netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: support deciphered SNI check, improve wording, closes #1365

Browse Source
This commit is contained in:
Frank Wall
2019-07-14 23:33:45 +02:00
parent 62128b4165
commit e08ddd2144
3 changed files with 32 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAcl.xml
+11
View File
@@ -423,6 +423,17 @@
<type>dropdown</type>
<help><![CDATA[Use the specified backend to count usable servers. Leave empty to use the current backend.]]></help>
</field>
<field>
<label>Parameters</label>
<type>header</type>
<style>expression_table table_ssl_fc_sni</style>
</field>
<field>
<id>acl.ssl_fc_sni</id>
<label>SNI Matches</label>
<type>text</type>
<help><![CDATA[The value of the Server Name TLS extension sent by a client matches the exact string.]]></help>
</field>
<field>
<label>Parameters</label>
<type>header</type>
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+12 -7
View File
@@ -1290,7 +1290,6 @@
<path_dir>Path contains subdir</path_dir>
<path_sub>Path contains string</path_sub>
<url_param>URL parameter contains</url_param>
<ssl_fc>SSL/TLS connection established</ssl_fc>
<ssl_c_verify>SSL Client certificate is valid</ssl_c_verify>
<ssl_c_verify_code>SSL Client certificate verify error result</ssl_c_verify_code>
<ssl_c_ca_commonname>SSL Client certificate issued by CA common-name</ssl_c_ca_commonname>
@@ -1317,12 +1316,14 @@
<src_sess_rate>Source IP: session rate</src_sess_rate>
<nbsrv>Minimum number of usable servers in backend</nbsrv>
<traffic_is_http>Traffic is HTTP</traffic_is_http>
<traffic_is_ssl>Traffic is SSL</traffic_is_ssl>
<ssl_sni>SNI TLS extension matches</ssl_sni>
<ssl_sni_sub>SNI TLS extension contains</ssl_sni_sub>
<ssl_sni_beg>SNI TLS extension starts with</ssl_sni_beg>
<ssl_sni_end>SNI TLS extension ends with</ssl_sni_end>
<ssl_sni_reg>SNI TLS extension regex</ssl_sni_reg>
<traffic_is_ssl>Traffic is SSL (TCP request content inspection)</traffic_is_ssl>
<ssl_fc>Traffic is SSL (locally deciphered)</ssl_fc>
<ssl_fc_sni>SNI TLS extension matches (locally deciphered)</ssl_fc_sni>
<ssl_sni>SNI TLS extension matches (TCP request content inspection)</ssl_sni>
<ssl_sni_sub>SNI TLS extension contains (TCP request content inspection)</ssl_sni_sub>
<ssl_sni_beg>SNI TLS extension starts with (TCP request content inspection)</ssl_sni_beg>
<ssl_sni_end>SNI TLS extension ends with (TCP request content inspection)</ssl_sni_end>
<ssl_sni_reg>SNI TLS extension regex (TCP request content inspection)</ssl_sni_reg>
<custom_acl>Custom condition (option pass-through)</custom_acl>
</OptionValues>
</expression>
@@ -1620,6 +1621,10 @@
<ValidationMessage>Related backend item not found</ValidationMessage>
<Required>N</Required>
</nbsrv_backend>
<ssl_fc_sni type="TextField">
<mask>/^.{1,4096}$/u</mask>
<Required>N</Required>
</ssl_fc_sni>
<ssl_sni type="TextField">
<mask>/^.{1,4096}$/u</mask>
<Required>N</Required>
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+9 -2
View File
@@ -182,8 +182,6 @@
{% set acl_enabled = '0' %}
# ERROR: missing parameters
{% endif %}
{% elif acl_data.expression == 'ssl_fc' %}
{% do acl_options.append('ssl_fc') %}
{% elif acl_data.expression == 'src' %}
{% if acl_data.src|default("") != "" %}
{% do acl_options.append('src ' ~ acl_data.src) %}
@@ -238,6 +236,15 @@
{% do acl_options.append('req.proto_http') %}
{% elif acl_data.expression == 'traffic_is_ssl' %}
{% do acl_options.append('req.ssl_ver gt 0') %}
{% elif acl_data.expression == 'ssl_fc' %}
{% do acl_options.append('ssl_fc') %}
{% elif acl_data.expression == 'ssl_fc_sni' %}
{% if acl_data.ssl_fc_sni|default("") != "" %}
{% do acl_options.append('ssl_fc_sni ' ~ acl_data.ssl_fc_sni) %}
{% else %}
{% set acl_enabled = '0' %}
# ERROR: missing parameters
{% endif %}
{% elif acl_data.expression == 'ssl_sni' %}
{% if acl_data.ssl_sni|default("") != "" %}
{% do acl_options.append('req.ssl_sni -i ' ~ acl_data.ssl_sni) %}