From 5baf2577724daef2d6fa24b4fc9abe12cfded917 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sun, 11 Nov 2018 16:14:33 +0100
Subject: [PATCH] net/haproxy: use new user management for stats auth

---
 .../OPNsense/HAProxy/forms/main.xml           | 15 +++--
 .../app/models/OPNsense/HAProxy/HAProxy.xml   | 24 ++++++++
 .../OPNsense/HAProxy/Migrations/M2_6_0.php    | 56 +++++++++++++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf   | 27 ++++++---
 4 files changed, 108 insertions(+), 14 deletions(-)
 create mode 100644 net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M2_6_0.php

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
index ef67afc0f..417f1e51b 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
@@ -292,13 +292,18 @@
                 <type>checkbox</type>
             </field>
             <field>
-                <id>haproxy.general.stats.users</id>
-                <label>Stats users</label>
+                <id>haproxy.general.stats.allowedUsers</id>
+                <label>Allowed Users</label>
                 <type>select_multiple</type>
-                <style>tokenize</style>
                 <allownew>true</allownew>
-                <help><![CDATA[Grant access to HAProxy statistics page. Please provide both user and password in clear text separated by a ':', i.e. john:secret123 or jdoe:anonymous. Use TAB key to complete adding a user.]]></help>
-                <hint>Enter user:password here. Finish with TAB.</hint>
+                <hint>Type username or choose from list.</hint>
+            </field>
+            <field>
+                <id>haproxy.general.stats.allowedGroups</id>
+                <label>Allowed Groups</label>
+                <type>select_multiple</type>
+                <allownew>true</allownew>
+                <hint>Type group or choose from list.</hint>
             </field>
             <field>
                 <id>haproxy.general.stats.customOptions</id>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 72bd1637f..66b025dfe 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -289,6 +289,30 @@
                     <mask>/^((([0-9a-zA-Z._\-]+:[0-9a-zA-Z._\-]+)([,]){0,1}))*/u</mask>
                     <ValidationMessage>Please provide a valid user and password, i.e. user:secret123.</ValidationMessage>
                 </users>
+                <allowedUsers type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.HAProxy.HAProxy</source>
+                            <items>users.user</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <ValidationMessage>Related user not found</ValidationMessage>
+                    <multiple>Y</multiple>
+                    <Required>N</Required>
+                </allowedUsers>
+                <allowedGroups type="ModelRelationField">
+                    <Model>
+                        <template>
+                            <source>OPNsense.HAProxy.HAProxy</source>
+                            <items>groups.group</items>
+                            <display>name</display>
+                        </template>
+                    </Model>
+                    <ValidationMessage>Related group not found</ValidationMessage>
+                    <multiple>Y</multiple>
+                    <Required>N</Required>
+                </allowedGroups>
                 <customOptions type="TextField">
                     <Required>N</Required>
                 </customOptions>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M2_6_0.php b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M2_6_0.php
new file mode 100644
index 000000000..53bd4a432
--- /dev/null
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M2_6_0.php
@@ -0,0 +1,56 @@
+<?php
+/**
+ *    Copyright (C) 2018 Frank Wall
+ *
+ *    All rights reserved.
+ *
+ *    Redistribution and use in source and binary forms, with or without
+ *    modification, are permitted provided that the following conditions are met:
+ *
+ *    1. Redistributions of source code must retain the above copyright notice,
+ *       this list of conditions and the following disclaimer.
+ *
+ *    2. Redistributions in binary form must reproduce the above copyright
+ *       notice, this list of conditions and the following disclaimer in the
+ *       documentation and/or other materials provided with the distribution.
+ *
+ *    THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES,
+ *    INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+ *    AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ *    AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,
+ *    OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ *    SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ *    INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ *    CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ *    ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+ *    POSSIBILITY OF SUCH DAMAGE.
+ *
+ */
+namespace OPNsense\HAProxy\Migrations;
+
+use OPNsense\Base\BaseModelMigration;
+
+class M2_6_0 extends BaseModelMigration
+{
+    public function run($model)
+    {
+        // Migrate old stats user:password entries to new user management feature
+        if (!empty((string)$model->general->stats->users)) {
+
+            // Add new user for each entry
+            $UUIDlist = array();
+            foreach (explode(',', (string)$model->general->stats->users) as $statsuser) {
+                $olddata = explode(':',$statsuser,2);
+                $userNode = $model->users->user->Add();
+                $userNode->name = (string)$olddata[0];
+                $userNode->description = 'stats user';
+                $userNode->password = (string)$olddata[1];
+                $userNode->enabled = 1;
+                $UUIDlist[] = $userNode->getAttributes()['uuid'];
+            }
+
+            // Add collected UUIDs to new list of allowed users
+            $model->general->stats->allowedUsers = (string)implode(',', $UUIDlist);
+        }
+    }
+}
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 784d4d06b..a1bcbbaba 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -907,7 +907,18 @@ userlist group_{{group_data.id}}
 {%   endfor %}
 {% endif %}
 
-# XXX: autogenerated entries for stats
+# autogenerated entries for stats
+{% if OPNsense.HAProxy.general.stats.remoteEnabled|default("") == "1" %}
+{%   if (OPNsense.HAProxy.general.stats.allowedUsers|default("") != "") or (OPNsense.HAProxy.general.stats.allowedGroups|default("") != "") %}
+{#     # call macro to generate list of unique users #}
+{%     set userlist_result = UserlistAddUsers(OPNsense.HAProxy.general.stats.allowedUsers, OPNsense.HAProxy.general.stats.allowedGroups) %}
+{#     # check result, skip when empty #}
+{%     if (userlist_result is defined and userlist_result|default("") != "" )%}
+userlist stats_auth
+{{userlist_result}}
+{%     endif %}
+{%   endif %}
+{% endif %}
 
 {# ############################### #}
 {#             FRONTENDS           #}
@@ -1382,15 +1393,12 @@ listen  remote_statistics
 {%       endfor %}
     mode            http
     stats uri       /haproxy?stats
-    stats realm     HAProxy\ statistics
     stats hide-version
 {#       # enable authentication? #}
 {%       if OPNsense.HAProxy.general.stats.authEnabled|default("") == "1" %}
-{%         if OPNsense.HAProxy.general.stats.users|default("") != "" %}
-{%           for statsuser in OPNsense.HAProxy.general.stats.users.split(",") %}
-    stats auth      {{statsuser}}
-{%           endfor %}
-{%         endif %}
+    acl auth_ok http_auth(stats_auth)
+    stats http-request allow if auth_ok
+    stats http-request auth realm HAProxy\ statistics
 {%       endif %}
 {%       if OPNsense.HAProxy.general.stats.customOptions|default("") != "" %}
     # WARNING: pass through options below this line
@@ -1401,9 +1409,10 @@ listen  remote_statistics
 {%     else %}
 # ERROR: remote statistics disabled, because no listen address was specified
 {%     endif %}
-{%   endif %}
-{% else %}
+{%   else %}
 # statistics are DISABLED
+{%   endif %}
+
 {% endif %}
 
 {% endif %}