netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

www/caddy: Add TLS termination to Layer4 Proxy (#4364)

Browse Source 
* www/caddy: Add TLS termination to Layer4 Proxy

* www/caddy: Unhide important options from advanced and change position of new TerminateTls

* www/caddy: default in template is better, reduce diff

* www/caddy: Add changelog

* www/caddy: Improve UX of layer4 dialog, since it is unclear what happens when routing type is not exposed

* www/caddy: Make style
This commit is contained in:
Monviech
2024-11-29 17:49:44 +01:00
committed by GitHub
parent ec4b328027
commit 088ab968c7
7 changed files with 45 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
www/caddy/Makefile
+1 -1
View File
@@ -1,5 +1,5 @@
PLUGIN_NAME= caddy
PLUGIN_VERSION= 1.7.4
PLUGIN_VERSION= 1.7.5
PLUGIN_DEPENDS= caddy-custom
PLUGIN_COMMENT= Modern Reverse Proxy with Automatic HTTPS, Dynamic DNS and Layer4 Routing
PLUGIN_MAINTAINER= cedrik@pischem.com
www/caddy/pkg-descr
+6
View File
@@ -13,6 +13,12 @@ DOC: https://docs.opnsense.org/manual/how-tos/caddy.html
Plugin Changelog
================
1.7.5
* Add: Layer4 TLS Termination
* Add: h2c protocol to HTTP Handler
* Cleanup: Refactor caddy_certs.php to Trust model
1.7.4
* Add: Layer4 OpenVPN matcher with mode, digest and static key support
www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogLayer4.xml
+10 -10
View File
@@ -19,34 +19,27 @@
</field>
<field>
<type>header</type>
<label>Type</label>
<advanced>true</advanced>
<label>Layer 4</label>
</field>
<field>
<id>layer4.Type</id>
<label>Routing Type</label>
<type>dropdown</type>
<help><![CDATA[Choose either "listener_wrappers" for multiplexing protocols on the default HTTP and HTTPS ports on OSI Layer 7, or "global" for raw TCP/UDP traffic routing on a custom "Local port" on OSI Layer 4 with optional OSI Layer 7 protocol matching.]]></help>
<advanced>true</advanced>
</field>
<field>
<type>header</type>
<label>Layer 4</label>
<advanced>true</advanced>
</field>
<field>
<id>layer4.Protocol</id>
<label>Protocol</label>
<type>dropdown</type>
<style>style_type</style>
<help><![CDATA[Match the received traffic on OSI Layer 4, either TCP or UDP. When "Routing Type" is "listener_wrappers", currently only TCP will match.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>layer4.FromPort</id>
<label>Local Port</label>
<type>text</type>
<style>style_type</style>
<help><![CDATA[Choose a custom local port to listen on.]]></help>
<advanced>true</advanced>
</field>
<field>
<type>header</type>
@@ -89,6 +82,13 @@
<help><![CDATA[Invert the sense of the matcher. E.g., if the protocol is TLS, inverting will match all traffic that is not TLS. When domains have been chosen, these will be equally inverted.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>layer4.TerminateTls</id>
<label>Terminate TLS</label>
<type>checkbox</type>
<style>style_matchers matchers_domain</style>
<help><![CDATA[Terminate TLS before routing to the upstream. Since this requires a certificate, ensure there is a domain configured in "Reverse Proxy" that matches the SNI of "Domain". The best matching SAN or wildcard certificate will be used automatically for this route.]]></help>
</field>
<field>
<type>header</type>
<label>Upstream</label>
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php
+16 -1
View File
@@ -180,7 +180,10 @@ class Caddy extends BaseModel
foreach ($this->reverseproxy->layer4->iterateItems() as $item) {
if ($item->isFieldChanged()) {
$key = $item->__reference;
if (in_array((string)$item->Matchers, ['httphost', 'tlssni', 'quicsni']) && empty((string)$item->FromDomain)) {
if (
in_array((string)$item->Matchers, ['httphost', 'tlssni', 'quicsni']) &&
empty((string)$item->FromDomain)
) {
$messages->appendMessage(new Message(
sprintf(
gettext(
@@ -208,6 +211,18 @@ class Caddy extends BaseModel
));
}
if (!in_array((string)$item->Matchers, ['tlssni', 'quicsni']) && !empty((string)$item->TerminateTls)) {
$messages->appendMessage(new Message(
sprintf(
gettext(
'When "%s" matcher is selected, TLS can not be terminated.'
),
$item->Matchers
),
$key . ".TerminateTls"
));
}
if ((string)$item->Matchers !== 'openvpn' && !empty((string)$item->FromOpenvpnModes)) {
$messages->appendMessage(new Message(
sprintf(
www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+1
View File
@@ -544,6 +544,7 @@
<AsList>Y</AsList>
<ValidationMessage>Please enter one or multiple valid IP addresses, hostnames or FQDNs.</ValidationMessage>
</ToDomain>
<TerminateTls type="BooleanField"/>
<ToPort type="PortField">
<Required>Y</Required>
</ToPort>
www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/layer4.volt
+8 -3
View File
@@ -95,9 +95,6 @@
}
});
// Hide all elements with style_matchers initially
$(".style_matchers").closest('tr').hide();
$("#layer4\\.Matchers").change(function() {
$(".style_matchers").closest('tr').hide();
const selectedVal = $(this).val();
@@ -109,6 +106,14 @@
}
});
$("#layer4\\.Type").change(function() {
if ($(this).val() === "global") {
$(".style_type").closest('tr').show();
} else {
$(".style_type").closest('tr').hide();
}
});
updateServiceControlUI('caddy');
});
</script>
www/caddy/src/opnsense/service/templates/OPNsense/Caddy/includeLayer4
+3
View File
@@ -23,6 +23,9 @@
{% set layer4_configs = unsorted_layer4_configs | sort(attribute='Sequence') %}
{% macro define_proxy(layer4, to_domains, to_port, fail_duration, proxy_protocol) %}
{% if layer4.TerminateTls|default("0") == "1" %}
tls
{% endif %}
proxy {% for domain in to_domains.split(',') %}
{% set is_ipv6 = (':' in domain) %}
{{ layer4.Protocol }}/{{ '[' if is_ipv6 }}{{ domain }}{{ ']' if is_ipv6 }}:{{ to_port }}{% if not loop.last %} {% endif %}