From f0dc836495a0378108d10639cb9d70b3f35caa2d Mon Sep 17 00:00:00 2001
From: Fabian Franz <franz.fabian.94@gmail.com>
Date: Thu, 26 May 2022 11:27:51 +0200
Subject: [PATCH 1/2] www/nginx: add support proxy_responses directive in
 streams

---
 www/nginx/pkg-descr                                      | 1 +
 .../controllers/OPNsense/Nginx/forms/streamserver.xml    | 9 ++++++++-
 .../src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml | 4 ++++
 .../service/templates/OPNsense/Nginx/streams.conf        | 3 +++
 4 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index ec8555ac5..b1aa7bc3a 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -13,6 +13,7 @@ Plugin Changelog
 1.28
 
 * add support for connect-src and worker-src in content security policy
+* add support for proxy_responses property in streams
 
 1.27
 
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
index a76c22e97..b988ecbc4 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
@@ -26,7 +26,7 @@
     <help>If you enable the proxy protocol, a downstream proxy can send the client IP and port before the real traffic is set.</help>
   </field>
   <field>
-    <id>httpserver.trusted_proxies</id>
+    <id>streamserver.trusted_proxies</id>
     <label>Trusted Proxies</label>
     <allownew>true</allownew>
     <style>tokenize</style>
@@ -34,6 +34,13 @@
     <advanced>true</advanced>
     <help>Enter a list of IP addresses or CIDR networks which are allowed to override the source IP address using the specified header.</help>
   </field>
+  <field>
+    <id>streamserver.proxy_responses</id>
+    <label>Proxy Responses (UDP)</label>
+    <type>text</type>
+    <advanced>true</advanced>
+    <help>Due to the nature of UDP, nginx cannot know, when the communication ends and this helps as it tells nginx the number of datagrams the communication is expected to last on server side and it is expected to be closed afterwards. If you enter 0, it is expected, that the server never responds to a datagram. If nginx gets a datagram, it will still get forwarded to the client. Setting this option might be useful in (mostly) unidirectional communication as well.</help>
+  </field>
   <field>
     <id>streamserver.certificate</id>
     <label>TLS Certificate</label>
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index f77f691b9..48d2e18bf 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -1059,6 +1059,10 @@
         <Required>N</Required>
         <multiple>N</multiple>
       </ip_acl>
+      <proxy_responses type="IntegerField">
+        <Required>N</Required>
+        <MinimumValue>0</MinimumValue>
+      </proxy_responses>
     </stream_server>
 
     <sni_hostname_upstream_map type="ArrayField">
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
index a9c265e49..25c6c2ce2 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
@@ -101,6 +101,9 @@
         proxy_pass $hostmap{{ server.sni_upstream_map.replace('-','') }};
 {%   endif %}
         proxy_protocol {% if server.proxy_protocol == '1' %}on{% else %}off{% endif %};
+{%   if server.proxy_responses is defined and server.proxy_responses != '' %}
+        proxy_responses {{ server.proxy_responses }};
+{%   endif%}
 {%   if server.trusted_proxies is defined and server.trusted_proxies != '' %}
 {%     for trusted_proxy in server.trusted_proxies.split(',') %}
         set_real_ip_from {{ trusted_proxy }};

From 1f56aa14331542bb8d74218e75315128bf156f01 Mon Sep 17 00:00:00 2001
From: Fabian Franz <franz.fabian.94@gmail.com>
Date: Thu, 26 May 2022 11:29:34 +0200
Subject: [PATCH 2/2] www/nginx: add support proxy_responses directive in
 streams

---
 www/nginx/pkg-descr | 1 +
 1 file changed, 1 insertion(+)

diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index b1aa7bc3a..697dfaafe 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -14,6 +14,7 @@ Plugin Changelog
 
 * add support for connect-src and worker-src in content security policy
 * add support for proxy_responses property in streams
+* bugfix: trusted proxies field is now correctly named which makes it usable
 
 1.27