From 762bac1707577c3534f3de7f22a6b1ce28a05a51 Mon Sep 17 00:00:00 2001
From: Mathias Aerts <mathias.aerts@integr.io>
Date: Thu, 6 Dec 2018 00:22:17 +0100
Subject: [PATCH] Added checkbox for HTTP/2

---
 .../controllers/OPNsense/HAProxy/forms/dialogFrontend.xml   | 6 ++++++
 .../opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml    | 4 ++++
 .../service/templates/OPNsense/HAProxy/haproxy.conf         | 4 ++++
 3 files changed, 14 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
index 7e044a330..f893fd827 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
@@ -104,6 +104,12 @@
         <type>text</type>
         <help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
     </field>
+    <field>
+        <id>frontend.ssl_http2Enabled</id>
+        <label>Enable HTTP/2</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable support for HTTP/2.]]></help>
+    </field>
     <field>
         <id>frontend.ssl_hstsEnabled</id>
         <label>Enable HSTS</label>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index de0c9093a..646297858 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -416,6 +416,10 @@
                     <default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
                     <Required>N</Required>
                 </ssl_cipherList>
+                <ssl_http2Enabled type="BooleanField">
+                    <default>0</default>
+                    <Required>N</Required>
+                </ssl_http2Enabled>
                 <ssl_hstsEnabled type="BooleanField">
                     <default>1</default>
                     <Required>Y</Required>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index b547e68e9..f1639c652 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -967,6 +967,10 @@ frontend {{frontend.name}}
 {%           if frontend.ssl_cipherList|default("") != "" %}
 {%             do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
 {%           endif %}
+{#           # HTTP/2 #}
+{%           if frontend.ssl_http2Enabled|default("") == '1' and frontend.mode == 'http' %}
+{%             do ssl_options.append('alpn h2,http/1.1') %}
+{%           endif %}
 {#           # HSTS #}
 {%           if frontend.ssl_hstsEnabled|default("") == '1' and frontend.mode == 'http' %}
 {%             set hsts_options = [] %}