From a01fd048ae6d5db323473d9fd8c574da18c45388 Mon Sep 17 00:00:00 2001
From: Monviech <79600909+Monviech@users.noreply.github.com>
Date: Wed, 3 Jul 2024 14:24:31 +0200
Subject: [PATCH] www/caddy: Add HTTP version selection. Mark NTLM as
 deprecated. Theoretically, it only hard codes the transport http to versions
 1.1. So, NTLM could be replaced by setting the http version to that value. At
 the same time, this also adds support for HTTP/3 to the upstream, which is
 included in the latest Caddy version 2.8.4 we have rolled out. (#4071)

---
 .../controllers/OPNsense/Caddy/forms/dialogHandle.xml    | 9 ++++++++-
 .../src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml | 8 ++++++++
 .../mvc/app/views/OPNsense/Caddy/reverse_proxy.volt      | 1 +
 .../opnsense/service/templates/OPNsense/Caddy/Caddyfile  | 8 +++++++-
 4 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
index cbd484ae8..e8013cd00 100644
--- a/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
+++ b/www/caddy/src/opnsense/mvc/app/controllers/OPNsense/Caddy/forms/dialogHandle.xml
@@ -109,11 +109,18 @@
         <type>checkbox</type>
         <help><![CDATA[Enable or disable HTTP over TLS (HTTPS) to communicate with the upstream destination. Caddy uses HTTP with the upstream destination by default.]]></help>
     </field>
+    <field>
+        <id>handle.HttpVersion</id>
+        <label>HTTP Version</label>
+        <type>dropdown</type>
+        <help><![CDATA[The default versions are highly recommended. Choose a HTTP version for the upstream destination. HTTP/3 (HTTP over QUIC) requires TLS, and only establishes connections to webservers that also support HTTP/3.]]></help>
+    </field>
     <field>
         <id>handle.HttpNtlm</id>
         <label>NTLM</label>
         <type>checkbox</type>
-        <help><![CDATA[Enable or disable NTLM. Needed to reverse proxy an Exchange Server.]]></help>
+        <help><![CDATA[Enable or disable NTLM. Needed to reverse proxy an Exchange Server. Warning: NTLM has been deprecated by Microsoft. This option will be removed in the future when support for NTLM phases out.]]></help>
+        <advanced>true</advanced>
     </field>
     <field>
         <id>handle.HttpTlsInsecureSkipVerify</id>
diff --git a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
index db4388ee4..b44276dc2 100644
--- a/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
+++ b/www/caddy/src/opnsense/mvc/app/models/OPNsense/Caddy/Caddy.xml
@@ -327,6 +327,14 @@
                         </check001>
                     </Constraints>
                 </HttpTls>
+                <HttpVersion type="OptionField">
+                    <BlankDesc>HTTP/1.1, HTTP/2</BlankDesc>
+                    <OptionValues>
+                        <http1>HTTP/1.1</http1>
+                        <http2>HTTP/2</http2>
+                        <http3>HTTP/3</http3>
+                    </OptionValues>
+                </HttpVersion>
                 <HttpNtlm type="BooleanField">
                     <Constraints>
                         <check001>
diff --git a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
index e3b559237..41622bac3 100644
--- a/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
+++ b/www/caddy/src/opnsense/mvc/app/views/OPNsense/Caddy/reverse_proxy.volt
@@ -336,6 +336,7 @@
                             <th data-column-id="PassiveHealthFailDuration" data-type="string" data-visible="false">{{ lang._('Fail Duration') }}</th>
                             <th data-column-id="ForwardAuth" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('Forward Auth') }}</th>
                             <th data-column-id="HttpTls" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('TLS') }}</th>
+                            <th data-column-id="HttpVersion" data-type="string" data-visible="false">{{ lang._('HTTP Version') }}</th>
                             <th data-column-id="HttpTlsTrustedCaCerts" data-type="string" data-visible="false">{{ lang._('TLS CA') }}</th>
                             <th data-column-id="HttpTlsServerName" data-type="string" data-visible="false">{{ lang._('TLS Server Name') }}</th>
                             <th data-column-id="HttpNtlm" data-type="boolean" data-formatter="boolean" data-visible="false">{{ lang._('NTLM') }}</th>
diff --git a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
index 795ba8f62..592f552d5 100644
--- a/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
+++ b/www/caddy/src/opnsense/service/templates/OPNsense/Caddy/Caddyfile
@@ -354,6 +354,7 @@
 #       - HttpTlsTrustedCaCerts (string, optional): The config extracted name of a CA certificate.
 #       - HttpTlsServerName (string, optional): Specifies the server name for the TLS handshake.
 #       - PassiveHealthFailDuration (integer, optional): Enables passive health checks when set > 0.
+#       - HttpVersion (string, optional): Choose HTTP version. Empty (default) is 1.1 and 2.
 #}
 {% macro reverse_proxy_configuration(handle) %}
     {{ handle.HandleType }} {{ handle.HandlePath|default("") }} {
@@ -373,7 +374,7 @@
             {% if handle.PassiveHealthFailDuration|default("") %}
             fail_duration {{ handle.PassiveHealthFailDuration }}s
             {% endif %}
-            {% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" or handle.HttpTlsTrustedCaCerts|default("") != "" or handle.HttpTlsServerName|default("") != "" %}
+            {% if handle.HttpTls|default("0") == "1" or handle.HttpTlsInsecureSkipVerify|default("0") == "1" or handle.HttpTlsTrustedCaCerts or handle.HttpTlsServerName or handle.HttpVersion %}
                 {% if handle.HttpNtlm|default("0") == "1" %}
                 transport http_ntlm {
                     {% if handle.HttpTls|default("0") == "1" %}
@@ -391,6 +392,11 @@
                 }
                 {% else %}
                 transport http {
+                    {# The model does not allow to set a single number as option directly, so we have to map them. #}
+                    {% set version_map = {'http1': 1.1, 'http2': 2, 'http3': 3} %}
+                    {% if handle.HttpVersion %}
+                        versions {{ version_map[handle.HttpVersion] }}
+                    {% endif %}
                     {% if handle.HttpTls|default("0") == "1" %}
                     tls
                     {% endif %}