From 8ad4b85c8384e8e66050dcc45a25bf8aef45061a Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 20 Apr 2016 12:52:06 +0200 Subject: [PATCH 1/6] net/haproxy: add basic logging capabilities --- .../OPNsense/HAProxy/forms/main.xml | 6 ++ .../app/models/OPNsense/HAProxy/HAProxy.xml | 6 +- .../scripts/OPNsense/HAProxy/setup.sh | 2 +- .../templates/OPNsense/HAProxy/+TARGETS | 1 + .../templates/OPNsense/HAProxy/haproxy.conf | 22 +++++-- .../templates/OPNsense/HAProxy/haproxy.inc | 65 +++++++++++++++++++ 6 files changed, 94 insertions(+), 8 deletions(-) create mode 100644 net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml index 94c57028c..196da4983 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml @@ -17,6 +17,12 @@ info + + haproxy.general.tuning.chroot + + checkbox +
NOTE: Enabling chroot will deactivate logging to localhost, because the local syslogd is running in secure mode and does not accept network connections (and it's log socket is not accessible from the chroot directory). You'll need to log to a remote host when enabling the chroot feature.
]]> + haproxy.general.tuning.nbproc diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 74ae5cbbe..d5aad8fe6 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -10,6 +10,10 @@ Y + + 0 + Y + 1 500000 @@ -132,7 +136,7 @@ daemon ftp kern - local0 + local0 [default] local1 local2 local3 diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh index b8c57f0f0..12cde91c0 100755 --- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh +++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/setup.sh @@ -1,6 +1,6 @@ #!/bin/sh -HAPROXY_DIRS="/var/log/haproxy /var/run/haproxy /var/etc/haproxy/ssl /var/etc/haproxy/lua /var/etc/haproxy/errorfiles" +HAPROXY_DIRS="/var/run/haproxy /var/etc/haproxy/ssl /var/etc/haproxy/lua /var/etc/haproxy/errorfiles" for directory in ${HAPROXY_DIRS}; do mkdir -p ${directory} diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS index 6e4c913d2..82cf9aac2 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS @@ -1,2 +1,3 @@ haproxy.conf:/usr/local/etc/haproxy.conf +haproxy.inc:/usr/local/etc/inc/plugins.inc.d/haproxy.inc rc.conf.d:/etc/rc.conf.d/haproxy diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index ebb6657ec..51b6f4a12 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -443,7 +443,11 @@ global uid 80 gid 80 +{% if OPNsense.HAProxy.general.tuning.chroot == "1" %} + # NOTE: chroot prevents (most) local logging, you need to enable remote + # logging when using it (because syslogd is running in secure mode). chroot /var/run/haproxy +{% endif %} daemon stats socket /var/run/haproxy.socket level admin nbproc {{OPNsense.HAProxy.general.tuning.nbproc}} @@ -465,12 +469,18 @@ global {% if OPNsense.HAProxy.general.tuning.luaMaxMem|default("") != "" %} tune.lua.maxmem {{OPNsense.HAProxy.general.tuning.luaMaxMem}} {% endif %} -{# # logging configuration #} -{% set logging = [] %} -{% do logging.append(OPNsense.HAProxy.general.logging.host) %} -{% do logging.append('len ' ~ OPNsense.HAProxy.general.logging.length) if OPNsense.HAProxy.general.logging.length|default("") != "" %} -{% do logging.append(OPNsense.HAProxy.general.logging.facility) %} -{% do logging.append(OPNsense.HAProxy.general.logging.level) if OPNsense.HAProxy.general.logging.level|default("") != "" %} +{# # logging configuration #} +{% set logging = [] %} +{% if OPNsense.HAProxy.general.logging.host != '127.0.0.1' %} +{% do logging.append(OPNsense.HAProxy.general.logging.host) %} +{% else %} +{# # NOTE: syslogd is running is secure mode and thus does not accept network #} +{# # connections. That's why we need to use the log socket instead. #} +{% do logging.append('/var/run/log') %} +{% endif %} +{% do logging.append('len ' ~ OPNsense.HAProxy.general.logging.length) if OPNsense.HAProxy.general.logging.length|default("") != "" %} +{% do logging.append(OPNsense.HAProxy.general.logging.facility) %} +{% do logging.append(OPNsense.HAProxy.general.logging.level) if OPNsense.HAProxy.general.logging.level|default("") != "" %} log {{logging|join(' ')}} {% if OPNsense.HAProxy.luas.lua is defined %} # lua scripts diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc new file mode 100644 index 000000000..fd9af8723 --- /dev/null +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc @@ -0,0 +1,65 @@ + + * + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions are met: + * + * 1. Redistributions of source code must retain the above copyright notice, + * this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, + * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY + * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, + * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF + * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS + * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN + * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE + * POSSIBILITY OF SUCH DAMAGE. + * + */ + +/** + * register legacy syslog facilities + * @return array + */ +function haproxy_syslog() +{ + $syslogconf = array(); + $syslogconf['haproxy'] = array("facility" => array('haproxy'), "remote" => "haproxy"); + return $syslogconf; +} + +/** + * register legacy service + * @return array + */ +function haproxy_services() +{ + global $config; + $services = array(); + + if (isset($config['OPNsense']['HAProxy']['general']['enabled']) && $config['OPNsense']['HAProxy']['general']['enabled'] == 1) { + $services[] = array( + 'description' => gettext('HAProxy load balancer'), + 'configd' => array( + 'restart' => array('haproxy restart'), + 'start' => array('haproxy start'), + 'stop' => array('haproxy stop'), + ), + 'name' => 'haproxy', + ); + } + + return $services; +} From b9d88d6f6e37d8fcdccad5051bded28a35567f2f Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 20 Apr 2016 14:06:19 +0200 Subject: [PATCH 2/6] net/haproxy: add logging GUI components --- net/haproxy/+POST_DEINSTALL | 3 +++ .../opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml | 2 +- .../opnsense/service/templates/OPNsense/HAProxy/+TARGETS | 1 + .../templates/OPNsense/HAProxy/diag_logs_haproxy.php | 6 ++++++ 4 files changed, 11 insertions(+), 1 deletion(-) create mode 100644 net/haproxy/+POST_DEINSTALL create mode 100644 net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php diff --git a/net/haproxy/+POST_DEINSTALL b/net/haproxy/+POST_DEINSTALL new file mode 100644 index 000000000..fa55fa709 --- /dev/null +++ b/net/haproxy/+POST_DEINSTALL @@ -0,0 +1,3 @@ +# remove legacy components on uninstall +rm -f /usr/local/www/diag_logs_haproxy.php +rm -f /usr/local/etc/inc/plugins.inc.d/haproxy.inc diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml index 5e04f9d37..d91b7c8ed 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml @@ -22,7 +22,7 @@ - + diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS index 82cf9aac2..fee417f6f 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS @@ -1,3 +1,4 @@ +diag_logs_haproxy.php:/usr/local/www/diag_logs_haproxy.php haproxy.conf:/usr/local/etc/haproxy.conf haproxy.inc:/usr/local/etc/inc/plugins.inc.d/haproxy.inc rc.conf.d:/etc/rc.conf.d/haproxy diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php new file mode 100644 index 000000000..dfd8a441c --- /dev/null +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php @@ -0,0 +1,6 @@ + Date: Wed, 20 Apr 2016 14:20:59 +0200 Subject: [PATCH 3/6] net/haproxy: set sane default loglevel --- .../src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index d5aad8fe6..9f21a2c23 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -155,13 +155,14 @@ N + info alert crit debug emerg err - info + info [default] notice warning From 6dfbb119f7cee23d8e071a1788f187b783a5d261 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 20 Apr 2016 14:31:42 +0200 Subject: [PATCH 4/6] net/haproxy: cleanup --- net/haproxy/+POST_DEINSTALL | 3 --- .../OPNsense/HAProxy => etc/inc/plugins.inc.d}/haproxy.inc | 1 - .../src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS | 2 -- .../templates/OPNsense/HAProxy => www}/diag_logs_haproxy.php | 0 4 files changed, 6 deletions(-) delete mode 100644 net/haproxy/+POST_DEINSTALL rename net/haproxy/src/{opnsense/service/templates/OPNsense/HAProxy => etc/inc/plugins.inc.d}/haproxy.inc (97%) rename net/haproxy/src/{opnsense/service/templates/OPNsense/HAProxy => www}/diag_logs_haproxy.php (100%) diff --git a/net/haproxy/+POST_DEINSTALL b/net/haproxy/+POST_DEINSTALL deleted file mode 100644 index fa55fa709..000000000 --- a/net/haproxy/+POST_DEINSTALL +++ /dev/null @@ -1,3 +0,0 @@ -# remove legacy components on uninstall -rm -f /usr/local/www/diag_logs_haproxy.php -rm -f /usr/local/etc/inc/plugins.inc.d/haproxy.inc diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc b/net/haproxy/src/etc/inc/plugins.inc.d/haproxy.inc similarity index 97% rename from net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc rename to net/haproxy/src/etc/inc/plugins.inc.d/haproxy.inc index fd9af8723..89ed9eb15 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.inc +++ b/net/haproxy/src/etc/inc/plugins.inc.d/haproxy.inc @@ -2,7 +2,6 @@ /** * Copyright (C) 2016 Frank Wall - * Copyright (C) 2014-2016 Franco Fichtner * * All rights reserved. * diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS index fee417f6f..6e4c913d2 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+TARGETS @@ -1,4 +1,2 @@ -diag_logs_haproxy.php:/usr/local/www/diag_logs_haproxy.php haproxy.conf:/usr/local/etc/haproxy.conf -haproxy.inc:/usr/local/etc/inc/plugins.inc.d/haproxy.inc rc.conf.d:/etc/rc.conf.d/haproxy diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php b/net/haproxy/src/www/diag_logs_haproxy.php similarity index 100% rename from net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/diag_logs_haproxy.php rename to net/haproxy/src/www/diag_logs_haproxy.php From f77069da85b540689646ad8949f8111aa02f9e16 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 20 Apr 2016 15:32:06 +0200 Subject: [PATCH 5/6] net/haproxy: print error if statistics are unavailable --- .../src/opnsense/mvc/app/views/OPNsense/HAProxy/statistics.volt | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/statistics.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/statistics.volt index 76bbb626f..aa4473c04 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/statistics.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/statistics.volt @@ -49,6 +49,8 @@ POSSIBILITY OF SUCH DAMAGE. $('#infolist').append(''+key+'' + ""+value+""); }); + } else { + $("#infolist").html("
Error: Unable to fetch statistics. Is HAProxy running?"); } $('#processing-dialog').modal('hide'); } From 359b8cd60a602134a0074fba7030b552a84b54f7 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 20 Apr 2016 15:32:26 +0200 Subject: [PATCH 6/6] net/haproxy: bump version to 0.3 --- net/haproxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 2b341765a..6fdde0d7d 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 0.2 +PLUGIN_VERSION= 0.3 PLUGIN_PRIVATE= yes PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy