net/haproxy: switch to HAProxy 2.2 release series, closes #2092

net/haproxy/pkg-descr

@@ -11,12 +11,20 @@ Plugin Changelog
 Added:
 * new feature to change server state and weight on-the-fly (#2213)
 * add new SSL bind option: prefer-client-ciphers
+* add global option to enable old buggy behaviour for PROXY v2 connections
+* add support for HTTP/2 in health checks
+
+Fixed:
+* fix maintenance page (python error: 'list' object has no attribute 'strip')
 
 Changed:
 * change default SSL version to TLSv1.2 (ssl-min-ver)
 * remove weak ciphers from (default) SSL settings
 * remove default SSL bind options that would conflict with ssl-min-ver
 * move SSL bind options below other SSL settings, they are rarely used nowadays
+* change default for tune.ssl.default-dh-param from 1024 to 2048
+* use new "http-check send" command for HTTP health checks
+* change default for spreadChecks from 0 to 2
 
 2.26
 

net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml

@@ -68,6 +68,12 @@
         <type>text</type>
         <help><![CDATA[Add some randomness in the check interval between 0 and +/- 50%. A value between 2 and 5 seems to show good results. The default value is 0 (disabled).]]></help>
     </field>
+    <field>
+        <id>haproxy.general.tuning.bogusProxyEnabled</id>
+        <label>Enable old bogus PROXY v2 implementation</label>
+        <type>checkbox</type>
+        <help><![CDATA[A bug in the PROXY protocol v2 implementation was present in HAProxy up to version 2.1. Enabling this option reverts this old buggy behaviour.]]></help>
+    </field>
     <field>
         <id>haproxy.general.tuning.customOptions</id>
         <label>Custom options</label>

net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml

@@ -86,7 +86,7 @@
                     </OptionValues>
                 </sslServerVerify>
                 <maxDHSize type="IntegerField">
-                    <default>1024</default>
+                    <default>2048</default>
                     <MinimumValue>1024</MinimumValue>
                     <MaximumValue>16384</MaximumValue>
                     <ValidationMessage>Please specify a value between 1024 and 16384.</ValidationMessage>
@@ -107,12 +107,16 @@
                     <Required>N</Required>
                 </checkBufferSize>
                 <spreadChecks type="IntegerField">
-                    <default>0</default>
+                    <default>2</default>
                     <MinimumValue>0</MinimumValue>
                     <MaximumValue>50</MaximumValue>
                     <ValidationMessage>Please specify a value between 0 and 50.</ValidationMessage>
                     <Required>Y</Required>
                 </spreadChecks>
+                <bogusProxyEnabled type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </bogusProxyEnabled>
                 <luaMaxMem type="IntegerField">
                     <default>0</default>
                     <MinimumValue>0</MinimumValue>
@@ -1322,6 +1326,7 @@
                     <OptionValues>
                         <http10>HTTP/1.0 [default]</http10>
                         <http11>HTTP/1.1</http11>
+                        <http2>HTTP/2</http2>
                     </OptionValues>
                 </http_version>
                 <http_host type="TextField">

net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/socketCommand.py

@@ -148,7 +148,7 @@ try:
         if con:
             result = con.sendCmd(command_class(**command_args), objectify=False)
             if result:
-                print(result.strip())
+                print(result)
         else:
             print(f"Could not open socket {SOCKET}")
 

net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf

@@ -838,6 +838,9 @@ global
 {% if OPNsense.HAProxy.general.tuning.spreadChecks|default("") != "" %}
     spread-checks               {{OPNsense.HAProxy.general.tuning.spreadChecks}}
 {% endif %}
+{% if OPNsense.HAProxy.general.tuning.bogusProxyEnabled|default("") == '1' %}
+    pp2-never-send-local
+{% endif %}
 {% if OPNsense.HAProxy.general.tuning.checkBufferSize|default("") != "" %}
     tune.chksize                {{OPNsense.HAProxy.general.tuning.checkBufferSize}}
 {% endif %}
@@ -1285,15 +1288,20 @@ backend {{backend.name}}
 {%             endif %}
 {%           endif %}
 {%         elif healthcheck_data.type == 'http' %}
-{%           do healthcheck_options.append('httpchk') %}
+    option httpchk
 {#           # HTTP method must be uppercase #}
+{%           do healthcheck_options.append('send meth') %}
 {%           do healthcheck_options.append(healthcheck_data.http_method|upper) %}
+{%           do healthcheck_options.append('uri') %}
 {%           do healthcheck_options.append(healthcheck_data.http_uri) %}
-{%           do healthcheck_options.append('HTTP/1.0') if healthcheck_data.http_version == 'http10' %}
 {#           # HTTP Host header requires HTTP 1.1 #}
-{%           do healthcheck_options.append('HTTP/1.1') if healthcheck_data.http_version == 'http11' and healthcheck_data.http_host|default("") == "" %}
-{%           do healthcheck_options.append('HTTP/1.1\\r\\nHost:\ ' ~ healthcheck_data.http_host) if healthcheck_data.http_version == 'http11' and healthcheck_data.http_host|default("") != "" %}
-    option {{healthcheck_options|join(' ')}}
+{%           if (healthcheck_data.http_version == 'http11' or healthcheck_data.http_version == 'http2') and healthcheck_data.http_host|default('') != '' %}
+{%             do healthcheck_options.append('ver HTTP/1.1 hdr Host ' ~ healthcheck_data.http_host) if healthcheck_data.http_version == 'http11' %}
+{%             do healthcheck_options.append('ver HTTP/2 hdr Host ' ~ healthcheck_data.http_host) if healthcheck_data.http_version == 'http2' %}
+{%           elif healthcheck_data.http_version == 'http10' %}
+{%             do healthcheck_options.append('ver HTTP/1.0') %}
+{%           endif %}
+    http-check {{healthcheck_options|join(' ')}}
 {#           # custom HTTP health check option #}
 {%           if healthcheck_data.http_expressionEnabled|default("") == '1' %}
 {#             # validate options #}