diff --git a/www/nginx/Makefile b/www/nginx/Makefile index 038d7a453..ecfd00ffe 100644 --- a/www/nginx/Makefile +++ b/www/nginx/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= nginx -PLUGIN_VERSION= 1.27 +PLUGIN_VERSION= 1.28 PLUGIN_COMMENT= Nginx HTTP server and reverse proxy PLUGIN_DEPENDS= nginx PLUGIN_MAINTAINER= franz.fabian.94@gmail.com diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr index 16d6c5655..ec8555ac5 100644 --- a/www/nginx/pkg-descr +++ b/www/nginx/pkg-descr @@ -10,6 +10,10 @@ WWW: https://nginx.org/ Plugin Changelog ================ +1.28 + +* add support for connect-src and worker-src in content security policy + 1.27 * add support for custom configuration in stream server (contributed by Fabio Castagnino) diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml index a5a2eab0b..2e7a4b839 100644 --- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml +++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/security_headers.xml @@ -617,6 +617,97 @@ If this checkbox is checked, all other settings for this directive are ignored and everything will be forbidden. + + + header + + Content Security Policy: Enable on the General tab needs to be enabled to activate this header.]]> + + + security_header.csp_connect_src_enabled + + checkbox + If checked, this part of the CSP is enabled. + + + security_header.csp_connect_src_http_urls + + select_multiple + true + + Allow connecting to websockets. You can use wildcards here like wss://*.exmaple.com. + + + security_header.csp_connect_src_none + + checkbox + If this checkbox is checked, all other settings for this directive are ignored and everything will be forbidden. + + + + + header + + Content Security Policy: Enable on the General tab needs to be enabled to activate this header.]]> + + + security_header.csp_worker_src_enabled + + checkbox + If checked, this part of the CSP is enabled. + + + security_header.csp_worker_src_data_urls + + Data URLs are used to embed files into HTML (for example images written directly into the src attribute). + checkbox + + + security_header.csp_worker_src_http_urls + + select_multiple + true + + Allow loading files over HTTP(S) allows downloading of content over other domains or CDNs. + You can use wildcards here like https://*.exmaple.com. + + + security_header.csp_worker_src_inline + + checkbox + Checking this directive allows to use scripts or styles directly embedded in in the HTML content. + Examples are the script and the style tags. + + + security_header.csp_worker_src_eval + + checkbox + Checking this box allows functions like eval or createFunction in JS, or style attributes for CSS. + + + security_header.csp_worker_src_self + + checkbox + Allows everything from the same site (path can differ, but host, protocol and port need to be the same). + + + security_header.csp_worker_src_blob + + checkbox + Allows to use blobs as a data source. This usually is content, which is somehow generated in JavaScript. + + + security_header.csp_worker_src_filesystem + + checkbox + + + security_header.csp_worker_src_none + + checkbox + If this checkbox is checked, all other settings for this directive are ignored and everything will be forbidden. + + header diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml index 03852a9da..f77f691b9 100644 --- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml +++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml @@ -1,6 +1,6 @@ //OPNsense/Nginx - 1.26.0 + 1.28.0 nginx web server, reverse proxy and waf @@ -1512,6 +1512,52 @@ Y 0 + + Y + 0 + + + N + + + Y + 0 + + + Y + 0 + + + Y + 0 + + + N + + + Y + 0 + + + Y + 0 + + + Y + 0 + + + Y + 0 + + + Y + 0 + + + Y + 0 + Y 0 diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf index f309c4cbf..0a46c83a1 100644 --- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf +++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/security_rule.conf @@ -19,7 +19,7 @@ {% endif %} {% if security_rule.enable_csp is defined and security_rule.enable_csp == '1' %} {% set hash_csp = {} %} -{% for csp_category in ['default-src', 'script-src', 'img-src', 'style-src', 'media-src', 'font-src', 'frame-src', 'frame-ancestors', 'form-action'] %} +{% for csp_category in ['default-src', 'script-src', 'img-src', 'style-src', 'media-src', 'font-src', 'frame-src', 'frame-ancestors', 'form-action', 'connect-src', 'worker-src'] %} {% set prefix = 'csp_' + csp_category.replace('-', '_') + '_' %} {% if security_rule[prefix + 'enabled'] == '1' %} {% set current_list = [] %}