net/haproxy: add support for forwarded header (RFC7239)

net/haproxy/pkg-descr

@@ -8,6 +8,7 @@ Plugin Changelog
 
 Added:
 * add support for built-in OCSP update feature
+* add support for forwarded header (RFC7239)
 
 Fixed:
 * fix typo in cert sync script

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml

@@ -173,6 +173,21 @@
         <sortable>true</sortable>
         <help><![CDATA[When using the TLS ALPN extension, HAProxy advertises the specified protocol list as supported on top of ALPN. TLS must be enabled.]]></help>
     </field>
+    <field>
+        <id>backend.forwardedHeader</id>
+        <label>Forwarded header (RFC7239)</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable insertion of the RFC7239 forwarded header in requests sent to servers.]]></help>
+    </field>
+    <field>
+        <id>backend.forwardedHeaderParameters</id>
+        <label>Forwarded header parameters</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <sortable>true</sortable>
+        <help><![CDATA[This may be used to add more information to the forwarded header. Default behavior enables proto parameter and injects original client IP. See he <a target="_blank" href="http://docs.haproxy.org/2.8/configuration.html#option forwarded">HAProxy documentation</a> for a full description.]]></help>
+    </field>
     <field>
         <label>Persistence</label>
         <type>header</type>

net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml

@@ -1053,6 +1053,23 @@
                         <http10>HTTP/1.0</http10>
                     </OptionValues>
                 </ba_advertised_protocols>
+                <forwardedHeader type="BooleanField">
+                    <default>0</default>
+                    <Required>N</Required>
+                </forwardedHeader>
+                <forwardedHeaderParameters type="OptionField">
+                    <Required>N</Required>
+                    <Sorted>Y</Sorted>
+                    <Multiple>Y</Multiple>
+                    <OptionValues>
+                        <proto>proto</proto>
+                        <host>host</host>
+                        <by>by</by>
+                        <by_port>by_port</by_port>
+                        <for>for</for>
+                        <for_port>for_port</for_port>
+                    </OptionValues>
+                </forwardedHeaderParameters>
                 <persistence type="OptionField">
                     <Required>N</Required>
                     <default>sticktable</default>

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -1686,6 +1686,15 @@ backend {{backend.name}}
 {%       if backend.tuning_httpreuse|default("") != "" and backend.mode == "http" %}
     http-reuse {{backend.tuning_httpreuse}}
 {%       endif %}
+{%       if backend.forwardedHeader == '1' and backend.mode == 'http' %}
+{%         set forwarded_params = [] %}
+{%         if backend.forwardedHeaderParameters|default("") != "" %}
+{%           for fwd_param in backend.forwardedHeaderParameters.split(",") %}
+{%             do forwarded_params.append(fwd_param) %}
+{%           endfor %}
+{%         endif %}
+    option forwarded {{forwarded_params|join(' ')}}
+{%       endif %}
 {%       if helpers.exists('OPNsense.HAProxy.general.cache') and OPNsense.HAProxy.general.cache.enabled|default("") == "1" and backend.tuning_caching|default("") == "1" and backend.mode == "http" %}
     http-request cache-use opnsense-haproxy-cache
     http-response cache-store opnsense-haproxy-cache