From d69f1a29f7a7786e9e53a9ef992b5019ecc0aed4 Mon Sep 17 00:00:00 2001 From: Fabian Franz BSc Date: Sat, 22 Dec 2018 14:06:04 +0100 Subject: [PATCH] www/nginx: allow to generate the fingerprint database from config.xml (#1086) * www/nginx: allow to generate the fingerprint database from config.xml * www/nginx: add missing file * www/nginx: run bmake style-fix --- .../OPNsense/Nginx/Api/SettingsController.php | 28 +++++++++++++++++ .../OPNsense/Nginx/IndexController.php | 1 + .../OPNsense/Nginx/forms/tls_fingerprint.xml | 31 +++++++++++++++++++ .../mvc/app/models/OPNsense/Nginx/Nginx.xml | 23 ++++++++++++++ .../mvc/app/views/OPNsense/Nginx/index.volt | 25 +++++++++++++++ .../src/opnsense/scripts/nginx/setup.php | 21 +++++++++++++ .../templates/OPNsense/Nginx/http.conf | 2 ++ .../www/js/nginx/dist/configuration.min.js | 2 +- .../opnsense/www/js/nginx/src/nginx_config.js | 1 + 9 files changed, 133 insertions(+), 1 deletion(-) create mode 100644 www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/tls_fingerprint.xml diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php index 1c93711db..0007ef660 100644 --- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php +++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/Api/SettingsController.php @@ -374,6 +374,33 @@ class SettingsController extends ApiMutableModelControllerBase return $this->setBase('limit_zone', 'limit_zone', $uuid); } + // TLS fingerprints for MITM detection + public function searchtls_fingerprintAction() + { + return $this->searchBase('tls_fingerprint', array('description')); + } + + public function gettls_fingerprintAction($uuid = null) + { + $this->sessionClose(); + return $this->getBase('tls_fingerprint', 'tls_fingerprint', $uuid); + } + + public function addtls_fingerprintAction() + { + return $this->addBase('tls_fingerprint', 'tls_fingerprint'); + } + + public function deltls_fingerprintAction($uuid) + { + return $this->delBase('tls_fingerprint', $uuid); + } + + public function settls_fingerprintAction($uuid) + { + return $this->setBase('tls_fingerprint', 'tls_fingerprint', $uuid); + } + // limit_request_connection public function searchlimit_request_connectionAction() { @@ -477,6 +504,7 @@ class SettingsController extends ApiMutableModelControllerBase } return []; } + // IP / Network based ACLs public function searchipaclAction() { diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php index e3782a706..e93544527 100644 --- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php +++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/IndexController.php @@ -60,6 +60,7 @@ class IndexController extends \OPNsense\Base\IndexController $this->view->cache_path = $this->getForm("cache_path"); $this->view->sni_hostname_map = $this->getForm("sni_hostname_map"); $this->view->ipacl = $this->getForm("ipacl"); + $this->view->tls_fingerprint = $this->getForm("tls_fingerprint"); $nginx = new Nginx(); $this->view->show_naxsi_download_button = count($nginx->custom_policy->iterateItems()) == 0 && count($nginx->naxsi_rule->iterateItems()) == 0; diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/tls_fingerprint.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/tls_fingerprint.xml new file mode 100644 index 000000000..90f187a3b --- /dev/null +++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/tls_fingerprint.xml @@ -0,0 +1,31 @@ +
+ + tls_fingerprint.description + + text + Enter a useful description for your entry. + + + tls_fingerprint.trusted + + checkbox + If you check this box, this entry will be added to the configuration of trusted fingerprints. + + + tls_fingerprint.user_agent + + text + + + tls_fingerprint.ciphers + + text + Enter a list of elliptic curves supported by the client in a standard configuration in OpenSSL syntax (cipher1:cipher2:0x0001). + + + tls_fingerprint.curves + + text + Enter a list of elliptic curves supported by the client in a standard configuration in OpenSSL syntax (curve1:curve2:0x0001). + +
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml index 8b7e3b827..debdd96e8 100644 --- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml +++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml @@ -1274,6 +1274,29 @@ + + + Y + + + Y + + + 0 + Y + + + + N + /^(0x[0-9a-fA-F]{4,4}|[a-zA-Z_\-0-9]+)(?::((0x[0-9a-fA-F]{4,4}|[a-zA-Z_\-0-9]+)))*$/ + + + + Y + /^(0x[0-9a-fA-F]{4,4}|[a-zA-Z_\-0-9]+)(?::((0x[0-9a-fA-F]{4,4}|[a-zA-Z_\-0-9]+)))*$/ + + + diff --git a/www/nginx/src/opnsense/mvc/app/views/OPNsense/Nginx/index.volt b/www/nginx/src/opnsense/mvc/app/views/OPNsense/Nginx/index.volt index ac0771e2f..39f0cc0bb 100644 --- a/www/nginx/src/opnsense/mvc/app/views/OPNsense/Nginx/index.volt +++ b/www/nginx/src/opnsense/mvc/app/views/OPNsense/Nginx/index.volt @@ -124,6 +124,9 @@
  • {{ lang._('Cache Path')}}
    • +
  • + {{ lang._('TLS Fingerprint (Advanced)')}} +