From f1d95e5609e81b3e2c9dbcc192afa518af68a41f Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 18 May 2016 23:36:37 +0200 Subject: [PATCH 1/8] net/haproxy: change to soft failure to avoid useless crash reports --- .../src/opnsense/scripts/OPNsense/HAProxy/queryStats.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/queryStats.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/queryStats.php index 08c780d51..0a37868c6 100755 --- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/queryStats.php +++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/queryStats.php @@ -35,11 +35,11 @@ function socketCmd($command) { global $haproxy_socket; $data = array(); if (!file_exists($haproxy_socket)) { - throw new UnexpectedValueException("HAProxy socket does not exist, service may be stopped"); + exit("HAProxy socket does not exist, service may be stopped"); } else { $socket = @stream_socket_client("unix://$haproxy_socket", $errorNumber, $errorMessage); if (!$socket) { - throw new UnexpectedValueException("Unable to open socket: $errorMessage"); + exit("Unable to open socket: $errorMessage"); } else { fwrite($socket, "$command\n"); while (!feof($socket)) { From efd9d8455de7275966004ad7535575a39c7d892f Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Wed, 18 May 2016 23:54:22 +0200 Subject: [PATCH 2/8] net/haproxy: more safeguarding in template code --- .../templates/OPNsense/HAProxy/haproxy.conf | 29 ++++++++++--------- 1 file changed, 15 insertions(+), 14 deletions(-) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 51b6f4a12..f287f9779 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -482,7 +482,7 @@ global {% do logging.append(OPNsense.HAProxy.general.logging.facility) %} {% do logging.append(OPNsense.HAProxy.general.logging.level) if OPNsense.HAProxy.general.logging.level|default("") != "" %} log {{logging|join(' ')}} -{% if OPNsense.HAProxy.luas.lua is defined %} +{% if helpers.exists('OPNsense.HAProxy.luas.lua') %} # lua scripts {% for lua in helpers.toList('OPNsense.HAProxy.luas.lua') %} {% if lua.enabled == '1' %} @@ -497,25 +497,27 @@ global {# DEFAULTS #} {# ############################### #} +{% if helpers.exists('OPNsense.HAProxy.general.defaults') %} defaults log global -{% if OPNsense.HAProxy.general.defaults.redispatch|default("") != "" %} +{% if OPNsense.HAProxy.general.defaults.redispatch|default("") != "" %} option redispatch {{OPNsense.HAProxy.general.defaults.redispatch|replace("x", "")}} -{% endif %} -{% if OPNsense.HAProxy.general.defaults.maxConnections|default("") != "" %} +{% endif %} +{% if OPNsense.HAProxy.general.defaults.maxConnections|default("") != "" %} maxconn {{OPNsense.HAProxy.general.defaults.maxConnections}} -{% endif %} -{% if OPNsense.HAProxy.general.defaults.timeoutClient|default("") != "" %} +{% endif %} +{% if OPNsense.HAProxy.general.defaults.timeoutClient|default("") != "" %} timeout client {{OPNsense.HAProxy.general.defaults.timeoutClient}} -{% endif %} -{% if OPNsense.HAProxy.general.defaults.timeoutConnect|default("") != "" %} +{% endif %} +{% if OPNsense.HAProxy.general.defaults.timeoutConnect|default("") != "" %} timeout connect {{OPNsense.HAProxy.general.defaults.timeoutConnect}} -{% endif %} -{% if OPNsense.HAProxy.general.defaults.timeoutServer|default("") != "" %} +{% endif %} +{% if OPNsense.HAProxy.general.defaults.timeoutServer|default("") != "" %} timeout server {{OPNsense.HAProxy.general.defaults.timeoutServer}} -{% endif %} -{% if OPNsense.HAProxy.general.defaults.retries|default("") != "" %} +{% endif %} +{% if OPNsense.HAProxy.general.defaults.retries|default("") != "" %} retries {{OPNsense.HAProxy.general.defaults.retries}} +{% endif %} {% endif %} {# ############################### #} @@ -766,7 +768,7 @@ backend {{backend.name}} {# STATISTICS #} {# ############################### #} -{% if OPNsense.HAProxy.general.stats.enabled|default("") == "1" %} +{% if helpers.exists('OPNsense.HAProxy.general.stats') and OPNsense.HAProxy.general.stats.enabled|default("") == "1" %} {# # enable local stats #} listen local_statistics bind 127.0.0.1:{{OPNsense.HAProxy.general.stats.port}} @@ -802,4 +804,3 @@ listen remote_statistics # statistics are DISABLED {% endif %} - From b998ac9d208fbdb6981bb5f71bf996fa84b6b1ff Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 00:29:13 +0200 Subject: [PATCH 3/8] net/haproxy: fix validation mask for Log Host --- .../src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 9f21a2c23..e79f57a71 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -118,7 +118,7 @@ 127.0.0.1 - /^((([0-9a-zA-Z._\-\*]+:[0-9]+)([,]){0,1}))*/u + /^([0-9a-zA-Z\.,_\-:]){0,1024}$/u lower Please provide a valid host, i.e. 127.0.0.1 or 10.0.0.1:514. Y From 0e8447ac2fcdd0a62a1f799c800b33ba3917b570 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 00:34:46 +0200 Subject: [PATCH 4/8] net/haproxy: fix validation message for Log Host --- .../src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index e79f57a71..bbb01f0ca 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -120,7 +120,7 @@ 127.0.0.1 /^([0-9a-zA-Z\.,_\-:]){0,1024}$/u lower - Please provide a valid host, i.e. 127.0.0.1 or 10.0.0.1:514. + Please specify a valid servername or IP address. Y From 07e2bc401b4e50350836c9b3864591f49c394182 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 00:39:43 +0200 Subject: [PATCH 5/8] net/haproxy: bump version to 1.0.1 --- net/haproxy/Makefile | 2 +- .../src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 48c46ba38..8a69d6f1c 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 1.0 +PLUGIN_VERSION= 1.0.1 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST index 5e864b8e6..29fead296 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST @@ -1,5 +1,5 @@ name: opnsense-haproxy -version: 1.0 +version: 1.0.1 origin: opnsense/haproxy comment: load balancer desc: Reliable, high performance TCP/HTTP load balancer From dec85ab09a577a316d118f31e5bdcc8c165e6100 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 11:51:10 +0200 Subject: [PATCH 6/8] net/haproxy: add logs to ACL pattern --- .../src/opnsense/mvc/app/models/OPNsense/HAProxy/ACL/ACL.xml | 1 + 1 file changed, 1 insertion(+) diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/ACL/ACL.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/ACL/ACL.xml index f03a9221d..01d17baf8 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/ACL/ACL.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/ACL/ACL.xml @@ -6,6 +6,7 @@ ui/haproxy/* api/haproxy/* + diag_logs_haproxy.php From f997189a7731deecb613f1966229357b95578f20 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 15:22:54 +0200 Subject: [PATCH 7/8] net/haproxy: fix certificate export --- .../src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php index e9aca1c45..96f03ee43 100755 --- a/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php +++ b/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php @@ -41,11 +41,11 @@ global $config; $configObj = Config::getInstance()->object(); if (isset($configObj->OPNsense->HAProxy->frontends)) { foreach ($configObj->OPNsense->HAProxy->frontends->children() as $frontend) { - if (!isset($frontend->ssl)) { + if (!isset($frontend->ssl_enabled)) { continue; } // multiple comma-separated values are possible - $certs = explode(',', $frontend->ssl->certificates); + $certs = explode(',', $frontend->ssl_certificates); foreach ($certs as $cert_refid) { // if the frontend has a cert attached, search for its contents if ($cert_refid != "") { @@ -53,7 +53,7 @@ if (isset($configObj->OPNsense->HAProxy->frontends)) { if ($cert_refid == (string)$cert->refid) { // generate cert pem file $pem_content = str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->crt))); - $pem_content .= str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->prv))); + $pem_content .= "\n" . str_replace("\n\n", "\n", str_replace("\r", "", base64_decode((string)$cert->prv))); $output_pem_filename = "/var/etc/haproxy/ssl/" . $cert_refid . ".pem" ; file_put_contents($output_pem_filename, $pem_content); chmod($output_pem_filename, 0600); From ab3e1003d89c6c9d4adcb20b5feb1728d57c3d37 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 19 May 2016 16:31:27 +0200 Subject: [PATCH 8/8] net/haproxy: bump version to 1.1 --- net/haproxy/Makefile | 2 +- .../src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index 8a69d6f1c..08ae2c6ae 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 1.0.1 +PLUGIN_VERSION= 1.1 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST index 29fead296..b80518cf9 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/+MANIFEST @@ -1,5 +1,5 @@ name: opnsense-haproxy -version: 1.0.1 +version: 1.1 origin: opnsense/haproxy comment: load balancer desc: Reliable, high performance TCP/HTTP load balancer