netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: update default SSL settings

Browse Source
This commit is contained in:
Frank Wall
2021-02-23 17:07:42 +01:00
parent 43f984def6
commit 436f5801f4
4 changed files with 36 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/pkg-descr
+7
View File
@@ -10,6 +10,13 @@ Plugin Changelog
Added:
* new feature to change server state and weight on-the-fly (#2213)
* add new SSL bind option: prefer-client-ciphers
Changed:
* change default SSL version to TLSv1.2 (ssl-min-ver)
* remove weak ciphers from (default) SSL settings
* remove default SSL bind options that would conflict with ssl-min-ver
* move SSL bind options below other SSL settings, they are rarely used nowadays
2.26
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
+9 -9
View File
@@ -89,15 +89,6 @@
<type>header</type>
<style>mode_table table_http table_ssl table_ssl_advanced table_ssl_advanced_true</style>
</field>
<field>
<id>frontend.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<sortable>true</sortable>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
<field>
<id>frontend.ssl_minVersion</id>
<label>Minimum SSL Version</label>
@@ -146,6 +137,15 @@
<type>text</type>
<help><![CDATA[Future requests to the domain should use only HTTPS for the specified time (in seconds): 15768000 = 6 months]]></help>
</field>
<field>
<id>frontend.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<sortable>true</sortable>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
<field>
<label>Client Certificate Auth</label>
<type>header</type>
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml
+9 -9
View File
@@ -85,15 +85,6 @@
<type>checkbox</type>
<help><![CDATA[Enable global SSL default values.]]></help>
</field>
<field>
<id>haproxy.general.tuning.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<sortable>true</sortable>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
<field>
<id>haproxy.general.tuning.ssl_minVersion</id>
<label>Minimum SSL Version</label>
@@ -118,4 +109,13 @@
<type>text</type>
<help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake for TLSv1.3.]]></help>
</field>
<field>
<id>haproxy.general.tuning.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<sortable>true</sortable>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
</form>
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+11 -7
View File
@@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/HAProxy</mount>
<version>2.10.0</version>
<version>3.0.0</version>
<description>the HAProxy load balancer</description>
<items>
<general>
@@ -129,7 +129,7 @@
</ssl_defaultsEnabled>
<ssl_bindOptions type="OptionField">
<Required>N</Required>
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
<default>prefer-client-ciphers</default>
<Sorted>Y</Sorted>
<Multiple>Y</Multiple>
<OptionValues>
@@ -144,11 +144,13 @@
<force-tlsv11>force-tlsv11</force-tlsv11>
<force-tlsv12>force-tlsv12</force-tlsv12>
<force-tlsv13>force-tlsv13</force-tlsv13>
<prefer-client-ciphers>prefer-client-ciphers</prefer-client-ciphers>
<strict-sni>strict-sni</strict-sni>
</OptionValues>
</ssl_bindOptions>
<ssl_minVersion type="OptionField">
<Required>N</Required>
<default>TLSv1.2</default>
<OptionValues>
<SSLv3>SSLv3</SSLv3>
<TLSv1.0>TLSv1.0</TLSv1.0>
@@ -168,11 +170,11 @@
</OptionValues>
</ssl_maxVersion>
<ssl_cipherList type="TextField">
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256</default>
<Required>N</Required>
</ssl_cipherList>
<ssl_cipherSuites type="TextField">
<default>TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256</default>
<default>TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256</default>
<Required>N</Required>
</ssl_cipherSuites>
</tuning>
@@ -461,7 +463,7 @@
</ssl_advancedEnabled>
<ssl_bindOptions type="OptionField">
<Required>N</Required>
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
<default>prefer-client-ciphers</default>
<Sorted>Y</Sorted>
<Multiple>Y</Multiple>
<OptionValues>
@@ -476,11 +478,13 @@
<force-tlsv11>force-tlsv11</force-tlsv11>
<force-tlsv12>force-tlsv12</force-tlsv12>
<force-tlsv13>force-tlsv13</force-tlsv13>
<prefer-client-ciphers>prefer-client-ciphers</prefer-client-ciphers>
<strict-sni>strict-sni</strict-sni>
</OptionValues>
</ssl_bindOptions>
<ssl_minVersion type="OptionField">
<Required>N</Required>
<default>TLSv1.2</default>
<OptionValues>
<SSLv3>SSLv3</SSLv3>
<TLSv1.0>TLSv1.0</TLSv1.0>
@@ -500,11 +504,11 @@
</OptionValues>
</ssl_maxVersion>
<ssl_cipherList type="TextField">
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256</default>
<Required>N</Required>
</ssl_cipherList>
<ssl_cipherSuites type="TextField">
<default>TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256</default>
<default>TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256</default>
<Required>N</Required>
</ssl_cipherSuites>
<ssl_hstsEnabled type="BooleanField">