From d585b0411554b876df2ee042bfdeb744f7b38134 Mon Sep 17 00:00:00 2001
From: blablup <langenbachs@gmail.com>
Date: Sun, 13 Oct 2019 14:26:09 +0200
Subject: [PATCH] Add OCSP Stapling for nginx (#1519)

* Add OCSP Stapeling
* Add aditional ocsp_verify flag and minor changes
* Version bump
* Update www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
  Typo
  Co-Authored-By: Fabian Franz BSc <fabianfrz@users.noreply.github.com>
* Update www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
  Co-Authored-By: Fabian Franz BSc <fabianfrz@users.noreply.github.com>
* Update www/nginx/pkg-descr typo
  Co-Authored-By: Franco Fichtner <franco@opnsense.org>
* Update www/nginx/Makefile
  plugin version bump
  Co-Authored-By: Franco Fichtner <franco@opnsense.org>
---
 www/nginx/Makefile                                 |  3 +--
 www/nginx/pkg-descr                                |  4 ++++
 .../OPNsense/Nginx/forms/httpserver.xml            | 14 ++++++++++++++
 .../mvc/app/models/OPNsense/Nginx/Nginx.xml        |  8 ++++++++
 .../service/templates/OPNsense/Nginx/http.conf     |  6 ++++++
 5 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/www/nginx/Makefile b/www/nginx/Makefile
index 0b14ed54a..912ab14b3 100644
--- a/www/nginx/Makefile
+++ b/www/nginx/Makefile
@@ -1,6 +1,5 @@
 PLUGIN_NAME=		nginx
-PLUGIN_VERSION=		1.14
-PLUGIN_REVISION=        2
+PLUGIN_VERSION=		1.15
 PLUGIN_COMMENT=		Nginx HTTP server and reverse proxy
 PLUGIN_DEPENDS=		nginx
 PLUGIN_MAINTAINER=	franz.fabian.94@gmail.com
diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index ecd0c36c2..13d933a0d 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -8,6 +8,10 @@ reuse, SSL offload and HTTP media streaming.
 Plugin Changelog
 ================
 
+1.15
+
+* add OCSP stapling and verify
+
 1.14
 
 * add load balancer algorithm option (ip_hash)
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
index 17e39f8b0..2e62fb6b1 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
@@ -132,6 +132,20 @@
     <type>checkbox</type>
     <help>If you check this box, a TLS encrypted connection is enforced.</help>
   </field>
+  <field>
+    <id>httpserver.ocsp_stapling</id>
+    <label>OCSP Stapling</label>
+    <type>checkbox</type>
+    <advanced>true</advanced>
+    <help><![CDATA[If you check this box, OCSP stapling is enabled. If your certificate has the TLS feature "status_request" enabled and don't enable OCSP Stapling, you could get an TLS error like "MOZILLA_PKIX_ERROR_REQUIRED_TLS_FEATURE_MISSING". This can be the case if you use Let's Encrypt with "OCSP Must Staple". More information about OCSP stapling can be found <a href="https://tools.ietf.org/html/rfc7633" target="_blank">in RFC 7633</a>.]]></help>
+  </field>
+  <field>
+    <id>httpserver.ocsp_verify</id>
+    <label>OCSP Verify</label>
+    <type>checkbox</type>
+    <advanced>true</advanced>
+    <help>Enables or disables verification of OCSP responses by the server.</help>
+  </field>
   <field>
     <id>httpserver.block_nonpublic_data</id>
     <label>Block Configuration Files</label>
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index cebf7d930..46f4b87ee 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -686,6 +686,14 @@
         <default>0</default>
         <Required>Y</Required>
       </https_only>
+      <ocsp_stapling type="BooleanField">
+        <default>0</default>
+        <Required>Y</Required>
+      </ocsp_stapling>
+      <ocsp_verify type="BooleanField">
+        <default>0</default>
+        <Required>Y</Required>
+      </ocsp_verify>
       <block_nonpublic_data type="BooleanField">
         <default>0</default>
         <Required>Y</Required>
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index 05aea6864..a929dab25 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -115,6 +115,12 @@ server {
     ssl_session_cache shared:SSL:50m;
     ssl_session_tickets off;
     ssl_prefer_server_ciphers on;
+{%     if server.ocsp_stapling is defined and server.ocsp_stapling == '1'%}
+    ssl_stapling on;
+    ssl_stapling_verify {% if server.ocsp_verify is defined and server.ocsp_verify == '1' %}On{% else %}Off{% endif %};
+{%     else %}
+    ssl_stapling off;
+{%     endif %}
     sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
 {%   endif %}
     server_name  {{ server.servername.replace(',', ' ') }};