From 095740ab393f6e572c359fbedef17d76c3c82cd7 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Mon, 29 Mar 2021 00:01:10 +0200 Subject: [PATCH] net/haproxy: ignore incompatible options when LibreSSL is used, refs #2013 --- net/haproxy/pkg-descr | 5 +++++ .../service/templates/OPNsense/HAProxy/haproxy.conf | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 69ef2148a..2dbcc504d 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -6,6 +6,11 @@ very high loads while needing persistence or Layer7 processing. Plugin Changelog ================ +3.2 + +Changed: +* ignore incompatible ciphersuites options when LibreSSL is used (#2013) + 3.1 Fixed: diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index a530b0a7a..d9923f799 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -926,7 +926,11 @@ global ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }} {% endif %} {% if OPNsense.HAProxy.general.tuning.ssl_cipherSuites|default("") != "" %} +{% if helpers.exists('system.firmware.flavour') and not(helpers.empty('system.firmware.flavour')) and system.firmware.flavour|default('') == 'libressl' %} + # WARNING: ssl-default-bind-ciphersuites cannot be used with flavour {{ system.firmware.flavour}}. +{% else %} ssl-default-bind-ciphersuites {{ OPNsense.HAProxy.general.tuning.ssl_cipherSuites }} +{% endif %} {% endif %} {% endif %} {# # pass-through options #} @@ -1162,7 +1166,11 @@ frontend {{frontend.name}} {% do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %} {% endif %} {% if frontend.ssl_cipherSuites|default("") != "" %} -{% do ssl_options.append('ciphersuites ' ~ frontend.ssl_cipherSuites) %} +{% if helpers.exists('system.firmware.flavour') and not(helpers.empty('system.firmware.flavour')) and system.firmware.flavour|default('') == 'libressl' %} + # WARNING: ciphersuites cannot be used with flavour {{ system.firmware.flavour}}. +{% else %} +{% do ssl_options.append('ciphersuites ' ~ frontend.ssl_cipherSuites) %} +{% endif %} {% endif %} {# # HSTS #} {% if frontend.ssl_hstsEnabled|default("") == '1' and frontend.mode == 'http' %}