Skip to content

Commit 0fe347f

Browse files
myreveryjaapmarcus
myrevery
and
jaapmarcus
authored
[Feature] TLS 1.3 0-RTT with replay protection (hestiacp#3692)
* TLS 1.3 0-RTT with replay protection * Update templates * Run formater * Prepare to merge * Protect Hestia against early_data * Comply with RFC 8470 and modernize * I don't like rebase LOL --------- Co-authored-by: Jaap Marcus <9754650+jaapmarcus@users.noreply.github.com>
1 parent 02e1953 commit 0fe347f

File tree

219 files changed

+13361
-9503
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

219 files changed

+13361
-9503
lines changed

‎.prettierrc.cjs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ module.exports = {
3131
files: ['**/nginx/*.inc', '**/nginx/*.conf'],
3232
options: {
3333
parser: 'nginx',
34+
wrapParameters: false,
3435
},
3536
},
3637
],

‎install/deb/nginx/0rtt-anti-replay.conf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Implement TLS 1.3 0-RTT anti-replay for NGINX
2+
3+
# Requires: NGINX directive "ssl_early_data" on
4+
5+
# Usage:
6+
7+
# Make sure these "map" blocks are included in "http" block
8+
# Put the following two lines in SSL "server" block, before any "location" blocks
9+
10+
# if ($anti_replay = 307) { return 307 https://$host$request_uri; }
11+
# if ($anti_replay = 425) { return 425; }
12+
13+
# Pass "Early-Data" header to backend/upstream
14+
# Only for 0-RTT requests from clients that understand 425 status code (RFC 8470)
15+
16+
# fastcgi_param HTTP_EARLY_DATA $rfc_early_data if_not_empty;
17+
# proxy_set_header Early-Data $rfc_early_data;
18+
19+
# Copyright © myrevery
20+
# Copyright © 7677333 (An anagram of a Anonymous Cybersecurity Research Team)
21+
22+
map "$request_method:$is_args" $ar_idempotent {
23+
default 0;
24+
"~^GET:$|^(HEAD|OPTIONS|TRACE):\?*$" 1;
25+
}
26+
27+
map $http_user_agent $ar_support_425 {
28+
default 0;
29+
"~Firefox/((58|59)|([6-9]\d)|([1-9]\d{2,}))\.\d+" 1;
30+
}
31+
32+
map "$ssl_early_data:$ar_idempotent:$ar_support_425" $anti_replay {
33+
1:0:0 307;
34+
1:0:1 425;
35+
}
36+
37+
map "$ssl_early_data:$ar_support_425" $rfc_early_data {
38+
1:1 1;
39+
}

‎install/deb/nginx/nginx.conf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ worker_processes auto;
44
worker_rlimit_nofile 65535;
55
error_log /var/log/nginx/error.log;
66
pid /run/nginx.pid;
7+
include /etc/nginx/conf.d/main/*.conf;
78
include /etc/nginx/modules-enabled/*.conf;
89

910
# Worker config
@@ -48,6 +49,7 @@ http {
4849
# Proxy settings
4950
proxy_redirect off;
5051
proxy_set_header Host $host;
52+
proxy_set_header Early-Data $rfc_early_data;
5153
proxy_set_header X-Real-IP $remote_addr;
5254
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
5355
proxy_pass_header Set-Cookie;

‎install/deb/nginx/phpmyadmin.inc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,11 @@ location /%pma_alias% {
1313

1414
location ~ ^/%pma_alias%/(.*\.php)$ {
1515
alias /usr/share/phpmyadmin/$1;
16-
fastcgi_pass 127.0.0.1:9000;
16+
include /etc/nginx/fastcgi_params;
1717
fastcgi_index index.php;
18-
include fastcgi_params;
18+
fastcgi_param HTTP_EARLY_DATA $rfc_early_data if_not_empty;
1919
fastcgi_param SCRIPT_FILENAME $request_filename;
20+
fastcgi_pass 127.0.0.1:9000;
2021
}
2122

2223
location /%pma_alias%/(.+\.(jpg|jpeg|gif|css|png|webp|js|ico|html|xml|txt))$ {

‎install/deb/nginx/phppgadmin.inc‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ location /%pga_alias% {
33

44
location ~ ^/%pga_alias%/(.*\.php)$ {
55
alias /usr/share/phppgadmin/$1;
6-
fastcgi_pass 127.0.0.1:9000;
6+
include /etc/nginx/fastcgi_params;
77
fastcgi_index index.php;
8-
include fastcgi_params;
8+
fastcgi_param HTTP_EARLY_DATA $rfc_early_data if_not_empty;
99
fastcgi_param SCRIPT_FILENAME $request_filename;
10+
fastcgi_pass 127.0.0.1:9000;
1011
}
1112
}

‎install/deb/nginx/status.conf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
server {
2-
listen 127.0.0.1:8084 default;
2+
listen 127.0.0.1:8084 default_server;
33
server_name _;
44
server_name_in_redirect off;
55

66
location / {
77
stub_status on;
88
access_log off;
9+
error_log /dev/null;
910
}
10-
}
11+
}

‎install/deb/nginx/unassigned.inc‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
server {
2-
listen directIP:80 default;
2+
listen directIP:80 default_server;
33
server_name _;
4+
access_log off;
5+
error_log /dev/null;
46

57
location / {
6-
access_log /dev/null;
7-
error_log /dev/null;
8-
root /var/www/html;
8+
root /var/www/html;
99

1010
location /phpmyadmin/ {
1111
alias /var/www/document_errors/;
@@ -34,8 +34,10 @@ server {
3434
}
3535

3636
server {
37-
listen directIP:443 ssl http2 default;
37+
listen directIP:443 default_server ssl;
3838
server_name _;
39+
access_log off;
40+
error_log /dev/null;
3941
ssl_certificate /usr/local/hestia/ssl/certificate.crt;
4042
ssl_certificate_key /usr/local/hestia/ssl/certificate.key;
4143
return 301 http://$host$request_uri;

‎install/deb/nginx/webmail.inc‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

‎install/deb/templates/mail/nginx/default.stpl‎

Lines changed: 50 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -1,45 +1,52 @@
11
server {
2-
listen %ip%:%proxy_ssl_port% ssl http2;
3-
server_name %domain_idn% %alias_idn%;
4-
root /var/lib/roundcube;
5-
index index.php index.html index.htm;
6-
access_log /var/log/nginx/domains/%domain%.log combined;
7-
error_log /var/log/nginx/domains/%domain%.error.log error;
8-
9-
ssl_certificate %ssl_pem%;
10-
ssl_certificate_key %ssl_key%;
11-
ssl_stapling on;
12-
ssl_stapling_verify on;
13-
14-
location ~ /\.(?!well-known\/) {
15-
deny all;
16-
return 404;
17-
}
18-
19-
location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
20-
deny all;
21-
return 404;
22-
}
23-
24-
location / {
25-
proxy_pass https://%ip%:%web_ssl_port%;
26-
try_files $uri $uri/ =404;
27-
alias /var/lib/roundcube/;
28-
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
29-
expires 7d;
30-
fastcgi_hide_header "Set-Cookie";
31-
}
32-
}
33-
34-
location /error/ {
35-
alias /var/www/document_errors/;
36-
}
37-
38-
location @fallback {
39-
proxy_pass https://%ip%:%web_ssl_port%;
40-
}
41-
42-
proxy_hide_header Upgrade;
43-
44-
include %home%/%user%/conf/mail/%root_domain%/%proxy_system%.ssl.conf_*;
2+
listen %ip%:%proxy_ssl_port% ssl;
3+
server_name %domain_idn% %alias_idn%;
4+
root /var/lib/roundcube;
5+
index index.php index.html index.htm;
6+
access_log /var/log/nginx/domains/%domain%.log combined;
7+
error_log /var/log/nginx/domains/%domain%.error.log error;
8+
9+
ssl_certificate %ssl_pem%;
10+
ssl_certificate_key %ssl_key%;
11+
ssl_stapling on;
12+
ssl_stapling_verify on;
13+
14+
# TLS 1.3 0-RTT anti-replay
15+
if ($anti_replay = 307) { return 307 https://$host$request_uri; }
16+
if ($anti_replay = 425) { return 425; }
17+
18+
location ~ /\.(?!well-known\/) {
19+
deny all;
20+
return 404;
21+
}
22+
23+
location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
24+
deny all;
25+
return 404;
26+
}
27+
28+
location / {
29+
alias /var/lib/roundcube/;
30+
31+
try_files $uri $uri/ =404;
32+
33+
proxy_pass https://%ip%:%web_ssl_port%;
34+
35+
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
36+
expires 7d;
37+
fastcgi_hide_header "Set-Cookie";
38+
}
39+
}
40+
41+
location @fallback {
42+
proxy_pass https://%ip%:%web_ssl_port%;
43+
}
44+
45+
location /error/ {
46+
alias /var/www/document_errors/;
47+
}
48+
49+
proxy_hide_header Upgrade;
50+
51+
include %home%/%user%/conf/mail/%root_domain%/%proxy_system%.ssl.conf_*;
4552
}

‎install/deb/templates/mail/nginx/default.tpl‎

Lines changed: 41 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -1,40 +1,43 @@
11
server {
2-
listen %ip%:%proxy_port%;
3-
server_name %domain_idn% %alias_idn%;
4-
root /var/lib/roundcube;
5-
index index.php index.html index.htm;
6-
access_log /var/log/nginx/domains/%domain%.log combined;
7-
error_log /var/log/nginx/domains/%domain%.error.log error;
8-
9-
include %home%/%user%/conf/mail/%root_domain%/nginx.forcessl.conf*;
10-
11-
location ~ /\.(?!well-known\/) {
12-
deny all;
13-
return 404;
14-
}
15-
16-
location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
17-
deny all;
18-
return 404;
19-
}
20-
21-
location / {
22-
proxy_pass http://%ip%:%web_port%;
23-
try_files $uri $uri/ =404;
24-
alias /var/lib/roundcube/;
25-
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
26-
expires 7d;
27-
fastcgi_hide_header "Set-Cookie";
28-
}
29-
}
30-
31-
location /error/ {
32-
alias /var/www/document_errors/;
33-
}
34-
35-
location @fallback {
36-
proxy_pass http://%ip%:%web_port%;
37-
}
38-
39-
include %home%/%user%/conf/mail/%root_domain%/%proxy_system%.conf_*;
2+
listen %ip%:%proxy_port%;
3+
server_name %domain_idn% %alias_idn%;
4+
root /var/lib/roundcube;
5+
index index.php index.html index.htm;
6+
access_log /var/log/nginx/domains/%domain%.log combined;
7+
error_log /var/log/nginx/domains/%domain%.error.log error;
8+
9+
include %home%/%user%/conf/mail/%root_domain%/nginx.forcessl.conf*;
10+
11+
location ~ /\.(?!well-known\/) {
12+
deny all;
13+
return 404;
14+
}
15+
16+
location ~ ^/(README.md|config|temp|logs|bin|SQL|INSTALL|LICENSE|CHANGELOG|UPGRADING)$ {
17+
deny all;
18+
return 404;
19+
}
20+
21+
location / {
22+
alias /var/lib/roundcube/;
23+
24+
try_files $uri $uri/ =404;
25+
26+
proxy_pass http://%ip%:%web_port%;
27+
28+
location ~* ^.+\.(ogg|ogv|svg|svgz|swf|eot|otf|woff|woff2|mov|mp3|mp4|webm|flv|ttf|rss|atom|jpg|jpeg|gif|png|webp|ico|bmp|mid|midi|wav|rtf|css|js|jar)$ {
29+
expires 7d;
30+
fastcgi_hide_header "Set-Cookie";
31+
}
32+
}
33+
34+
location @fallback {
35+
proxy_pass http://%ip%:%web_port%;
36+
}
37+
38+
location /error/ {
39+
alias /var/www/document_errors/;
40+
}
41+
42+
include %home%/%user%/conf/mail/%root_domain%/%proxy_system%.conf_*;
4043
}

0 commit comments

Comments
 (0)