From 29f56908dd826d884f37e7eea8ba537ac57ff433 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 18 Nov 2017 00:15:11 +0100
Subject: [PATCH 1/4] net/haproxy: make SSL params configurable, closes #375

---
 .../OPNsense/HAProxy/forms/dialogFrontend.xml | 41 +++++++++++++++----
 .../app/models/OPNsense/HAProxy/HAProxy.xml   | 25 +++++++++++
 .../mvc/app/views/OPNsense/HAProxy/index.volt | 16 ++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf   | 19 +++++++--
 4 files changed, 89 insertions(+), 12 deletions(-)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
index 2ed5d20a4..e9a1b33b5 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
@@ -45,17 +45,17 @@
         <type>dropdown</type>
         <help><![CDATA[Set the default Backend Pool to use for this Public Service.]]></help>
     </field>
-    <field>
-        <label>SSL Offloading</label>
-        <type>header</type>
-        <style>mode_table table_http table_ssl</style>
-    </field>
     <field>
         <id>frontend.ssl_enabled</id>
-        <label>Enabled</label>
+        <label>Enable SSL offloading</label>
         <type>checkbox</type>
         <help>Enable SSL offloading</help>
     </field>
+    <field>
+        <label>SSL Offloading</label>
+        <type>header</type>
+        <style>mode_table table_http table_ssl table_ssl_true</style>
+    </field>
     <field>
         <id>frontend.ssl_certificates</id>
         <label>Certificates</label>
@@ -74,11 +74,36 @@
     </field>
     <field>
         <id>frontend.ssl_customOptions</id>
-        <label>Advanced SSL options</label>
+        <label>SSL option pass-through</label>
         <type>text</type>
-        <help><![CDATA[Specify additional SSL parameters such as force-sslv3, force-tlsv10, force-tlsv11, force-tlsv12, no-sslv3, no-tlsv10, no-tlsv11, no-tlsv12, no-tls-tickets or customize the list of SSL ciphers.<br/>Example: no-sslv3 ciphers HIGH:!DSS:!aNULL@STRENGTH<br/>]]></help>
+        <help><![CDATA[Pass additional SSL parameters to the HAProxy configuration.]]></help>
         <advanced>true</advanced>
     </field>
+    <field>
+        <id>frontend.ssl_advancedEnabled</id>
+        <label>Enable Advanced settings</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable advanced SSL settings.]]></help>
+    </field>
+    <field>
+        <label>Advanced SSL settings</label>
+        <type>header</type>
+        <style>mode_table table_http table_ssl table_ssl_advanced table_ssl_advanced_true</style>
+    </field>
+    <field>
+        <id>frontend.ssl_bindOptions</id>
+        <label>Bind options</label>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
+        <help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
+    </field>
+    <field>
+        <id>frontend.ssl_cipherList</id>
+        <label>Cipher List</label>
+        <type>text</type>
+        <help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
+    </field>
     <field>
         <label>Tuning Options</label>
         <type>header</type>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 5829d0c53..045076ccd 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -298,6 +298,31 @@
                 <ssl_customOptions type="TextField">
                     <Required>N</Required>
                 </ssl_customOptions>
+                <ssl_advancedEnabled type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </ssl_advancedEnabled>
+                <ssl_bindOptions type="OptionField">
+                    <Required>N</Required>
+                    <default>no-sslv3,no-tlsv10,no-tls-tickets</default>
+                    <Multiple>Y</Multiple>
+                    <OptionValues>
+                        <no-sslv3>no-sslv3</no-sslv3>
+                        <no-tlsv10>no-tlsv10</no-tlsv10>
+                        <no-tlsv11>no-tlsv11</no-tlsv11>
+                        <no-tlsv12>no-tlsv12</no-tlsv12>
+                        <no-tls-tickets>no-tls-tickets</no-tls-tickets>
+                        <force-sslv3>force-sslv3</force-sslv3>
+                        <force-tlsv10>force-tlsv10</force-tlsv10>
+                        <force-tlsv11>force-tlsv11</force-tlsv11>
+                        <force-tlsv12>force-tlsv12</force-tlsv12>
+                        <strict-sni>strict-sni</strict-sni>
+                    </OptionValues>
+                </ssl_bindOptions>
+                <ssl_cipherList type="TextField">
+                    <default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
+                    <Required>N</Required>
+                </ssl_cipherList>
                 <tuning_maxConnections type="IntegerField">
                     <MinimumValue>1</MinimumValue>
                     <MaximumValue>500000</MaximumValue>
diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt
index 031b8f8c5..9750fc363 100644
--- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt
+++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt
@@ -186,6 +186,22 @@ POSSIBILITY OF SUCH DAMAGE.
                 $("."+service_id).show();
             });
             $("#frontend\\.mode").change();
+
+            // show/hide SSL offloading
+            $("#frontend\\.ssl_enabled").change(function(){
+                var service_id = 'table_ssl_' + $(this).is(':checked');
+                $(".table_ssl").hide();
+                $("."+service_id).show();
+            });
+            $("#frontend\\.ssl_enabled").change();
+
+            // show/hide advanced SSL settings
+            $("#frontend\\.ssl_advancedEnabled").change(function(){
+                var service_id = 'table_ssl_advanced_' + $(this).is(':checked');
+                $(".table_ssl_advanced").hide();
+                $("."+service_id).show();
+            });
+            $("#frontend\\.ssl_advancedEnabled").change();
         })
 
         // hook into on-show event for dialog to extend layout.
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index ad6ce9700..1d3f84f6f 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -571,22 +571,33 @@ defaults
 # Frontend: {{frontend.name}} ({{frontend.description}})
 frontend {{frontend.name}}
 {%       set ssl_certs = [] %}
+{%       set ssl_options = [] %}
 {%       if frontend.ssl_enabled == '1' %}
 {#         # check if ssl certs are configured #}
 {%         if frontend.ssl_certificates|default("") != "" %}
 {#           # NOTE: Cert lists are generated by exportCerts.php #}
 {%           do ssl_certs.append('crt-list /var/etc/haproxy/ssl/' ~ frontend.id ~ '.crtlist') %}
 {%         endif %}
-{#         # advanced ssl options #}
+{#         # advanced ssl parameters (pass-through) #}
 {%         if frontend.ssl_customOptions|default("") != "" %}
-{#           # add a space to separate it from other ssl params #}
-{%           set ssl_options = frontend.ssl_customOptions ~ ' ' %}
+{%           do ssl_options.append(frontend.ssl_customOptions ~ ' ') %}
+{%         endif %}
+{#         # advanced ssl settings #}
+{%         if frontend.ssl_advancedEnabled|default("") == '1' %}
+{%           if frontend.ssl_bindOptions|default("") != "" %}
+{%             for bindopt in frontend.ssl_bindOptions.split(",") %}
+{%               do ssl_options.append(bindopt) %}
+{%             endfor %}
+{%           endif %}
+{%           if frontend.ssl_cipherList|default("") != "" %}
+{%             do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
+{%           endif %}
 {%         endif %}
 {%       endif %}
 {#       # bind/listen configuration #}
 {%       if frontend.bind|default("") != "" %}
 {%         for bind in frontend.bind.split(",") %}
-    bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options }}{{ssl_certs|join(' ')}} {% endif %}
+    bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options|join(' ') }} {{ ssl_certs|join(' ') }} {% endif %}
 
 {%         endfor %}
 {%       endif %}

From d231f77062bb2cdf2bb06c90620dff479824d980 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 18 Nov 2017 00:15:55 +0100
Subject: [PATCH 2/4] net/haproxy: fix syntax error

---
 .../mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml
index 8935c7e6a..5df745d0d 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml
@@ -69,6 +69,7 @@
     <field>
         <label>NOTE: The specified server must be present in the Backend Pool where this rule is applied.</label>
         <type>info</type>
+    </field>
     <field>
         <label>Parameters</label>
         <type>header</type>

From f7afbc30b753c9ace466709f484c95e47ab2c67c Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 18 Nov 2017 00:51:25 +0100
Subject: [PATCH 3/4] net/haproxy: add global SSL default values, refs #375

---
 .../OPNsense/HAProxy/forms/main.xml           | 24 ++++++++++++++++++
 .../app/models/OPNsense/HAProxy/HAProxy.xml   | 25 +++++++++++++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf   | 14 +++++++++++
 3 files changed, 63 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
index bfe9c6e35..3a48bfaeb 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
@@ -86,6 +86,30 @@
                 <help><![CDATA[These lines will be added to the global settings of to the HAProxy configuration file.<br/><div class="text-info"><b>NOTE:</b> The syntax will not be checked, use at your own risk!</div>]]></help>
                 <advanced>true</advanced>
             </field>
+            <field>
+                <label>SSL default settings</label>
+                <type>header</type>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_defaultsEnabled</id>
+                <label>Enabled</label>
+                <type>checkbox</type>
+                <help><![CDATA[Enable global SSL default values.]]></help>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_bindOptions</id>
+                <label>Bind options</label>
+                <type>select_multiple</type>
+                <style>tokenize</style>
+                <allownew>true</allownew>
+                <help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_cipherList</id>
+                <label>Cipher List</label>
+                <type>text</type>
+                <help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
+            </field>
         </subtab>
         <subtab id="haproxy-general-defaults" description="Default Parameters">
             <field>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 045076ccd..ae6724884 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -79,6 +79,31 @@
                 <customOptions type="TextField">
                     <Required>N</Required>
                 </customOptions>
+                <ssl_defaultsEnabled type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </ssl_defaultsEnabled>
+                <ssl_bindOptions type="OptionField">
+                    <Required>N</Required>
+                    <default>no-sslv3,no-tlsv10,no-tls-tickets</default>
+                    <Multiple>Y</Multiple>
+                    <OptionValues>
+                        <no-sslv3>no-sslv3</no-sslv3>
+                        <no-tlsv10>no-tlsv10</no-tlsv10>
+                        <no-tlsv11>no-tlsv11</no-tlsv11>
+                        <no-tlsv12>no-tlsv12</no-tlsv12>
+                        <no-tls-tickets>no-tls-tickets</no-tls-tickets>
+                        <force-sslv3>force-sslv3</force-sslv3>
+                        <force-tlsv10>force-tlsv10</force-tlsv10>
+                        <force-tlsv11>force-tlsv11</force-tlsv11>
+                        <force-tlsv12>force-tlsv12</force-tlsv12>
+                        <strict-sni>strict-sni</strict-sni>
+                    </OptionValues>
+                </ssl_bindOptions>
+                <ssl_cipherList type="TextField">
+                    <default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
+                    <Required>N</Required>
+                </ssl_cipherList>
             </tuning>
             <defaults>
                 <maxConnections type="IntegerField">
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 1d3f84f6f..d0aeb2f27 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -518,6 +518,20 @@ global
 {%     endif %}
 {%   endfor %}
 {% endif %}
+{# # ssl default settings #}
+{% if OPNsense.HAProxy.general.tuning.ssl_defaultsEnabled|default("") == '1' %}
+{%   if OPNsense.HAProxy.general.tuning.ssl_bindOptions|default("") != "" %}
+{%     set bindopts = [] %}
+{%     for bindopt in OPNsense.HAProxy.general.tuning.ssl_bindOptions.split(",") %}
+{%       do bindopts.append(bindopt) %}
+{%     endfor %}
+    ssl-default-bind-options {{ bindopts|join(' ') }}
+{%   endif %}
+{%   if OPNsense.HAProxy.general.tuning.ssl_cipherList|default("") != "" %}
+    ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }}
+{%   endif %}
+{% endif %}
+{# # pass-through options #}
 {% if OPNsense.HAProxy.general.tuning.customOptions|default("") != "" %}
     # WARNING: pass through options below this line
 {%   for customOpt in OPNsense.HAProxy.general.tuning.customOptions.split("\n") %}

From 80613eea0ed7295f38d03f80afaf8eb35b5ba9e5 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 18 Nov 2017 01:09:38 +0100
Subject: [PATCH 4/4] net/haproxy: support HSTS, refs #375

---
 .../OPNsense/HAProxy/forms/dialogFrontend.xml        | 12 ++++++++++++
 .../mvc/app/models/OPNsense/HAProxy/HAProxy.xml      | 11 +++++++++++
 .../service/templates/OPNsense/HAProxy/haproxy.conf  |  4 ++++
 3 files changed, 27 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
index e9a1b33b5..3b1e3449a 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
@@ -104,6 +104,18 @@
         <type>text</type>
         <help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
     </field>
+    <field>
+        <id>frontend.ssl_hstsEnabled</id>
+        <label>Enable HSTS</label>
+        <type>checkbox</type>
+        <help><![CDATA[Enable HTTP Strict Transport Security.]]></help>
+    </field>
+    <field>
+        <id>frontend.ssl_hstsMaxAge</id>
+        <label>HSTS max-age</label>
+        <type>text</type>
+        <help><![CDATA[Future requests to the domain should use only HTTPS for the specified time (in seconds): 15768000 = 6 months]]></help>
+    </field>
     <field>
         <label>Tuning Options</label>
         <type>header</type>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index ae6724884..af366cdcb 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -348,6 +348,17 @@
                     <default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
                     <Required>N</Required>
                 </ssl_cipherList>
+                <ssl_hstsEnabled type="BooleanField">
+                    <default>1</default>
+                    <Required>Y</Required>
+                </ssl_hstsEnabled>
+                <ssl_hstsMaxAge type="IntegerField">
+                    <default>15768000</default>
+                    <MinimumValue>1</MinimumValue>
+                    <MaximumValue>1000000000</MaximumValue>
+                    <ValidationMessage>Please specify a value between 1 and 1000000000.</ValidationMessage>
+                    <Required>Y</Required>
+                </ssl_hstsMaxAge>
                 <tuning_maxConnections type="IntegerField">
                     <MinimumValue>1</MinimumValue>
                     <MaximumValue>500000</MaximumValue>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index d0aeb2f27..b6b70b8b0 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -607,6 +607,10 @@ frontend {{frontend.name}}
 {%             do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
 {%           endif %}
 {%         endif %}
+{#         # HSTS #}
+{%         if frontend.ssl_hstsEnabled|default("") == '1' %}
+    http-response set-header Strict-Transport-Security max-age={{frontend.ssl_hstsMaxAge}}
+{%         endif %}
 {%       endif %}
 {#       # bind/listen configuration #}
 {%       if frontend.bind|default("") != "" %}