netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: support multiple CAs in servers

Browse Source 
For historical reasons we only supported a single CA in servers.
This artificial limit is finally removed. As a side effect it was
also possible to drop the previously added CA export code.

This loosely refs #1074 (and hopefully doesn't break it again).
This commit is contained in:
Frank Wall
2018-12-25 23:54:19 +01:00
parent 2a1a7e0a7c
commit 7c00f26e74
4 changed files with 12 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogServer.xml
+3 -2
View File
@@ -46,8 +46,9 @@
<field>
<id>server.sslCA</id>
<label>SSL Verify CA</label>
<type>dropdown</type>
<help><![CDATA[This certificate authority will be used to verify server's certificate. <br/>To import additional CAs, go to <a href="/system_certmanager.php">Certificate Manager</a>.]]></help>
<type>select_multiple</type>
<allownew>true</allownew>
<help><![CDATA[These CAs will be used to verify server's certificate. <br/>To import additional CAs, go to <a href="/system_certmanager.php">Certificate Manager</a>.]]></help>
<hint>Type CA name or choose from list.</hint>
</field>
<field>
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+2 -1
View File
@@ -1053,7 +1053,8 @@
<sslCA type="CertificateField">
<Required>N</Required>
<Type>ca</Type>
<ValidationMessage>Please select a valid CA from the list.</ValidationMessage>
<Multiple>Y</Multiple>
<ValidationMessage>Please select one or more CAs from the list.</ValidationMessage>
</sslCA>
<sslCRL type="CertificateField">
<Required>N</Required>
net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php
+6 -17
View File
@@ -85,26 +85,15 @@ foreach ($configNodes as $key => $value) {
}
// generate pem file for individual certs
// (not supported for CRLs)
if (($type == 'cert') or ($type == 'ca')) {
if ($type == 'cert') {
$output_pem_filename = $export_path . $cert_refid . ".pem";
file_put_contents($output_pem_filename, $pem_content);
chmod($output_pem_filename, 0600);
echo "exported $type to " . $output_pem_filename . "\n";
/* For future reference, CAs are used in two ways:
* 1. for server SSL verification:
* *one* CA cert + private key in a .pem file
* 2. for SSL client authentication:
* *multiple* CA certs + private keys in a .calist file
* The jinja template decides wether the .pem or .calist file will be used.
*/
if ($type == 'ca') {
$crtlist[] = $pem_content;
} else {
$crtlist[] = $output_pem_filename;
}
$crtlist[] = $output_pem_filename;
} else {
// CRLs need to be put in a single file, lists are not supported.
// In contrast to certificates, CA/CRL content needs to be put in a single file.
// A list of individual files is not supported by HAproxy.
$crtlist[] = $pem_content;
}
}
@@ -112,8 +101,8 @@ foreach ($configNodes as $key => $value) {
}
}
// generate list file
// (only supported for frontends)
if ($key == 'frontends') {
// (only supported for frontends and servers)
if (($key == 'frontends') or ($key == 'servers')) {
// ignore if list is empty
if (empty($crtlist)) {
continue;
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+1 -1
View File
@@ -1336,7 +1336,7 @@ backend {{backend.name}}
{% do server_options.append('verify required') %}
{# # check for SSL CA #}
{% if server_data.sslCA|default("") != "" %}
{% do server_options.append('ca-file /tmp/haproxy/ssl/' ~ server_data.sslCA ~ '.pem') %}
{% do server_options.append('ca-file /tmp/haproxy/ssl/' ~ server_data.id ~ '.calist') %}
{% endif %}
{# # check for SSL CRL #}
{% if server_data.sslCRL|default("") != "" %}