From 4f617b6d9cb0bfdcf6e884b96da68e467db16d8e Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 4 Jan 2023 22:50:43 +0100 Subject: [PATCH 01/10] net/haproxy: update URLs to HAProxy 2.6 documentation, refs #3026 --- net/haproxy/pkg-descr | 3 +++ .../OPNsense/HAProxy/forms/dialogAction.xml | 12 ++++++------ .../OPNsense/HAProxy/forms/dialogBackend.xml | 10 +++++----- .../OPNsense/HAProxy/forms/dialogFcgi.xml | 2 +- .../OPNsense/HAProxy/forms/dialogFrontend.xml | 6 +++--- .../OPNsense/HAProxy/forms/dialogMapfile.xml | 2 +- .../mvc/app/views/OPNsense/HAProxy/index.volt | 10 +++++----- 7 files changed, 24 insertions(+), 21 deletions(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index d675ec264..2333e2ed1 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -6,6 +6,9 @@ very high loads while needing persistence or Layer7 processing. Plugin Changelog ================ +Changed: +* update URLs to HAProxy 2.6 documentation + 3.12 Added: diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml index 7a499dab8..e03c3632b 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml @@ -89,7 +89,7 @@ action.http_request_redirect text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> @@ -128,7 +128,7 @@ action.http_request_add_header_content text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> @@ -145,7 +145,7 @@ action.http_request_set_header_content text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> @@ -251,7 +251,7 @@ action.http_response_add_header_content text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> @@ -268,7 +268,7 @@ action.http_response_set_header_content text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> @@ -468,6 +468,6 @@ action.fcgi_set_param text - Custom Log format rules. With this directive, it is possible to overwrite the value of default FastCGI parameters.]]> + Custom Log format rules. With this directive, it is possible to overwrite the value of default FastCGI parameters.]]> diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml index 7615ceb09..c7babd3a7 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml @@ -28,7 +28,7 @@ backend.algorithm dropdown - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> Choose a load balancing algorithm. @@ -42,7 +42,7 @@ backend.proxyProtocol dropdown - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> true @@ -192,7 +192,7 @@ backend.persistence_cookiemode dropdown - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> backend.persistence_cookiename @@ -214,14 +214,14 @@ backend.stickiness_pattern dropdown - HAProxy documentation for a full description.
NOTE: Consider not using this feature in multi-process mode, it can result in random behaviours.
]]> + HAProxy documentation for a full description.
NOTE: Consider not using this feature in multi-process mode, it can result in random behaviours.
]]> Choose a persistence type. backend.stickiness_dataTypes select_multiple - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> backend.stickiness_expire diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFcgi.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFcgi.xml index ffaec1d91..fd6e48bfd 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFcgi.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFcgi.xml @@ -33,7 +33,7 @@ fcgi.path_info text - HAProxy's documentation for further details and examples.]]> + HAProxy's documentation for further details and examples.]]> fcgi.log_stderr diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml index 9f6fb5801..98475acd0 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml @@ -336,14 +336,14 @@ frontend.stickiness_pattern dropdown - HAProxy documentation for further information.]]> + HAProxy documentation for further information.]]> Choose a stick-table type. frontend.stickiness_dataTypes select_multiple - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> frontend.stickiness_expire @@ -370,7 +370,7 @@ frontend.stickiness_counter_key text - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> true diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogMapfile.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogMapfile.xml index fc0011cc8..6b8e712a3 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogMapfile.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogMapfile.xml @@ -15,6 +15,6 @@ mapfile.content textbox - HAProxy documentation for a full description.]]> + HAProxy documentation for a full description.]]> diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt index 2dc92a782..ee36d6a4a 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt @@ -717,7 +717,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._('Lastly, enable HAProxy using the %sService%s settings page.') | format('', '') }}

    • {{ lang._('Please be aware that you need to %smanually%s add the required firewall rules for all configured services.') | format('', '') }}

    -

    {{ lang._('Further information is available in our %sHAProxy plugin documentation%s and of course in the %sofficial HAProxy documentation%s. Be sure to report bugs and request features on our %sGitHub issue page%s. Code contributions are also very welcome!') | format('', '', '', '', '', '') }}

    +

    {{ lang._('Further information is available in our %sHAProxy plugin documentation%s and of course in the %sofficial HAProxy documentation%s. Be sure to report bugs and request features on our %sGitHub issue page%s. Code contributions are also very welcome!') | format('', '', '', '', '', '') }}


    @@ -759,7 +759,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._('%sConditions:%s HAProxy is capable of extracting data from requests, responses and other connection data and match it against predefined patterns. Use these powerful patterns to compose a condition that may be used in multiple Rules.') | format('', '') }}
  • {{ lang._('%sRules:%s Perform a large set of actions if one or more %sConditions%s match. These Rules may be used in %sBackend Pools%s as well as %sPublic Services%s.') | format('', '', '', '', '', '', '', '') }}
    • -

    {{ lang._("For more information on HAProxy's %sACL feature%s see the %sofficial documentation%s.") | format('', '', '', '') }}

    +

    {{ lang._("For more information on HAProxy's %sACL feature%s see the %sofficial documentation%s.") | format('', '', '', '') }}

    {{ lang._('Note that it is possible to directly add options to the HAProxy configuration by using the "option pass-through", a setting that is available for several configuration items. It allows you to implement configurations that are currently not officially supported by this plugin. It is strongly discouraged to rely on this feature. Please report missing features on our GitHub page!') | format('', '') }}


    @@ -774,7 +774,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._('%sGroup:%s A optional list containing one or more users. Groups usually make it easier to manage permissions for a large number of users') | format('', '') }}

    • {{ lang._('Note that users and groups must be selected from the Backend Pool or Public Service configuration in order to be used for authentication. In addition to this users and groups may also be used in Rules/Conditions.') }}

    -

    {{ lang._("For more information on HAProxy's %suser/group management%s see the %sofficial documentation%s.") | format('', '', '', '') }}

    +

    {{ lang._("For more information on HAProxy's %suser/group management%s see the %sofficial documentation%s.") | format('', '', '', '') }}


    @@ -792,7 +792,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._("%sCache:%s HAProxy's cache which was designed to perform cache on small objects (favicon, css, etc.). This is a minimalist low-maintenance cache which runs in RAM.") | format('', '', '', '') }}
  • {{ lang._("%sPeers:%s Configure a communication channel between two HAProxy instances. This will propagate entries of any data-types in stick-tables between these HAProxy instances over TCP connections in a multi-master fashion. Useful when aiming for a seamless failover in a HA setup.") | format('', '', '', '') }}
    • -

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sStatistics%s, %sCache%s and %sPeers%s features.") | format('', '', '', '', '', '') }}

    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sStatistics%s, %sCache%s and %sPeers%s features.") | format('', '', '', '', '', '') }}


    @@ -810,7 +810,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._("%sResolvers:%s This feature allows in-depth configuration of how HAProxy handles name resolution and interacts with name resolvers (DNS). Each resolver configuration can be used in %sBackend Pools%s to apply individual name resolution configurations.") | format('', '', '', '') }}
  • {{ lang._("%sE-Mail Alerts:%s It is possible to send email alerts when the state of servers changes. Each configuration can be used in %sBackend Pools%s to send e-mail alerts to the configured recipient.") | format('', '', '', '') }}
    • -

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s. A detailed explanation of the resolvers feature can be found %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '','', '') }}

    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s. A detailed explanation of the resolvers feature can be found %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '','', '') }}


    From 4538a854d5bd7a782fd49d8d79e4d159a2b15293 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 4 Jan 2023 23:19:50 +0100 Subject: [PATCH 02/10] net/haproxy: remove process-related options, refs #3026 --- net/haproxy/pkg-descr | 5 ++ .../HAProxy/Api/SettingsController.php | 2 +- .../OPNsense/HAProxy/forms/dialogCpu.xml | 6 -- .../OPNsense/HAProxy/forms/generalTuning.xml | 7 -- .../app/models/OPNsense/HAProxy/HAProxy.xml | 78 ------------------- .../mvc/app/views/OPNsense/HAProxy/index.volt | 1 - .../templates/OPNsense/HAProxy/haproxy.conf | 13 +--- 7 files changed, 9 insertions(+), 103 deletions(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 2333e2ed1..b3867d3e2 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -9,6 +9,11 @@ Plugin Changelog Changed: * update URLs to HAProxy 2.6 documentation +Removed: +* remove Processes/nbproc option (use Threads/nbthread instead) +* remove "Process ID" from CPU Affinity settings (now always 1) +* remove "bind-process" option (replaced by the "process" bind keyword) + 3.12 Added: diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php index 4e0006f39..4231ca119 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php @@ -343,7 +343,7 @@ class SettingsController extends ApiMutableModelControllerBase public function searchCpusAction() { - return $this->searchBase('cpus.cpu', array('enabled', 'name', 'process_id', 'thread_id', 'cpu_id'), 'name'); + return $this->searchBase('cpus.cpu', array('enabled', 'name', 'thread_id', 'cpu_id'), 'name'); } public function getGroupAction($uuid = null) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogCpu.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogCpu.xml index a1d97f46e..8e0b70596 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogCpu.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogCpu.xml @@ -11,12 +11,6 @@ text Choose a name for this CPU affinity rule. - - cpu.process_id - - dropdown - Process ID that should bind to a specific CPU set. Any process IDs above nbproc are ignored. - cpu.thread_id diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml index 807087cce..0bef8a78b 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml @@ -10,13 +10,6 @@
    NOTE: Running as user root could be a security issue but it may be required by some features.
    ]]>     true     - - haproxy.general.tuning.nbproc - - text -
    WARNING: This option is deprecated and will be removed in a future version of HAProxy, threads should be used instead.
    ]]>     - true -     haproxy.general.tuning.nbthread diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 8289391d5..a4920acc2 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -72,13 +72,6 @@ Please specify a value between 0 and 10000000. N - - 1 - 1 - 128 - Please specify a value between 1 and 128. - Y - 1 1 @@ -2712,77 +2705,6 @@ Should be a string between 1 and 255 characters. Y - - Y - - All HAProxy processes - Processes with odd ID - Processes with even ID - Process 1 - Process 2 - Process 3 - Process 4 - Process 5 - Process 6 - Process 7 - Process 8 - Process 9 - Process 10 - Process 11 - Process 12 - Process 13 - Process 14 - Process 15 - Process 16 - Process 17 - Process 18 - Process 19 - Process 20 - Process 21 - Process 22 - Process 23 - Process 24 - Process 25 - Process 26 - Process 27 - Process 28 - Process 29 - Process 30 - Process 31 - Process 32 - Process 33 - Process 34 - Process 35 - Process 36 - Process 37 - Process 38 - Process 39 - Process 40 - Process 41 - Process 42 - Process 43 - Process 44 - Process 45 - Process 46 - Process 47 - Process 48 - Process 49 - Process 50 - Process 51 - Process 52 - Process 53 - Process 54 - Process 55 - Process 56 - Process 57 - Process 58 - Process 59 - Process 60 - Process 61 - Process 62 - Process 63 - - Y diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt index ee36d6a4a..54dd719be 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt @@ -1131,7 +1131,6 @@ POSSIBILITY OF SUCH DAMAGE. {{ lang._('CPU Rule ID') }} {{ lang._('Enabled') }} {{ lang._('Name') }} - {{ lang._('Process ID') }} {{ lang._('Thread ID') }} {{ lang._('CPU ID') }} {{ lang._('Commands') }} diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index e0fb1fd7a..418a16c1e 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -960,14 +960,13 @@ global {% else %} stats socket /var/run/haproxy.socket group proxy mode 775 level admin {% endif %} - nbproc {{OPNsense.HAProxy.general.tuning.nbproc}} {% if OPNsense.HAProxy.general.tuning.nbthread|default('') != '' %} nbthread {{OPNsense.HAProxy.general.tuning.nbthread}} {% endif %} {% if helpers.exists('OPNsense.HAProxy.cpus.cpu') %} {% for cpu_map in helpers.toList('OPNsense.HAProxy.cpus.cpu') %} {% if cpu_map.enabled == '1' %} - cpu-map {{cpu_map.process_id|replace('x', '')}}/{{cpu_map.thread_id|replace('x', '')}} {{cpu_map.cpu_id|replace('x', '')|replace(',', ' ')}} + cpu-map 1/{{cpu_map.thread_id|replace('x', '')}} {{cpu_map.cpu_id|replace('x', '')|replace(',', ' ')}} {% endif %} {% endfor %} {% endif %} @@ -1372,20 +1371,14 @@ frontend {{frontend.name}} {% do adv_options.append('proto h2') %} {% endif %} {# # CPU affinity configuration #} -{% set bind_process = [] %} {% if frontend.linkedCpuAffinityRules|default('') != '' %} {% for cpu_map in frontend.linkedCpuAffinityRules.split(',') %} {% set cpu_map_data = helpers.getUUID(cpu_map) %} {% if cpu_map_data.enabled == '1' %} -{# # Limit visibility to a certain set of processes #} -{% do bind_process.append(cpu_map_data.process_id|replace('x', '')) %} -{# # Restrict the list of processes/threads on which this listener is allowed to run #} -{% do adv_options.append('process ' ~ cpu_map_data.process_id|replace('x', '') ~ '/' ~ cpu_map_data.thread_id|replace('x', '')) %} +{# # Restrict the list of threads on which this listener is allowed to run #} +{% do adv_options.append('process ' ~ '1/' ~ cpu_map_data.thread_id|replace('x', '')) %} {% endif %} {% endfor %} -{% if bind_process|length > 0 %} - bind-process {{bind_process|join(' ')}} -{% endif %} {% endif %} {# # bind/listen configuration #} {% if frontend.bind|default("") != "" %} From 2e8b59cde703ee69ca2e0b71045427f6e8d89bb4 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 4 Jan 2023 23:28:56 +0100 Subject: [PATCH 03/10] net/haproxy: remove traces of removed option chksize, refs #3026 --- .../controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml index f77d4ccb7..179ef4b8e 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogHealthcheck.xml @@ -96,7 +96,7 @@ healthcheck.http_value text -
    NOTE: It is important to note that the responses will be limited to a certain size defined by the global "tune.chksize" option, which defaults to 16384 bytes.
    ]]>     +     @@ -112,7 +112,7 @@ healthcheck.tcp_sendValue text -
    NOTE: It is important to note that the responses will be limited to a certain size defined by the global "tune.chksize" option, which defaults to 16384 bytes.
    ]]>     +     healthcheck.tcp_matchType From 605a3f4b9ce1ec450b67333c844190aefb1d572f Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 00:03:05 +0100 Subject: [PATCH 04/10] net/haproxy: remove options "http-tunnel" and "forceclose", refs #3026 --- net/haproxy/pkg-descr | 11 ++-- .../OPNsense/HAProxy/forms/dialogFrontend.xml | 14 +++--- .../app/models/OPNsense/HAProxy/HAProxy.xml | 4 +- .../OPNsense/HAProxy/Migrations/M4_0_0.php | 50 +++++++++++++++++++ 4 files changed, 65 insertions(+), 14 deletions(-) create mode 100644 net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M4_0_0.php diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index b3867d3e2..1675d938b 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -7,12 +7,15 @@ Plugin Changelog ================ Changed: -* update URLs to HAProxy 2.6 documentation +* rename frontend option "Type" to "Connection Mode" (#3026) +* update URLs to HAProxy 2.6 documentation (#3026) +* migrate options "http-tunnel" and "forceclose" to "http-keep-alive" (#3026) Removed: -* remove Processes/nbproc option (use Threads/nbthread instead) -* remove "Process ID" from CPU Affinity settings (now always 1) -* remove "bind-process" option (replaced by the "process" bind keyword) +* remove Processes/nbproc option (use Threads/nbthread instead) (#3026) +* remove "Process ID" from CPU Affinity settings (now always 1) (#3026) +* remove "bind-process" option (replaced by the "process" bind keyword) (#3026) +* remove options "http-tunnel" and "forceclose" from "Connection Mode" (#3026) 3.12 diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml index 98475acd0..9d776f2ff 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml @@ -225,6 +225,13 @@ true + + frontend.connectionBehaviour + + dropdown + keep-alive mode with regards to persistent connections. Option "httpclose" configures HAProxy to close connections with the server and the client as soon as the request and the response are received. It will also check if a "Connection: close" header is already set in each direction, and will add one if missing. Option "http-server-close" enables HTTP connection-close mode on the server side while keeping the ability to support HTTP keep-alive and pipelining on the client side.]]> + true + header @@ -426,13 +433,6 @@ header - - frontend.connectionBehaviour - - dropdown - keep-alive mode with regards to persistent connections. Option "http-tunnel" disables any HTTP processing past the first request and the first response. Option "httpclose" configures HAProxy to work in HTTP tunnel mode and check if a "Connection: close" header is already set in each direction, and will add one if missing. Option "http-server-close" enables HTTP connection-close mode on the server side while keeping the ability to support HTTP keep-alive and pipelining on the client side. With Option "forceclose" HAProxy will actively close the outgoing server channel as soon as the server has finished to respond and release some resources earlier.]]> - true - frontend.customOptions diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index a4920acc2..5a465b296 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1,6 +1,6 @@ //OPNsense/HAProxy - 3.8.0 + 4.0.0 the HAProxy load balancer @@ -803,10 +803,8 @@ http-keep-alive http-keep-alive [default] - http-tunnel httpclose http-server-close - forceclose diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M4_0_0.php b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M4_0_0.php new file mode 100644 index 000000000..c13544da5 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Migrations/M4_0_0.php @@ -0,0 +1,50 @@ +getNodeByReference('frontends.frontend')->iterateItems() as $frontend) { + switch ((string)$frontend->connectionBehaviour) { + case 'http-tunnel': + $frontend->connectionBehaviour = 'http-keep-alive'; + break; + case 'forceclose': + $frontend->connectionBehaviour = 'http-keep-alive'; + break; + } + } + } +} From 9bd79cff45c36066bdbef4f039418ce4998da391 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 00:19:56 +0100 Subject: [PATCH 05/10] net/haproxy: add close-spread-time option, refs #3026 --- net/haproxy/pkg-descr | 3 +++ .../controllers/OPNsense/HAProxy/forms/generalSettings.xml | 6 ++++++ .../opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 5 +++++ .../service/templates/OPNsense/HAProxy/haproxy.conf | 3 +++ 4 files changed, 17 insertions(+) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 1675d938b..cee9c1c70 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -6,6 +6,9 @@ very high loads while needing persistence or Layer7 processing. Plugin Changelog ================ +Added: +* add new option "Gradual connection close time" (close-spread-time) (#3026) + Changed: * rename frontend option "Type" to "Connection Mode" (#3026) * update URLs to HAProxy 2.6 documentation (#3026) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml index aa3f791ff..b9934dd6a 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml @@ -21,6 +21,12 @@ text + + haproxy.general.closeSpreadTime + + text + + haproxy.general.seamlessReload diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 5a465b296..340264d97 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -18,6 +18,11 @@ Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". N + + /^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u + Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". + N + 0 Y diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 418a16c1e..c4799282f 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -973,6 +973,9 @@ global {% if OPNsense.HAProxy.general.hardStopAfter|default('') != '' %} hard-stop-after {{OPNsense.HAProxy.general.hardStopAfter}} {% endif %} +{% if OPNsense.HAProxy.general.closeSpreadTime|default('') != '' %} + close-spread-time {{OPNsense.HAProxy.general.closeSpreadTime}} +{% endif %} {# # Disable strict-limits because a syntax check will not reveal #} {# # whether kern.maxfilesperproc or kern.maxfiles are too low. #} no strict-limits From f16e410ad5f4052bad4189df6802719e2d2d4c87 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 00:26:59 +0100 Subject: [PATCH 06/10] net/haproxy: switch to HAProxy 2.6 package, refs #3026 --- net/haproxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 084dfc5a4..69d15276a 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,7 +1,7 @@ PLUGIN_NAME= haproxy PLUGIN_VERSION= 3.12 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer -PLUGIN_DEPENDS= haproxy24 +PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de .include "../../Mk/plugins.mk" From 26c4cce58126883be177b79ff05344213423c43e Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 00:40:15 +0100 Subject: [PATCH 07/10] net/haproxy: bump version to 4.0, refs #3026 --- net/haproxy/Makefile | 2 +- net/haproxy/pkg-descr | 4 +++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 69d15276a..e3dd19ba7 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 3.12 +PLUGIN_VERSION= 4.0 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index cee9c1c70..4da288475 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -6,12 +6,14 @@ very high loads while needing persistence or Layer7 processing. Plugin Changelog ================ +4.0 + Added: * add new option "Gradual connection close time" (close-spread-time) (#3026) Changed: +* upgrade to HAProxy 2.6 release series (#3026) * rename frontend option "Type" to "Connection Mode" (#3026) -* update URLs to HAProxy 2.6 documentation (#3026) * migrate options "http-tunnel" and "forceclose" to "http-keep-alive" (#3026) Removed: From 57f89c616114b581c57d3a72d0d1b0cdf0380def Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 00:48:12 +0100 Subject: [PATCH 08/10] net/haproxy: replace "process" with "threads" bind keyword, refs #3026 --- net/haproxy/pkg-descr | 3 ++- .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 4da288475..6ea53de08 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -15,11 +15,12 @@ Changed: * upgrade to HAProxy 2.6 release series (#3026) * rename frontend option "Type" to "Connection Mode" (#3026) * migrate options "http-tunnel" and "forceclose" to "http-keep-alive" (#3026) +* replace "process" with "threads" bind keyword for CPU Affinity (#3026) Removed: * remove Processes/nbproc option (use Threads/nbthread instead) (#3026) * remove "Process ID" from CPU Affinity settings (now always 1) (#3026) -* remove "bind-process" option (replaced by the "process" bind keyword) (#3026) +* remove "bind-process" option (replaced by the "threads" bind keyword) (#3026) * remove options "http-tunnel" and "forceclose" from "Connection Mode" (#3026) 3.12 diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index c4799282f..f465e6bf5 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1379,7 +1379,7 @@ frontend {{frontend.name}} {% set cpu_map_data = helpers.getUUID(cpu_map) %} {% if cpu_map_data.enabled == '1' %} {# # Restrict the list of threads on which this listener is allowed to run #} -{% do adv_options.append('process ' ~ '1/' ~ cpu_map_data.thread_id|replace('x', '')) %} +{% do adv_options.append('thread ' ~ cpu_map_data.thread_id|replace('x', '')) %} {% endif %} {% endfor %} {% endif %} From f9e325e88267305829b2ac96fcdef8dd6c5a318e Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 5 Jan 2023 01:12:39 +0100 Subject: [PATCH 09/10] net/haproxy: add new "shards" option, refs #3026 --- net/haproxy/pkg-descr | 3 ++- .../controllers/OPNsense/HAProxy/forms/dialogFrontend.xml | 7 +++++++ .../opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 6 ++++++ .../service/templates/OPNsense/HAProxy/haproxy.conf | 4 ++++ 4 files changed, 19 insertions(+), 1 deletion(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 6ea53de08..31a2faff2 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -9,7 +9,8 @@ Plugin Changelog 4.0 Added: -* add new option "Gradual connection close time" (close-spread-time) (#3026) +* add new service option "Gradual connection close time" (close-spread-time) (#3026) +* add new frontend option "shards" (#3026) Changed: * upgrade to HAProxy 2.6 release series (#3026) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml index 9d776f2ff..2a4c492a5 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml @@ -297,6 +297,13 @@ Choose CPU affinity rules. true + + frontend.tuning_shards + + text + + true + header diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 340264d97..baf4277b3 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -655,6 +655,12 @@ Y N + + 2 + 1000 + Please specify a value between 2 and 1000. + N + 0 Y diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index f465e6bf5..441e12ce2 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1383,6 +1383,10 @@ frontend {{frontend.name}} {% endif %} {% endfor %} {% endif %} +{# # shards / multiple listeners on the same IP:port #} +{% if frontend.tuning_shards|default('') != '' %} +{% do adv_options.append('shards ' ~ frontend.tuning_shards) %} +{% endif %} {# # bind/listen configuration #} {% if frontend.bind|default("") != "" %} {% for bind in frontend.bind.split(",") %} From 251c1261a94212737aac2171ef87ce8e2ce226d4 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 12 Jan 2023 21:22:51 +0100 Subject: [PATCH 10/10] net/haproxy: do not duplicate global defaults anymore, closes #2642 --- net/haproxy/pkg-descr | 1 + .../service/templates/OPNsense/HAProxy/haproxy.conf | 12 ++---------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 31a2faff2..4028a0650 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -17,6 +17,7 @@ Changed: * rename frontend option "Type" to "Connection Mode" (#3026) * migrate options "http-tunnel" and "forceclose" to "http-keep-alive" (#3026) * replace "process" with "threads" bind keyword for CPU Affinity (#3026) +* no longer duplicate global defaults in backends/frontends (#2642) Removed: * remove Processes/nbproc option (use Threads/nbthread instead) (#3026) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 441e12ce2..14442a686 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -1429,14 +1429,12 @@ frontend {{frontend.name}} {% if frontend.prometheus_enabled == '1' and frontend.mode == 'http' and frontend.prometheus_path|default("") != "" %} http-request use-service prometheus-exporter if { path {{frontend.prometheus_path}} } {% endif %} - # tuning options +{# # tuning options #} {% if frontend.tuning_maxConnections is defined %} maxconn {{frontend.tuning_maxConnections}} {% endif %} {% if frontend.tuning_timeoutClient is defined %} timeout client {{frontend.tuning_timeoutClient}} -{% elif OPNsense.HAProxy.general.defaults.timeoutClient is defined %} - timeout client {{OPNsense.HAProxy.general.defaults.timeoutClient}} {% endif %} {% if frontend.tuning_timeoutHttpReq|default("") != "" and frontend.mode == 'http' %} timeout http-request {{frontend.tuning_timeoutHttpReq}} @@ -1653,21 +1651,15 @@ backend {{backend.name}} {% endif %} {# # call macro to evaluate stickiness config #} {{ StickTableConfig(backend,true) }} - # tuning options +{# # tuning options #} {% if backend.tuning_timeoutConnect|default("") != "" %} timeout connect {{backend.tuning_timeoutConnect}} -{% elif OPNsense.HAProxy.general.defaults.timeoutConnect is defined %} - timeout connect {{OPNsense.HAProxy.general.defaults.timeoutConnect}} {% endif %} {% if backend.tuning_timeoutCheck|default("") != "" %} timeout check {{backend.tuning_timeoutCheck}} -{% elif OPNsense.HAProxy.general.defaults.timeoutCheck is defined %} - timeout check {{OPNsense.HAProxy.general.defaults.timeoutCheck}} {% endif %} {% if backend.tuning_timeoutServer|default("") != "" %} timeout server {{backend.tuning_timeoutServer}} -{% elif OPNsense.HAProxy.general.defaults.timeoutServer is defined %} - timeout server {{OPNsense.HAProxy.general.defaults.timeoutServer}} {% endif %} {% if backend.tuning_retries|default("") != "" %} retries {{backend.tuning_retries}}