From fd6016a9303e4b1821cea72a31ec23576e2b07e6 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 14 Apr 2020 21:53:29 +0200 Subject: [PATCH 1/6] net/haproxy: fix label of src_sess_cnt, closes #1780 --- .../src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index d70ebc823..e06699a61 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1388,7 +1388,7 @@ Source IP: number of HTTP requests Source IP: rate of HTTP requests - Source IP: cumulative number of connections + Source IP: cumulative number of sessions Source IP: session rate Minimum number of usable servers in backend Traffic is HTTP From 744f17a10cb35f0d14c3bd34f5cc55c94f237716 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 14 Apr 2020 23:24:27 +0200 Subject: [PATCH 2/6] net/haproxy: allow to enable SSL verification from health checks, refs #1761 --- .../templates/OPNsense/HAProxy/haproxy.conf | 25 ++++++++++++------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index ba7585640..40e947875 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1383,6 +1383,22 @@ backend {{backend.name}} {# # server ssl communication #} {% if server_data.ssl|default("") == '1' %} {% do server_options.append('ssl') %} +{# # HTTP/2 #} +{% if backend.http2Enabled|default("") == '1' and backend.ba_advertised_protocols|default("") != "" %} +{# # convert protocols to HAProxy-compatible format #} +{% set alpn_options = backend.ba_advertised_protocols|replace('http10', 'http/1.0')|replace('http11', 'http/1.1') %} +{% do server_options.append('alpn ' ~ alpn_options) %} +{% endif %} +{# # HTTP/2 without TLS #} +{% elif backend.http2Enabled|default("") == '1' and backend.http2Enabled_nontls|default("") == '1' %} +{% do server_options.append('proto h2') %} +{% endif %} +{# # ssl verification can be enabled for two reasons: #} +{# # 1. in server settings: to verify *all* communication to this server #} +{# # 2. in health checks: to verify *only* health check communication to this server #} +{# # When 1. is enabled, health checks are automatically secured. #} +{# # Use-case for 2: when using TCP for server communication, but HTTPS for health checks. #} +{% if server_data.ssl|default("") == '1' or (healthcheck_enabled == '1' and healthcheck_data.force_ssl|default('') == '1') %} {# # get status of ssl verification #} {% set ssl_verify_enabled = '0' %} {% if helpers.exists('OPNsense.HAProxy.general.tuning.sslServerVerify') and OPNsense.HAProxy.general.tuning.sslServerVerify|default("") != 'ignore' %} @@ -1410,15 +1426,6 @@ backend {{backend.name}} {% else %} {% do server_options.append('verify none') %} {% endif %} -{# # HTTP/2 #} -{% if backend.http2Enabled|default("") == '1' and backend.ba_advertised_protocols|default("") != "" %} -{# # convert protocols to HAProxy-compatible format #} -{% set alpn_options = backend.ba_advertised_protocols|replace('http10', 'http/1.0')|replace('http11', 'http/1.1') %} -{% do server_options.append('alpn ' ~ alpn_options) %} -{% endif %} -{# # HTTP/2 without TLS #} -{% elif backend.http2Enabled|default("") == '1' and backend.http2Enabled_nontls|default("") == '1' %} -{% do server_options.append('proto h2') %} {% endif %} {# # source address #} {% if backend.source|default("") != "" %} From 25c3c1ffab9024c11591fed525d673339c4d824d Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 14 Apr 2020 23:31:46 +0200 Subject: [PATCH 3/6] net/haproxy: fallback to system CA certs for SSL verification, refs #1761 --- .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 40e947875..0574f0a45 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1414,6 +1414,9 @@ backend {{backend.name}} {# # check for SSL CA #} {% if server_data.sslCA|default("") != "" %} {% do server_options.append('ca-file /tmp/haproxy/ssl/' ~ server_data.id ~ '.calist') %} +{% else %} +{# # fallback to system CA Root Certificates #} +{% do server_options.append('ca-file /etc/ssl/cert.pem') %} {% endif %} {# # check for SSL CRL #} {% if server_data.sslCRL|default("") != "" %} From cf179b19ad71c919f6c69c99e4e7b00d8236d9c9 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 14 Apr 2020 23:53:17 +0200 Subject: [PATCH 4/6] net/haproxy: fix invalid use of option httplog This resolves the infamous warning: 'option httplog' not usable with frontend (needs 'mode http') --- .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 0574f0a45..1e47bd478 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1119,7 +1119,7 @@ frontend {{frontend.name}} {% endif %} {% if frontend.logging_detailedLog=='1' %} {# # automatically select the best-suited log type #} -{% if frontend.mode == 'tcp' %} +{% if frontend.mode == 'tcp' or frontend.mode == 'ssl' %} option tcplog {% else %} option httplog From ceb08f9334d4210e3ef03dd876442e069c20213e Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 14 Apr 2020 23:58:41 +0200 Subject: [PATCH 5/6] net/haproxy: fix invalid use of option forwardfor This resolves another infamous warning during config test: 'option forwardfor' ignored for frontend as it requires HTTP mode --- .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 1e47bd478..d3d429689 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1087,7 +1087,7 @@ frontend {{frontend.name}} http-request replace-header Cookie '^(.*?; )?({{backend_data.persistence_cookiename}}=)"([^;"]*)"(;.*)?$' \1\2\3\4 {% endif %} {% endif %} -{% if frontend.forwardFor == '1' %} +{% if frontend.forwardFor == '1' and frontend.mode == 'http' %} option forwardfor {% endif %} # tuning options From 61391097b30072fd1167f8ebcd3bddb8038f7eee Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 16 Apr 2020 00:00:58 +0200 Subject: [PATCH 6/6] net/haproxy: bump version --- net/haproxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index eee2f29f1..9cd8c4701 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 2.21 +PLUGIN_VERSION= 2.22 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de