www/nginx: Naxsi whitelisting based on source IPs (#1310)

* Naxsi source IP whitelisting

* Update www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml

Co-Authored-By: juliocbc <julio@cloudfence.com.br>

* Simple way to whitelist

with this configuration it's working better!

* www/nginx: fixup #1375 - migration needs a default

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml

@@ -167,6 +167,15 @@
     <style>selectpicker</style>
     <help>All: All access restrictions must be fulfilled; Any: Any of the access restrictions must be fulfilled.</help>
   </field>
+  <field>
+    <id>httpserver.naxsi_whitelist_srcip</id>
+    <label>Naxsi Trusted Source IPs</label>
+    <allownew>true</allownew>
+    <style>tokenize</style>
+    <type>select_multiple</type>
+    <advanced>true</advanced>
+    <help>Enter a list of IP addresses or CIDR networks which will be whitelisted for the Naxsi rules.</help>
+  </field>
   <field>
     <id>httpserver.naxsi_extensive_log</id>
     <label>Extensive Naxsi Log</label>

www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml

@@ -694,6 +694,11 @@
         <default>0</default>
         <Required>Y</Required>
       </disable_bot_protection>
+      <naxsi_whitelist_srcip type="CSVListField">
+        <Required>N</Required>
+        <mask>/^((?:\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?(,?(?:(?:(\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?))*$/i</mask>
+        <multiple>Y</multiple>
+      </naxsi_whitelist_srcip>
       <naxsi_extensive_log type="BooleanField">
         <default>0</default>
         <Required>Y</Required>

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf

@@ -78,6 +78,15 @@ include opnsense_http_vhost_plugins/*.conf;
 {%   if OPNsense.Nginx.general.enabled is defined and OPNsense.Nginx.general.enabled == '1' %}
 {% for server in helpers.toList('OPNsense.Nginx.http_server') %}
 {%   set single_servername = server.servername.split(",")[0] %}
+{%   if server.naxsi_whitelist_srcip is defined and server.naxsi_whitelist_srcip != '' %}
+  geo $naxsiwl{{ server['@uuid'].replace('-', '') }} {
+        default 0;
+        # Disable naxsi if client ip is trusted
+{%     for whitelist_srcip in server.naxsi_whitelist_srcip.split(',') %}
+        {{ whitelist_srcip }} 1;
+{%     endfor %}
+  }
+{%   endif %}
 server {
 {% set our_headers = [] %}
 {% do our_headers.append('X-Powered-By') %}
@@ -260,6 +269,11 @@ server {
     }
 {%   endif %}
     include {{ server['@uuid'] }}_pre/*.conf;
+{%  if server.naxsi_whitelist_srcip is defined and server.naxsi_whitelist_srcip != ''  %}
+  if ($naxsiwl{{ server['@uuid'].replace('-', '') }}) {
+    set $naxsi_flag_enable 0;
+  }
+{%  endif %}
 {% if server.rewrites is defined %}
 {%   for rewrite_uuid in server.rewrites.split(',') %}
 {%     set rewrite = helpers.getUUID(rewrite_uuid) %}