From 63dde5fc65ec670a3f698cf7609d38dc8d0cc289 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 19 Feb 2021 00:18:01 +0100
Subject: [PATCH] net/haproxy: add support for custom header checks, closes
 #1907

---
 net/haproxy/pkg-descr                         |  1 +
 .../OPNsense/HAProxy/forms/dialogAcl.xml      | 85 +++++++++++++++++++
 .../app/models/OPNsense/HAProxy/HAProxy.xml   | 55 ++++++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf   | 35 ++++++++
 4 files changed, 176 insertions(+)

diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr
index dab4836e5..9ace5e787 100644
--- a/net/haproxy/pkg-descr
+++ b/net/haproxy/pkg-descr
@@ -18,6 +18,7 @@ Added:
 * guard against broken config by using a staging config file
 * add basic OCSP stapling support (#1430)
 * add support for e-mail alerts and mailers (#1669)
+* add support for custom header checks (#1907)
 
 Fixed:
 * fix maintenance page (python error: 'list' object has no attribute 'strip')
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
index a0a7a5b7c..3d5bb47cd 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
@@ -148,6 +148,91 @@
         <type>text</type>
         <help><![CDATA[HTTP request URL path contains string (substring match)]]></help>
     </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_cust_hdr_beg</style>
+    </field>
+    <field>
+        <id>acl.cust_hdr_beg_name</id>
+        <label>Header Name</label>
+        <type>text</type>
+        <help><![CDATA[The name of the HTTP Header.]]></help>
+    </field>
+    <field>
+        <id>acl.cust_hdr_beg</id>
+        <label>Header Prefix</label>
+        <type>text</type>
+        <help><![CDATA[HTTP Header starts with string (prefix match)]]></help>
+    </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_cust_hdr_end</style>
+    </field>
+    <field>
+        <id>acl.cust_hdr_end_name</id>
+        <label>Header Name</label>
+        <type>text</type>
+        <help><![CDATA[The name of the HTTP Header.]]></help>
+    </field>
+    <field>
+        <id>acl.cust_hdr_end</id>
+        <label>Header Suffix</label>
+        <type>text</type>
+        <help><![CDATA[HTTP Header ends with string (suffix match)]]></help>
+    </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_cust_hdr</style>
+    </field>
+    <field>
+        <id>acl.cust_hdr_name</id>
+        <label>Header Name</label>
+        <type>text</type>
+        <help><![CDATA[The name of the HTTP Header.]]></help>
+    </field>
+    <field>
+        <id>acl.cust_hdr</id>
+        <label>Header Matches</label>
+        <type>text</type>
+        <help><![CDATA[HTTP Header matches exact string]]></help>
+    </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_cust_hdr_reg</style>
+    </field>
+    <field>
+        <id>acl.cust_hdr_reg_name</id>
+        <label>Header Name</label>
+        <type>text</type>
+        <help><![CDATA[The name of the HTTP Header.]]></help>
+    </field>
+    <field>
+        <id>acl.cust_hdr_reg</id>
+        <label>Header Regex</label>
+        <type>text</type>
+        <help><![CDATA[HTTP Header matches regular expression]]></help>
+    </field>
+    <field>
+        <label>Parameters</label>
+        <type>header</type>
+        <style>expression_table table_cust_hdr_sub</style>
+    </field>
+    <field>
+        <id>acl.cust_hdr_sub_name</id>
+        <label>Header Name</label>
+        <type>text</type>
+        <help><![CDATA[The name of the HTTP Header.]]></help>
+    </field>
+    <field>
+        <id>acl.cust_hdr_sub</id>
+        <label>Header Contains</label>
+        <type>text</type>
+        <help><![CDATA[HTTP Header contains string (substring match)]]></help>
+    </field>
     <field>
         <label>Parameters</label>
         <type>header</type>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 7e2086bd9..211350c1f 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -1466,6 +1466,11 @@
                         <path_reg>Path regex</path_reg>
                         <path_dir>Path contains subdir</path_dir>
                         <path_sub>Path contains string</path_sub>
+                        <cust_hdr_beg>HTTP Header starts with</cust_hdr_beg>
+                        <cust_hdr_end>HTTP Header ends with</cust_hdr_end>
+                        <cust_hdr>HTTP Header matches</cust_hdr>
+                        <cust_hdr_reg>HTTP Header regex</cust_hdr_reg>
+                        <cust_hdr_sub>HTTP Header contains</cust_hdr_sub>
                         <url_param>URL parameter contains</url_param>
                         <ssl_c_verify>SSL Client certificate is valid</ssl_c_verify>
                         <ssl_c_verify_code>SSL Client certificate verify error result</ssl_c_verify_code>
@@ -1563,6 +1568,56 @@
                     <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
                     <Required>N</Required>
                 </path_sub>
+                <cust_hdr_beg_name type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_beg_name>
+                <cust_hdr_beg type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_beg>
+                <cust_hdr_end_name type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_end_name>
+                <cust_hdr_end type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_end>
+                <cust_hdr_name type="TextField">
+                    <mask>/^.{1,1024}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_name>
+                <cust_hdr type="TextField">
+                    <mask>/^.{1,1024}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr>
+                <cust_hdr_reg_name type="TextField">
+                    <mask>/^.{1,1024}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_reg_name>
+                <cust_hdr_reg type="TextField">
+                    <mask>/^.{1,1024}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 1024 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_reg>
+                <cust_hdr_sub_name type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_sub_name>
+                <cust_hdr_sub type="TextField">
+                    <mask>/^.{1,255}$/u</mask>
+                    <ValidationMessage>Should be a string between 1 and 255 characters.</ValidationMessage>
+                    <Required>N</Required>
+                </cust_hdr_sub>
                 <url_param type="TextField">
                     <mask>/^.{1,4096}$/u</mask>
                     <Required>N</Required>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 64f07b7cb..5dff7a2f7 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -158,6 +158,41 @@
 {%                 set acl_enabled = '0' %}
     # ERROR: missing parameters
 {%               endif %}
+{%             elif acl_data.expression == 'cust_hdr_beg' %}
+{%               if acl_data.cust_hdr_beg|default("") != "" and acl_data.cust_hdr_beg_name|default("") != "" %}
+{%                 do acl_options.append('hdr_beg(' ~ acl_data.cust_hdr_beg_name ~ ') -i ' ~ acl_data.cust_hdr_beg) %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
+{%             elif acl_data.expression == 'cust_hdr_end' %}
+{%               if acl_data.cust_hdr_end|default("") != "" and acl_data.cust_hdr_end_name|default("") %}
+{%                 do acl_options.append('hdr_end(' ~ acl_data.cust_hdr_end_name ~ ') -i ' ~ acl_data.cust_hdr_end) %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
+{%             elif acl_data.expression == 'cust_hdr' %}
+{%               if acl_data.cust_hdr|default("") != "" and acl_data.cust_hdr_name|default("") != "" %}
+{%                 do acl_options.append('hdr(' ~ acl_data.cust_hdr_name ~ ') -i ' ~ acl_data.cust_hdr) %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
+{%             elif acl_data.expression == 'cust_hdr_reg' %}
+{%               if acl_data.cust_hdr_reg|default("") != "" and acl_data.cust_hdr_reg_name|default("") != "" %}
+{%                 do acl_options.append('hdr_reg(' ~ acl_data.cust_hdr_reg_name ~ ') -i ' ~ acl_data.cust_hdr_reg) %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
+{%             elif acl_data.expression == 'cust_hdr_sub' %}
+{%               if acl_data.cust_hdr_sub|default("") != "" and acl_data.cust_hdr_sub_name|default("") != "" %}
+{%                 do acl_options.append('hdr_sub(' ~ acl_data.cust_hdr_sub_name ~ ') -i ' ~ acl_data.cust_hdr_sub) %}
+{%               else %}
+{%                 set acl_enabled = '0' %}
+    # ERROR: missing parameters
+{%               endif %}
 {%             elif acl_data.expression == 'url_param' %}
 {%               if acl_data.url_param_value|default("") != "" and acl_data.url_param|default("") != "" %}
 {%                 do acl_options.append('url_param(' ~ acl_data.url_param ~ ') -i ' ~ acl_data.url_param_value) %}