net/haproxy: allow to add groups as userlists, refs #1796

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml

@@ -24,4 +24,10 @@
         <allownew>true</allownew>
         <hint>Type username or choose from list.</hint>
     </field>
+    <field>
+        <id>group.add_userlist</id>
+        <label>Add userlist</label>
+        <type>checkbox</type>
+        <help>Usually HAproxy userlists are created automatically in a context sensitive way. This option adds this group as userlist, so that it can be referenced in rules/conditions. All special and non-alphanumeric characters will be removed from the userlist name.</help>
+    </field>
 </form>

net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml

@@ -1,6 +1,6 @@
 <model>
     <mount>//OPNsense/HAProxy</mount>
-    <version>2.8.0</version>
+    <version>2.9.0</version>
     <description>the HAProxy load balancer</description>
     <items>
         <general>
@@ -2219,6 +2219,10 @@
                     <Multiple>Y</Multiple>
                     <Required>N</Required>
                 </members>
+                <add_userlist type="BooleanField">
+                    <default>0</default>
+                    <Required>N</Required>
+                </add_userlist>
             </group>
         </groups>
         <users>

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -729,7 +729,7 @@
 {%       endif %}
 {%     endfor %}
 {%   else %}
-    # WARNING: UserlistAddUsers called with empty user data
+    # NOTE: UserlistAddUsers called with empty user data
 {%   endif %}
 {#   # process all group members #}
 {%   if linkedGroupData is defined %}
@@ -758,20 +758,32 @@
 {%       endif %}
 {%     endfor %}
 {%   else %}
-    # WARNING: UserlistAddUsers called with empty group data
+    # NOTE: UserlistAddUsers called with empty group data
 {%   endif %}
 {%- endmacro %}
 
-{# Macro expects a backend or frontend object. #}
-{% macro AddUserlist(proxy) -%}
-{%   if proxy is defined %}
-{%     if (proxy.enabled|default("") == '1' and proxy.mode|default("") == 'http' and proxy.basicAuthEnabled|default("") == '1') %}
+{# Macro expects a backend/frontend (type 1) or group object (type 2). #}
+{% macro AddUserlist(type,object) -%}
+{%   if (type == '1' and object is defined) %}
+{#     # frontend/backend object #}
+{%     if (object.enabled|default("") == '1' and object.mode|default("") == 'http' and object.basicAuthEnabled|default("") == '1') %}
 {#       # call macro to generate list of unique users #}
-{%       set userlist_result = UserlistAddUsers(proxy.basicAuthUsers,proxy.basicAuthGroups) %}
+{%       set userlist_result = UserlistAddUsers(object.basicAuthUsers,object.basicAuthGroups) %}
 {#       # check result, skip when empty #}
 {%       if (userlist_result is defined and userlist_result|default("") != "" )%}
-userlist list_{{proxy.id}}
-    # Origin: {{proxy.name}}
+userlist list_{{object.id}}
+    # Origin: {{object.name}}
+{{userlist_result}}
+{%       endif %}
+{%     endif %}
+{%   elif (type == '2' and object is defined) %}
+{#     # group object #}
+{%     if (object.enabled|default("") == '1' and object.add_userlist|default("") == '1') %}
+{#       # call macro to generate list of unique users #}
+{%       set userlist_result = UserlistAddUsers(object.members) %}
+{#       # check result, skip when empty #}
+{%       if (userlist_result is defined and userlist_result|default("") != "" ) %}
+userlist {{object.name | regex_replace ("[^A-Za-z0-9]","")}}
 {{userlist_result}}
 {%       endif %}
 {%     endif %}
@@ -951,17 +963,25 @@ userlist acl_{{acl.id}}
 {%   endfor %}
 {% endif %}
 
+{% if helpers.exists('OPNsense.HAProxy.groups') %}
+# userlists generated from groups
+{%   for group in helpers.toList('OPNsense.HAProxy.groups.group') %}
+{#     # call macro to generate userlist #}
+{{     AddUserlist('2',group) -}}
+{%   endfor %}
+{% endif %}
+
 # autogenerated entries for config in backends/frontends
 {% if helpers.exists('OPNsense.HAProxy.frontends') %}
 {%   for frontend in helpers.toList('OPNsense.HAProxy.frontends.frontend') %}
 {#     # call macro to generate userlist #}
-{{     AddUserlist(frontend) -}}
+{{     AddUserlist('1',frontend) -}}
 {%   endfor %}
 {% endif %}
 {% if helpers.exists('OPNsense.HAProxy.backends') %}
 {%   for backend in helpers.toList('OPNsense.HAProxy.backends.backend') %}
 {#     # call macro to generate userlist #}
-{{     AddUserlist(backend) -}}
+{{     AddUserlist('1',backend) -}}
 {%   endfor %}
 {% endif %}