Merge pull request #2992 from opnsense/nginx_2875_fix

www/nginx #2875 fix - allow to set proxy_responses

www/nginx/pkg-descr

@@ -13,6 +13,8 @@ Plugin Changelog
 1.28
 
 * add support for connect-src and worker-src in content security policy
+* add support for proxy_responses property in streams
+* bugfix: trusted proxies field is now correctly named which makes it usable
 
 1.27
 

www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml

@@ -26,7 +26,7 @@
     <help>If you enable the proxy protocol, a downstream proxy can send the client IP and port before the real traffic is set.</help>
   </field>
   <field>
-    <id>httpserver.trusted_proxies</id>
+    <id>streamserver.trusted_proxies</id>
     <label>Trusted Proxies</label>
     <allownew>true</allownew>
     <style>tokenize</style>
@@ -34,6 +34,13 @@
     <advanced>true</advanced>
     <help>Enter a list of IP addresses or CIDR networks which are allowed to override the source IP address using the specified header.</help>
   </field>
+  <field>
+    <id>streamserver.proxy_responses</id>
+    <label>Proxy Responses (UDP)</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>Due to the nature of UDP, nginx cannot know, when the communication ends and this helps as it tells nginx the number of datagrams the communication is expected to last on server side and it is expected to be closed afterwards. If you enter 0, it is expected, that the server never responds to a datagram. If nginx gets a datagram, it will still get forwarded to the client. Setting this option might be useful in (mostly) unidirectional communication as well.</help>
+  </field>
   <field>
     <id>streamserver.certificate</id>
     <label>TLS Certificate</label>

www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml

@@ -1059,6 +1059,10 @@
         <Required>N</Required>
         <multiple>N</multiple>
       </ip_acl>
+      <proxy_responses type="IntegerField">
+        <Required>N</Required>
+        <MinimumValue>0</MinimumValue>
+      </proxy_responses>
     </stream_server>
 
     <sni_hostname_upstream_map type="ArrayField">

www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf

@@ -101,6 +101,9 @@
         proxy_pass $hostmap{{ server.sni_upstream_map.replace('-','') }};
 {%   endif %}
         proxy_protocol {% if server.proxy_protocol == '1' %}on{% else %}off{% endif %};
+{%   if server.proxy_responses is defined and server.proxy_responses != '' %}
+        proxy_responses {{ server.proxy_responses }};
+{%   endif%}
 {%   if server.trusted_proxies is defined and server.trusted_proxies != '' %}
 {%     for trusted_proxy in server.trusted_proxies.split(',') %}
         set_real_ip_from {{ trusted_proxy }};