netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: support HTTP Basic Auth in ACLs

Browse Source
This commit is contained in:
Frank Wall
2018-11-11 18:26:46 +01:00
parent 5baf257772
commit 1e949192b4
3 changed files with 64 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
+17
View File
@@ -467,6 +467,23 @@
<type>text</type>
<help><![CDATA[The value of the Server Name TLS extension sent by a client ends with the specified string (suffix match).]]></help>
</field>
<field>
<label>Parameters</label>
<type>header</type>
<style>expression_table table_http_auth</style>
</field>
<field>
<id>acl.allowedUsers</id>
<label>Allowed Users</label>
<type>select_multiple</type>
<allownew>true</allownew>
</field>
<field>
<id>acl.allowedGroups</id>
<label>Allowed Groups</label>
<type>select_multiple</type>
<allownew>true</allownew>
</field>
<field>
<label>Parameters</label>
<type>header</type>
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+25
View File
@@ -1246,6 +1246,7 @@
<expression type="OptionField">
<Required>Y</Required>
<OptionValues>
<http_auth>HTTP Basic Auth: username/password from client matches selected User/Group</http_auth>
<hdr_beg>Host starts with</hdr_beg>
<hdr_end>Host ends with</hdr_end>
<hdr>Host matches</hdr>
@@ -1631,6 +1632,30 @@
<Required>N</Required>
<Required>N</Required>
</queryBackend>
<allowedUsers type="ModelRelationField">
<Model>
<template>
<source>OPNsense.HAProxy.HAProxy</source>
<items>users.user</items>
<display>name</display>
</template>
</Model>
<ValidationMessage>Related user not found</ValidationMessage>
<multiple>Y</multiple>
<Required>N</Required>
</allowedUsers>
<allowedGroups type="ModelRelationField">
<Model>
<template>
<source>OPNsense.HAProxy.HAProxy</source>
<items>groups.group</items>
<display>name</display>
</template>
</Model>
<ValidationMessage>Related group not found</ValidationMessage>
<multiple>Y</multiple>
<Required>N</Required>
</allowedGroups>
</acl>
</acls>
<actions>
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+22 -35
View File
@@ -72,7 +72,14 @@
{% endif %}
{% do acls_seen.append(acl_data.id) %}
{% set acl_options = [] %}
{% if acl_data.expression == 'hdr_beg' %}
{% if acl_data.expression == 'http_auth' %}
{% if acl_data.allowedUsers|default("") != "" or acl_data.allowedGroups|default("") != "" %}
{% do acl_options.append('http_auth(acl_' ~ acl_data.id ~ ')') %}
{% else %}
{% set acl_enabled = '0' %}
# ERROR: missing parameters
{% endif %}
{% elif acl_data.expression == 'hdr_beg' %}
{% if acl_data.hdr_beg|default("") != "" %}
{% do acl_options.append('hdr_beg(host) -i ' ~ acl_data.hdr_beg) %}
{% else %}
@@ -678,7 +685,7 @@
{% endif %}
{% endfor %}
{% else %}
# ERROR: UserlistAddUsers called with empty user data
# WARNING: UserlistAddUsers called with empty user data
{% endif %}
{# # process all group members #}
{% if linkedGroupData is defined %}
@@ -686,7 +693,7 @@
{% set group_data = helpers.getUUID(group) %}
{# # check if this group can (still) be found in configuration #}
{% if group_data == {} %}
# ERROR: group data not found ({{group}})
# WARNING: group data not found ({{group}})
{% else %}
{# # extract user list from group object #}
{% for user in group_data.members.split(",") %}
@@ -707,7 +714,7 @@
{% endif %}
{% endfor %}
{% else %}
# ERROR: UserlistAddUsers called with empty group data
# WARNING: UserlistAddUsers called with empty group data
{% endif %}
{%- endmacro %}
@@ -857,38 +864,18 @@ defaults
{# # NOTE: Yes, this config block is redundant and duplicates entries (on purpose). #}
{# # This makes it much easier for a user to compose this from the GUI. #}
# autogenerated entries for all users/groups (may be used in ACLs)
{# # add an entry for every user #}
{% if helpers.exists('OPNsense.HAProxy.users') %}
{% for user_data in helpers.toList('OPNsense.HAProxy.users.user') %}
{% if user_data.enabled|default("") == '1' %}
userlist user_{{user_data.id}}
{# # check if using an encrypted password #}
{% if user_data.password|default("")|truncate(1, False, '', 0) == '$' %}
{% set user_pwsec = 'password' %}
{% else %}
{% set user_pwsec = 'insecure-password' %}
# autogenerated entries for ACLs
{% if helpers.exists('OPNsense.HAProxy.acls') %}
{% for acl in helpers.toList('OPNsense.HAProxy.acls.acl') %}
{% if (acl.allowedUsers|default("") != "") or (acl.allowedGroups|default("") != "") %}
{# # call macro to generate list of unique users #}
{% set userlist_result = UserlistAddUsers(acl.allowedUsers, acl.allowedGroups) %}
{# # check result, skip when empty #}
{% if (userlist_result is defined and userlist_result|default("") != "" )%}
userlist acl_{{acl.id}}
# Origin: {{acl.name}}
{{userlist_result}}
{% endif %}
user {{user_data.name}} {{user_pwsec}} {{user_data.password}}
{% endif %}
{% endfor %}
{% endif %}
{# # add an entry for every group #}
{% if helpers.exists('OPNsense.HAProxy.groups') %}
{% for group_data in helpers.toList('OPNsense.HAProxy.groups.group') %}
{% if group_data.enabled|default("") == '1' %}
userlist group_{{group_data.id}}
{# # extract user list from group object #}
{% for user in group_data.members.split(",") %}
{% set user_data = helpers.getUUID(user) %}
{# # check if using an encrypted password #}
{% if user_data.password|default("")|truncate(1, False, '', 0) == '$' %}
{% set user_pwsec = 'password' %}
{% else %}
{% set user_pwsec = 'insecure-password' %}
{% endif %}
user {{user_data.name}} {{user_pwsec}} {{user_data.password}}
{% endfor %}
{% endif %}
{% endfor %}
{% endif %}