mirror of
https://github.com/netbirdio/plugins.git
synced 2026-05-22 18:44:07 -07:00
Merge pull request #380 from fraenki/issue_375
net/haproxy: make SSL parameters configurable
This commit is contained in:
Frank Wall
@@ -69,6 +69,7 @@
|
||||
<field>
|
||||
<label>NOTE: The specified server must be present in the Backend Pool where this rule is applied.</label>
|
||||
<type>info</type>
|
||||
</field>
|
||||
<field>
|
||||
<label>Parameters</label>
|
||||
<type>header</type>
|
||||
|
||||
+45
-8
@@ -45,17 +45,17 @@
|
||||
<type>dropdown</type>
|
||||
<help><![CDATA[Set the default Backend Pool to use for this Public Service.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<label>SSL Offloading</label>
|
||||
<type>header</type>
|
||||
<style>mode_table table_http table_ssl</style>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_enabled</id>
|
||||
<label>Enabled</label>
|
||||
<label>Enable SSL offloading</label>
|
||||
<type>checkbox</type>
|
||||
<help>Enable SSL offloading</help>
|
||||
</field>
|
||||
<field>
|
||||
<label>SSL Offloading</label>
|
||||
<type>header</type>
|
||||
<style>mode_table table_http table_ssl table_ssl_true</style>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_certificates</id>
|
||||
<label>Certificates</label>
|
||||
@@ -74,11 +74,48 @@
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_customOptions</id>
|
||||
<label>Advanced SSL options</label>
|
||||
<label>SSL option pass-through</label>
|
||||
<type>text</type>
|
||||
<help><![CDATA[Specify additional SSL parameters such as force-sslv3, force-tlsv10, force-tlsv11, force-tlsv12, no-sslv3, no-tlsv10, no-tlsv11, no-tlsv12, no-tls-tickets or customize the list of SSL ciphers.<br/>Example: no-sslv3 ciphers HIGH:!DSS:!aNULL@STRENGTH<br/>]]></help>
|
||||
<help><![CDATA[Pass additional SSL parameters to the HAProxy configuration.]]></help>
|
||||
<advanced>true</advanced>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_advancedEnabled</id>
|
||||
<label>Enable Advanced settings</label>
|
||||
<type>checkbox</type>
|
||||
<help><![CDATA[Enable advanced SSL settings.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<label>Advanced SSL settings</label>
|
||||
<type>header</type>
|
||||
<style>mode_table table_http table_ssl table_ssl_advanced table_ssl_advanced_true</style>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_bindOptions</id>
|
||||
<label>Bind options</label>
|
||||
<type>select_multiple</type>
|
||||
<style>tokenize</style>
|
||||
<allownew>true</allownew>
|
||||
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_cipherList</id>
|
||||
<label>Cipher List</label>
|
||||
<type>text</type>
|
||||
<help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_hstsEnabled</id>
|
||||
<label>Enable HSTS</label>
|
||||
<type>checkbox</type>
|
||||
<help><![CDATA[Enable HTTP Strict Transport Security.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>frontend.ssl_hstsMaxAge</id>
|
||||
<label>HSTS max-age</label>
|
||||
<type>text</type>
|
||||
<help><![CDATA[Future requests to the domain should use only HTTPS for the specified time (in seconds): 15768000 = 6 months]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<label>Tuning Options</label>
|
||||
<type>header</type>
|
||||
|
||||
@@ -86,6 +86,30 @@
|
||||
<help><![CDATA[These lines will be added to the global settings of to the HAProxy configuration file.<br/><div class="text-info"><b>NOTE:</b> The syntax will not be checked, use at your own risk!</div>]]></help>
|
||||
<advanced>true</advanced>
|
||||
</field>
|
||||
<field>
|
||||
<label>SSL default settings</label>
|
||||
<type>header</type>
|
||||
</field>
|
||||
<field>
|
||||
<id>haproxy.general.tuning.ssl_defaultsEnabled</id>
|
||||
<label>Enabled</label>
|
||||
<type>checkbox</type>
|
||||
<help><![CDATA[Enable global SSL default values.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>haproxy.general.tuning.ssl_bindOptions</id>
|
||||
<label>Bind options</label>
|
||||
<type>select_multiple</type>
|
||||
<style>tokenize</style>
|
||||
<allownew>true</allownew>
|
||||
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
|
||||
</field>
|
||||
<field>
|
||||
<id>haproxy.general.tuning.ssl_cipherList</id>
|
||||
<label>Cipher List</label>
|
||||
<type>text</type>
|
||||
<help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
|
||||
</field>
|
||||
</subtab>
|
||||
<subtab id="haproxy-general-defaults" description="Default Parameters">
|
||||
<field>
|
||||
|
||||
@@ -79,6 +79,31 @@
|
||||
<customOptions type="TextField">
|
||||
<Required>N</Required>
|
||||
</customOptions>
|
||||
<ssl_defaultsEnabled type="BooleanField">
|
||||
<default>0</default>
|
||||
<Required>Y</Required>
|
||||
</ssl_defaultsEnabled>
|
||||
<ssl_bindOptions type="OptionField">
|
||||
<Required>N</Required>
|
||||
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
|
||||
<Multiple>Y</Multiple>
|
||||
<OptionValues>
|
||||
<no-sslv3>no-sslv3</no-sslv3>
|
||||
<no-tlsv10>no-tlsv10</no-tlsv10>
|
||||
<no-tlsv11>no-tlsv11</no-tlsv11>
|
||||
<no-tlsv12>no-tlsv12</no-tlsv12>
|
||||
<no-tls-tickets>no-tls-tickets</no-tls-tickets>
|
||||
<force-sslv3>force-sslv3</force-sslv3>
|
||||
<force-tlsv10>force-tlsv10</force-tlsv10>
|
||||
<force-tlsv11>force-tlsv11</force-tlsv11>
|
||||
<force-tlsv12>force-tlsv12</force-tlsv12>
|
||||
<strict-sni>strict-sni</strict-sni>
|
||||
</OptionValues>
|
||||
</ssl_bindOptions>
|
||||
<ssl_cipherList type="TextField">
|
||||
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
|
||||
<Required>N</Required>
|
||||
</ssl_cipherList>
|
||||
</tuning>
|
||||
<defaults>
|
||||
<maxConnections type="IntegerField">
|
||||
@@ -298,6 +323,42 @@
|
||||
<ssl_customOptions type="TextField">
|
||||
<Required>N</Required>
|
||||
</ssl_customOptions>
|
||||
<ssl_advancedEnabled type="BooleanField">
|
||||
<default>0</default>
|
||||
<Required>Y</Required>
|
||||
</ssl_advancedEnabled>
|
||||
<ssl_bindOptions type="OptionField">
|
||||
<Required>N</Required>
|
||||
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
|
||||
<Multiple>Y</Multiple>
|
||||
<OptionValues>
|
||||
<no-sslv3>no-sslv3</no-sslv3>
|
||||
<no-tlsv10>no-tlsv10</no-tlsv10>
|
||||
<no-tlsv11>no-tlsv11</no-tlsv11>
|
||||
<no-tlsv12>no-tlsv12</no-tlsv12>
|
||||
<no-tls-tickets>no-tls-tickets</no-tls-tickets>
|
||||
<force-sslv3>force-sslv3</force-sslv3>
|
||||
<force-tlsv10>force-tlsv10</force-tlsv10>
|
||||
<force-tlsv11>force-tlsv11</force-tlsv11>
|
||||
<force-tlsv12>force-tlsv12</force-tlsv12>
|
||||
<strict-sni>strict-sni</strict-sni>
|
||||
</OptionValues>
|
||||
</ssl_bindOptions>
|
||||
<ssl_cipherList type="TextField">
|
||||
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
|
||||
<Required>N</Required>
|
||||
</ssl_cipherList>
|
||||
<ssl_hstsEnabled type="BooleanField">
|
||||
<default>1</default>
|
||||
<Required>Y</Required>
|
||||
</ssl_hstsEnabled>
|
||||
<ssl_hstsMaxAge type="IntegerField">
|
||||
<default>15768000</default>
|
||||
<MinimumValue>1</MinimumValue>
|
||||
<MaximumValue>1000000000</MaximumValue>
|
||||
<ValidationMessage>Please specify a value between 1 and 1000000000.</ValidationMessage>
|
||||
<Required>Y</Required>
|
||||
</ssl_hstsMaxAge>
|
||||
<tuning_maxConnections type="IntegerField">
|
||||
<MinimumValue>1</MinimumValue>
|
||||
<MaximumValue>500000</MaximumValue>
|
||||
|
||||
@@ -186,6 +186,22 @@ POSSIBILITY OF SUCH DAMAGE.
|
||||
$("."+service_id).show();
|
||||
});
|
||||
$("#frontend\\.mode").change();
|
||||
|
||||
// show/hide SSL offloading
|
||||
$("#frontend\\.ssl_enabled").change(function(){
|
||||
var service_id = 'table_ssl_' + $(this).is(':checked');
|
||||
$(".table_ssl").hide();
|
||||
$("."+service_id).show();
|
||||
});
|
||||
$("#frontend\\.ssl_enabled").change();
|
||||
|
||||
// show/hide advanced SSL settings
|
||||
$("#frontend\\.ssl_advancedEnabled").change(function(){
|
||||
var service_id = 'table_ssl_advanced_' + $(this).is(':checked');
|
||||
$(".table_ssl_advanced").hide();
|
||||
$("."+service_id).show();
|
||||
});
|
||||
$("#frontend\\.ssl_advancedEnabled").change();
|
||||
})
|
||||
|
||||
// hook into on-show event for dialog to extend layout.
|
||||
|
||||
@@ -518,6 +518,20 @@ global
|
||||
{% endif %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{# # ssl default settings #}
|
||||
{% if OPNsense.HAProxy.general.tuning.ssl_defaultsEnabled|default("") == '1' %}
|
||||
{% if OPNsense.HAProxy.general.tuning.ssl_bindOptions|default("") != "" %}
|
||||
{% set bindopts = [] %}
|
||||
{% for bindopt in OPNsense.HAProxy.general.tuning.ssl_bindOptions.split(",") %}
|
||||
{% do bindopts.append(bindopt) %}
|
||||
{% endfor %}
|
||||
ssl-default-bind-options {{ bindopts|join(' ') }}
|
||||
{% endif %}
|
||||
{% if OPNsense.HAProxy.general.tuning.ssl_cipherList|default("") != "" %}
|
||||
ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{# # pass-through options #}
|
||||
{% if OPNsense.HAProxy.general.tuning.customOptions|default("") != "" %}
|
||||
# WARNING: pass through options below this line
|
||||
{% for customOpt in OPNsense.HAProxy.general.tuning.customOptions.split("\n") %}
|
||||
@@ -571,22 +585,37 @@ defaults
|
||||
# Frontend: {{frontend.name}} ({{frontend.description}})
|
||||
frontend {{frontend.name}}
|
||||
{% set ssl_certs = [] %}
|
||||
{% set ssl_options = [] %}
|
||||
{% if frontend.ssl_enabled == '1' %}
|
||||
{# # check if ssl certs are configured #}
|
||||
{% if frontend.ssl_certificates|default("") != "" %}
|
||||
{# # NOTE: Cert lists are generated by exportCerts.php #}
|
||||
{% do ssl_certs.append('crt-list /var/etc/haproxy/ssl/' ~ frontend.id ~ '.crtlist') %}
|
||||
{% endif %}
|
||||
{# # advanced ssl options #}
|
||||
{# # advanced ssl parameters (pass-through) #}
|
||||
{% if frontend.ssl_customOptions|default("") != "" %}
|
||||
{# # add a space to separate it from other ssl params #}
|
||||
{% set ssl_options = frontend.ssl_customOptions ~ ' ' %}
|
||||
{% do ssl_options.append(frontend.ssl_customOptions ~ ' ') %}
|
||||
{% endif %}
|
||||
{# # advanced ssl settings #}
|
||||
{% if frontend.ssl_advancedEnabled|default("") == '1' %}
|
||||
{% if frontend.ssl_bindOptions|default("") != "" %}
|
||||
{% for bindopt in frontend.ssl_bindOptions.split(",") %}
|
||||
{% do ssl_options.append(bindopt) %}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
{% if frontend.ssl_cipherList|default("") != "" %}
|
||||
{% do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{# # HSTS #}
|
||||
{% if frontend.ssl_hstsEnabled|default("") == '1' %}
|
||||
http-response set-header Strict-Transport-Security max-age={{frontend.ssl_hstsMaxAge}}
|
||||
{% endif %}
|
||||
{% endif %}
|
||||
{# # bind/listen configuration #}
|
||||
{% if frontend.bind|default("") != "" %}
|
||||
{% for bind in frontend.bind.split(",") %}
|
||||
bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options }}{{ssl_certs|join(' ')}} {% endif %}
|
||||
bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options|join(' ') }} {{ ssl_certs|join(' ') }} {% endif %}
|
||||
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
Reference in New Issue
Block a user