ciphers {% if server.tls_prefer_server_ciphers is defined and server.tls_prefer_server_ciphers == '0'%}off{% else %}on{% endif %};
{% if server.ocsp_stapling is defined and server.ocsp_stapling == '1'%}
ssl_stapling on;
ssl_stapling_verify {% if server.ocsp_verify is defined and server.ocsp_verify == '1' %}On{% else %}Off{% endif %};