From 1e949192b431802d71a2307654b36163fa8543f5 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 11 Nov 2018 18:26:46 +0100 Subject: [PATCH] net/haproxy: support HTTP Basic Auth in ACLs --- .../OPNsense/HAProxy/forms/dialogAcl.xml | 17 ++++++ .../app/models/OPNsense/HAProxy/HAProxy.xml | 25 ++++++++ .../templates/OPNsense/HAProxy/haproxy.conf | 57 +++++++------------ 3 files changed, 64 insertions(+), 35 deletions(-) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml index 886d9f206..f56065c94 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml @@ -467,6 +467,23 @@ text + + + header + + + + acl.allowedUsers + + select_multiple + true + + + acl.allowedGroups + + select_multiple + true + header diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 66b025dfe..6b135564a 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1246,6 +1246,7 @@ Y + HTTP Basic Auth: username/password from client matches selected User/Group Host starts with Host ends with Host matches @@ -1631,6 +1632,30 @@ N N + + + + + Related user not found + Y + N + + + + + + Related group not found + Y + N + diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index a1bcbbaba..398e9561b 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -72,7 +72,14 @@ {% endif %} {% do acls_seen.append(acl_data.id) %} {% set acl_options = [] %} -{% if acl_data.expression == 'hdr_beg' %} +{% if acl_data.expression == 'http_auth' %} +{% if acl_data.allowedUsers|default("") != "" or acl_data.allowedGroups|default("") != "" %} +{% do acl_options.append('http_auth(acl_' ~ acl_data.id ~ ')') %} +{% else %} +{% set acl_enabled = '0' %} + # ERROR: missing parameters +{% endif %} +{% elif acl_data.expression == 'hdr_beg' %} {% if acl_data.hdr_beg|default("") != "" %} {% do acl_options.append('hdr_beg(host) -i ' ~ acl_data.hdr_beg) %} {% else %} @@ -678,7 +685,7 @@ {% endif %} {% endfor %} {% else %} -# ERROR: UserlistAddUsers called with empty user data + # WARNING: UserlistAddUsers called with empty user data {% endif %} {# # process all group members #} {% if linkedGroupData is defined %} @@ -686,7 +693,7 @@ {% set group_data = helpers.getUUID(group) %} {# # check if this group can (still) be found in configuration #} {% if group_data == {} %} -# ERROR: group data not found ({{group}}) + # WARNING: group data not found ({{group}}) {% else %} {# # extract user list from group object #} {% for user in group_data.members.split(",") %} @@ -707,7 +714,7 @@ {% endif %} {% endfor %} {% else %} -# ERROR: UserlistAddUsers called with empty group data + # WARNING: UserlistAddUsers called with empty group data {% endif %} {%- endmacro %} @@ -857,38 +864,18 @@ defaults {# # NOTE: Yes, this config block is redundant and duplicates entries (on purpose). #} {# # This makes it much easier for a user to compose this from the GUI. #} -# autogenerated entries for all users/groups (may be used in ACLs) -{# # add an entry for every user #} -{% if helpers.exists('OPNsense.HAProxy.users') %} -{% for user_data in helpers.toList('OPNsense.HAProxy.users.user') %} -{% if user_data.enabled|default("") == '1' %} -userlist user_{{user_data.id}} -{# # check if using an encrypted password #} -{% if user_data.password|default("")|truncate(1, False, '', 0) == '$' %} -{% set user_pwsec = 'password' %} -{% else %} -{% set user_pwsec = 'insecure-password' %} +# autogenerated entries for ACLs +{% if helpers.exists('OPNsense.HAProxy.acls') %} +{% for acl in helpers.toList('OPNsense.HAProxy.acls.acl') %} +{% if (acl.allowedUsers|default("") != "") or (acl.allowedGroups|default("") != "") %} +{# # call macro to generate list of unique users #} +{% set userlist_result = UserlistAddUsers(acl.allowedUsers, acl.allowedGroups) %} +{# # check result, skip when empty #} +{% if (userlist_result is defined and userlist_result|default("") != "" )%} +userlist acl_{{acl.id}} + # Origin: {{acl.name}} +{{userlist_result}} {% endif %} - user {{user_data.name}} {{user_pwsec}} {{user_data.password}} -{% endif %} -{% endfor %} -{% endif %} -{# # add an entry for every group #} -{% if helpers.exists('OPNsense.HAProxy.groups') %} -{% for group_data in helpers.toList('OPNsense.HAProxy.groups.group') %} -{% if group_data.enabled|default("") == '1' %} -userlist group_{{group_data.id}} -{# # extract user list from group object #} -{% for user in group_data.members.split(",") %} -{% set user_data = helpers.getUUID(user) %} -{# # check if using an encrypted password #} -{% if user_data.password|default("")|truncate(1, False, '', 0) == '$' %} -{% set user_pwsec = 'password' %} -{% else %} -{% set user_pwsec = 'insecure-password' %} -{% endif %} - user {{user_data.name}} {{user_pwsec}} {{user_data.password}} -{% endfor %} {% endif %} {% endfor %} {% endif %}