From 095740ab393f6e572c359fbedef17d76c3c82cd7 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Mon, 29 Mar 2021 00:01:10 +0200 Subject: [PATCH 1/3] net/haproxy: ignore incompatible options when LibreSSL is used, refs #2013 --- net/haproxy/pkg-descr | 5 +++++ .../service/templates/OPNsense/HAProxy/haproxy.conf | 10 +++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 69ef2148a..2dbcc504d 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -6,6 +6,11 @@ very high loads while needing persistence or Layer7 processing. Plugin Changelog ================ +3.2 + +Changed: +* ignore incompatible ciphersuites options when LibreSSL is used (#2013) + 3.1 Fixed: diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index a530b0a7a..d9923f799 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -926,7 +926,11 @@ global ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }} {% endif %} {% if OPNsense.HAProxy.general.tuning.ssl_cipherSuites|default("") != "" %} +{% if helpers.exists('system.firmware.flavour') and not(helpers.empty('system.firmware.flavour')) and system.firmware.flavour|default('') == 'libressl' %} + # WARNING: ssl-default-bind-ciphersuites cannot be used with flavour {{ system.firmware.flavour}}. +{% else %} ssl-default-bind-ciphersuites {{ OPNsense.HAProxy.general.tuning.ssl_cipherSuites }} +{% endif %} {% endif %} {% endif %} {# # pass-through options #} @@ -1162,7 +1166,11 @@ frontend {{frontend.name}} {% do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %} {% endif %} {% if frontend.ssl_cipherSuites|default("") != "" %} -{% do ssl_options.append('ciphersuites ' ~ frontend.ssl_cipherSuites) %} +{% if helpers.exists('system.firmware.flavour') and not(helpers.empty('system.firmware.flavour')) and system.firmware.flavour|default('') == 'libressl' %} + # WARNING: ciphersuites cannot be used with flavour {{ system.firmware.flavour}}. +{% else %} +{% do ssl_options.append('ciphersuites ' ~ frontend.ssl_cipherSuites) %} +{% endif %} {% endif %} {# # HSTS #} {% if frontend.ssl_hstsEnabled|default("") == '1' and frontend.mode == 'http' %} From bd3811438708311dd5966a5733589879dab9c622 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Mon, 29 Mar 2021 00:04:12 +0200 Subject: [PATCH 2/3] net/haproxy: bump version --- net/haproxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index c2f195fc2..381ec9f77 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 3.1 +PLUGIN_VERSION= 3.2 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de From b41246811d7bb2b2532deeb3a901798e953f8013 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 14 Apr 2021 23:37:45 +0200 Subject: [PATCH 3/3] net/haproxy: fix config test when service is not enabled --- net/haproxy/pkg-descr | 3 +++ .../opnsense/service/templates/OPNsense/HAProxy/haproxy.conf | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 2dbcc504d..685819d34 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -8,6 +8,9 @@ Plugin Changelog 3.2 +Fixed: +* fix config test when HAProxy service is not enabled + Changed: * ignore incompatible ciphersuites options when LibreSSL is used (#2013) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index d9923f799..5cd9e0722 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -829,7 +829,7 @@ userlist {{object.name | regex_replace ("[^A-Za-z0-9]","")}} # # NOTE: HAProxy is currently DISABLED # -{%- endif -%} +{% endif %} {#- ############################### -#} {#- GLOBAL -#}