From 9c6261c37c81872a994b4880aefa6f7402a02f4e Mon Sep 17 00:00:00 2001 From: Monviech <79600909+Monviech@users.noreply.github.com> Date: Wed, 10 Jul 2024 09:34:21 +0200 Subject: [PATCH] www/caddy: Add option to disable TLS in domain (#4077) * www/caddy: Add option to disable TLS for a domain. Add new validation to ensure conflicting TLS options can not be selected. * www/caddy: Add changelog. * www/caddy: Invert the logic, make TLS activation a checkbox that is enabled by default. Standard migration will take care of this. This makes the TLS checkbox in domains behave the same as in handlers, improving consistency. * www/caddy: Change logic again, going back to the original plan to use DisableTls for a domain. This way, the default can be empty. * www/caddy: Only validate if field DisableTLS has changed. * www/caddy: Remove sprintf since it does nothing here. --- www/caddy/pkg-descr | 1 + .../Caddy/forms/dialogReverseProxy.xml | 6 ++++ .../mvc/app/models/OPNsense/Caddy/Caddy.php | 31 +++++++++++++++++++ .../mvc/app/models/OPNsense/Caddy/Caddy.xml | 1 + .../views/OPNsense/Caddy/reverse_proxy.volt | 1 + .../templates/OPNsense/Caddy/Caddyfile | 3 +- 6 files changed, 42 insertions(+), 1 deletion(-) diff --git a/www/caddy/pkg-descr b/www/caddy/pkg-descr index 9a3d7175c..7aa3e1d4a 100644 --- a/www/caddy/pkg-descr +++ b/www/caddy/pkg-descr @@ -34,6 +34,7 @@ Plugin Changelog * Add: Introduce HTTP version to handler. HTTP/1.1, HTTP/2 and HTTP/3 can be chosen. * Add: HTTP Keepalive can be set in a handler. * Change: Option "tls_trusted_ca_certs" is now "tls_trust_pool". +* Add: TLS can be deactivated in a domain. 1.5.7 diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml index 9b43eb076..bd9f481ea 100644 --- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml +++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogReverseProxy.xml @@ -42,6 +42,12 @@ true + + reverse.DisableTls + + checkbox + + reverse.DnsChallenge diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php index f66497fdd..9f76fe20e 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.php @@ -160,6 +160,35 @@ class Caddy extends BaseModel } } + // 5. Prevent the usage of conflicting options when TLS is deactivated for a Domain + private function checkDisableTlsConflicts($messages) + { + foreach ($this->reverseproxy->reverse->iterateItems() as $item) { + // First check if the DisableTls field has been changed + if ($item->isFieldChanged('DisableTls')) { + if ((string) $item->DisableTls === '1') { + $conflictChecks = [ + 'DnsChallenge' => (string) $item->DnsChallenge === '1', + 'AcmePassthrough' => !empty((string) $item->AcmePassthrough), + 'CustomCertificate' => !empty((string) $item->CustomCertificate) + ]; + + $conflictFields = array_keys(array_filter($conflictChecks)); + + if (!empty($conflictFields)) { + $messages->appendMessage(new Message( + gettext( + 'TLS cannot be disabled if one of the following options are used: ' . + '"DNS-01 Challenge", "HTTP-01 Challenge Redirection" and "Custom Certificate"' + ), + $item->__reference . ".DisableTls" + )); + } + } + } + } + } + // Perform the actual validation public function performValidation($validateFullModel = false) { @@ -172,6 +201,8 @@ class Caddy extends BaseModel $this->checkWebGuiSettings($messages); // 4. Check for ACME Email requirement $this->checkAcmeEmailAutoHttps($messages); + // 5. Check for TLS conflicts in Domain + $this->checkDisableTlsConflicts($messages); return $messages; } diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml index e00c0efb6..2650cb267 100644 --- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml +++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml @@ -193,6 +193,7 @@ Please enter a valid 'to' domain or IP address. Y + diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt index 9da4e4596..fb9bc191f 100644 --- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt +++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt @@ -262,6 +262,7 @@ {{ lang._('HTTP Access Log') }} {{ lang._('Custom Certificate') }} {{ lang._('HTTP-01 redirection') }} + {{ lang._('Disable TLS') }} {{ lang._('Description') }} {{ lang._('Commands') }} diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile index 3dac6c0ab..eb4ce0ad8 100644 --- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile +++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile @@ -484,7 +484,8 @@ {% for reverse in helpers.toList('Pischem.caddy.reverseproxy.reverse') %} {% if reverse.enabled|default("0") == "1" %} # Reverse Proxy Domain: "{{ reverse['@uuid'] }}" -{{ reverse.FromDomain|default("") }}{% if reverse.FromPort %}:{{ reverse.FromPort }}{% endif %} { +{# The default are encrypted connections, uncencrypted connections have to render http:// #} +{% if reverse.DisableTls|default("0") == "1" %}http://{% endif %}{{ reverse.FromDomain|default("") }}{% if reverse.FromPort %}:{{ reverse.FromPort }}{% endif %} { {% if reverse.AccessLog|default("0") == "1" %} {% if generalSettings.LogAccessPlain|default("0") == "0" %} log {{ reverse['@uuid'] }}