netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: export ssl_default_certificate to a file, refs #1088

Browse Source
This commit is contained in:
Frank Wall
2018-12-26 00:24:59 +01:00
parent 7c00f26e74
commit 334d72ea77
2 changed files with 10 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
+9 -4
View File
@@ -39,7 +39,7 @@ $export_path = '/tmp/haproxy/ssl/';
// configure ssl elements
$configNodes = [
'frontends' => ['ssl_certificates', 'ssl_clientAuthCAs', 'ssl_clientAuthCRLs'],
'frontends' => ['ssl_certificates', 'ssl_clientAuthCAs', 'ssl_clientAuthCRLs', 'ssl_default_certificate'],
'servers' => ['sslCA', 'sslCRL', 'sslClientCertificate'],
];
$certTypes = ['cert', 'ca', 'crl'];
@@ -90,7 +90,7 @@ foreach ($configNodes as $key => $value) {
file_put_contents($output_pem_filename, $pem_content);
chmod($output_pem_filename, 0600);
echo "exported $type to " . $output_pem_filename . "\n";
$crtlist[] = $output_pem_filename;
$crtlist[] = $output_pem_filename;
} else {
// In contrast to certificates, CA/CRL content needs to be put in a single file.
// A list of individual files is not supported by HAproxy.
@@ -107,12 +107,17 @@ foreach ($configNodes as $key => $value) {
if (empty($crtlist)) {
continue;
}
// skip for ssl_default_certificate, it's only used to ensure
// that the default certificate is exported to a file
if ($sslchild == 'ssl_default_certificate') {
continue;
}
// check if a default certificate is configured
if (($type == cert) and isset($child->ssl_default_certificate) and (string)$child->ssl_default_certificate != "") {
$default_cert = (string)$child->ssl_default_certificate;
$default_cert_filename = $export_path . $default_cert . ".pem";
// ensure default certificate is the first entry on the list
unset($crtlist[$default_cert]);
// ensure that the default certificate is the first entry on the list
$crtlist = array_diff($crtlist, [$default_cert_filename]);
array_unshift($crtlist, $default_cert_filename);
}
$crtlist_content = implode("\n", $crtlist) . "\n";
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+1 -1
View File
@@ -949,7 +949,7 @@ frontend {{frontend.name}}
{% set ssl_options = [] %}
{% if frontend.ssl_enabled == '1' %}
{# # check if ssl certs are configured #}
{% if frontend.ssl_certificates|default("") != "" %}
{% if frontend.ssl_certificates|default("") != "" or frontend.ssl_default_certificate|default("") != "" %}
{# # NOTE: Cert lists are generated by exportCerts.php #}
{% do ssl_certs.append('crt-list /tmp/haproxy/ssl/' ~ frontend.id ~ '.certlist') %}
{% endif %}