netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add OCSP Stapling for nginx (#1519)

Browse Source 
* Add OCSP Stapeling
* Add aditional ocsp_verify flag and minor changes
* Version bump
* Update www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
  Typo
  Co-Authored-By: Fabian Franz BSc <fabianfrz@users.noreply.github.com>
* Update www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
  Co-Authored-By: Fabian Franz BSc <fabianfrz@users.noreply.github.com>
* Update www/nginx/pkg-descr typo
  Co-Authored-By: Franco Fichtner <franco@opnsense.org>
* Update www/nginx/Makefile
  plugin version bump
  Co-Authored-By: Franco Fichtner <franco@opnsense.org>
This commit is contained in:
blablup
2019-10-13 14:26:09 +02:00
committed by Fabian Franz BSc
parent e3b7837851
commit d585b04115
5 changed files with 33 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/nginx/Makefile
+1 -2
View File
@@ -1,6 +1,5 @@
PLUGIN_NAME= nginx
PLUGIN_VERSION= 1.14
PLUGIN_REVISION= 2
PLUGIN_VERSION= 1.15
PLUGIN_COMMENT= Nginx HTTP server and reverse proxy
PLUGIN_DEPENDS= nginx
PLUGIN_MAINTAINER= franz.fabian.94@gmail.com
www/nginx/pkg-descr
+4
View File
@@ -8,6 +8,10 @@ reuse, SSL offload and HTTP media streaming.
Plugin Changelog
================
1.15
* add OCSP stapling and verify
1.14
* add load balancer algorithm option (ip_hash)
www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+14
View File
@@ -132,6 +132,20 @@
<type>checkbox</type>
<help>If you check this box, a TLS encrypted connection is enforced.</help>
</field>
<field>
<id>httpserver.ocsp_stapling</id>
<label>OCSP Stapling</label>
<type>checkbox</type>
<advanced>true</advanced>
<help><![CDATA[If you check this box, OCSP stapling is enabled. If your certificate has the TLS feature "status_request" enabled and don't enable OCSP Stapling, you could get an TLS error like "MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING". This can be the case if you use Let's Encrypt with "OCSP Must Staple". More information about OCSP stapling can be found <a href="https://tools.ietf.org/html/rfc7633" target="_blank">in RFC 7633</a>.]]></help>
</field>
<field>
<id>httpserver.ocsp_verify</id>
<label>OCSP Verify</label>
<type>checkbox</type>
<advanced>true</advanced>
<help>Enables or disables verification of OCSP responses by the server.</help>
</field>
<field>
<id>httpserver.block_nonpublic_data</id>
<label>Block Configuration Files</label>
www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+8
View File
@@ -686,6 +686,14 @@
<default>0</default>
<Required>Y</Required>
</https_only>
<ocsp_stapling type="BooleanField">
<default>0</default>
<Required>Y</Required>
</ocsp_stapling>
<ocsp_verify type="BooleanField">
<default>0</default>
<Required>Y</Required>
</ocsp_verify>
<block_nonpublic_data type="BooleanField">
<default>0</default>
<Required>Y</Required>
www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+6
View File
@@ -115,6 +115,12 @@ server {
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_prefer_server_ciphers on;
{% if server.ocsp_stapling is defined and server.ocsp_stapling == '1'%}
ssl_stapling on;
ssl_stapling_verify {% if server.ocsp_verify is defined and server.ocsp_verify == '1' %}On{% else %}Off{% endif %};
{% else %}
ssl_stapling off;
{% endif %}
sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
{% endif %}
server_name {{ server.servername.replace(',', ' ') }};