diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index e4f47a08c..a27f03962 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 2.23 +PLUGIN_VERSION= 2.24 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy20 PLUGIN_MAINTAINER= opnsense@moov.de diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 5a41f6ad0..be9ec9837 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -3,4 +3,244 @@ availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for web sites crawling under very high loads while needing persistence or Layer7 processing. -WWW: https://haproxy.org/ +Plugin Changelog +================ + +2.24 + +Added: +* add support for http-request set-var and http-response set-var (#1796) +* add group as userlist to HAProxy config to make it usable in rules/conditions (#1796) +* add support for resolvers to customize how HAProxy handles name resolution (#1787) +* add support for init-addr to allow HAProxy to start when DNS does not resolve (#1787) + +Fixed: +* honor sort order of all rules, remove special handling of "use_[backend|server]" options (#1925) + +Changed: +* add "Save & Test syntax" button to all "Settings" pages +* add "introduction" page for Settings tab +* streamine "Settings" subtabs + +2.23 + +Fixed: +* add missing acl SNI regex text field (#1883) + +2.22 + +Added: +* enable SSL verification for a server when "Force SSL" is enabled in the associated health check (#1761) +* use the systems local Root CA Certificates for SSL verification when no CA was selected (#1761) + +Fixed: +* fix label of src_sess_cnt (#1780) +* fix invalid use of option httplog (resolves a warning in config test) +* fix invalid use of option forwardfor (resolves a warning in config test) + +2.21 + +Fixed: +* override "graceful" restart if required (#1745) + +2.20 + +Changed: +* update stats socket permission for easier (non-root) monitoring (#1232) + +2.19 + +Added: +* switch to HAProxy 2.0 release series (#1089) +* add support for the "max-object-size" cache configuration option (#1458) +* add end-to-end HTTP/2 support (details) +* add support for the random balancing algorithm (details) + +Fixed: +* fix IPv6 validation in frontends (#540) + +Changed: +* add IPv6 example to listen address help text +* update URLs to HAProxy 2.0 documentation +* frontends: move HTTP/2 option to HTTP settings +* change order of frontend options + +2.18 + +Added: +* add support for HAProxy cache (#1442) + +Changed: +* change http-reuse default (align with HAProxy's default value, #1439) + +2.17 + +Added: +* allow backends without servers (#1304) +* add support for deciphered SNI check in ACLs (#1365) +* allow to force SSL for health checks (#1282) + +Changed: +* improve wording for SNI conditions to differentiate between deciphered vs. not deciphered + +2.16 + +Fixed: +* allow hyphens in server, frontend and backend names (#1346) + +2.15 + +Added: +* rules can finally be sorted by using drag'n'drop (#582) +* added "enabled" field to servers (#1208) +* TCP inspection delays are supported in rules (#1188) + +Changed: +* server option "mode" is always visible, no longer requires "advanced mode" (#1208) +* most dropdown fields finally have alphanumeric sorting (#687, opnsense/core#3251) +* rules: align indentation of comments in haproxy.conf + +2.14 + +Fixed: +* bulk deleting does not work (#1164) + +Changed: +* migrate to mutable controller (required to fix #1164) + +2.13 + +Added: +* support multiple CAs for SSL verification for servers + +Fixed: +* fix export of CAs (#1074) + +Changed: +* export a frontend's default SSL certificate (#1088) +* it is no longer required to add a default SSL certificate to a frontend's "certificates" list (#1088) +* avoid duplicate entry in certlist file if a default SSL certificate is specified +* always show "Default certificate" option in frontends, it's no longer an "advanced" option + +2.12 + +Added: +* add support for HTTP/2 (#1047) + +2.11 + +Fixed: +* fix warning: a 'http-request' rule placed after a 'use_backend' rule will still be processed before (#999) +* fix wrong parameter name when using tcp-request content lua (#999) + +Changed: +* internal: trim whitespace, remove empty lines in haproxy.conf (#999) + +2.10 + +Added: +* add support for multithreading (available as new option in Settings -> Global Parameters) (#1003) +* add support for client certificate authentication (#426) +* add support for HTTP Basic Auth to frontends/backends/ACLs (#300) +* add basic user/group management functionality (supports Basic Auth as well as stats users) +* add new CPU Affinity Rules feature (which is a combination of HAProxy's cpu-map, bind-process and process options) (see #1003 for a short explanation) + +Fixed: +* function "http-request header-delete" generated a corrupted haproxy.conf (#882) + +Changed: +* migrate all stats users from old (and cumbersome) username:password format to new user management feature +* internal: use /tmp for autogenerated files (now they are automatically cleaned up on boot) +* internal: change filename of cert lists from id.crtlist to id.certlist + +2.9 + +Added: +* add "http-reuse" option (#836) + +2.8 + +Added: +* support truly seamless reloads (#224) +* add support for the "map" feature (#180) + +Fixed: +* fix reload of service template in "reconfigure" action (#690; introduced in 7381101) +* enabling "hard stop" mode resulted in an invalid "hardrestart" RC command + +Changed: +* use "reload" instead of "restart" RC action +* if "reload" fails, also issue a "restart" command (required when enabling seamless reloads) +* start progress animation (spinner) earlier when applying settings + +2.7 + +Added: +* support rise/fall parameters in backends and health checks +* support set-path in ACLs +* support for cookie-based persistence (#680) + +Fixed: +* fix X-Forwarded-For option disappeared (#647) +* fix validation for source address fields (#695) + +2.6 + +Added: +* add support for http-response set-status in ACLs to manipulate HTTP status codes + +Fixed: +* fix invalid backend name when using nbsrv in ACLs + +2.5 + +Added: +* add support for the PROXY protocol (i.e. in combination with postfix or dovecot) +* switch to HAProxy 1.8.4 + +2.4 + +Added: +* add support for "preload" and "includeSubDomains" HSTS options (#447) +* support session sync / HAProxy peers (#165) +* add new HTTP timeout options (to mitigate slowloris attacks) (#202) +* allow tracking additional values in stick-tables (#202) +* add stick-table config for frontends (optional, disabled by default) (#202) +* add support for many new conditions (#202) +* enable sticky counters for frontend stick-tables (required for new conditions) (#202) + +Changed: +* relax validation masks for several "name" fields (to allow more "special" characters) +* switch to new mutable service controller + +2.3 + +Added: +* new option to hide introduction pages (#340) + +Fixed: +* fix wrong introduction for "Advanced" tab (regression introduced in 8cdcbda) + +2.2 + +Fixed: +* fix for rules parameters (values could not be saved, leading to invalid rules) + +2.1 + +Fixed: +* do not enable HSTS unconditionally (now works as described in #380) +* enable HSTS only for HTTP frontends + +2.0 + +Added: +* new GUI to guide new users and improve general usability (#208) +* make server port optional (#341) +* new SSL settings for frontends (#380) +* new global SSL default values (#380) +* new option for HTTP Strict Transport Security (#380) + +Fixed: +* rephrase text to make it clear that aliases cannot be used (#360) +* rephrase text to make it clear that "use_server" will only work for backends (#361) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php index 7779d14d5..ef5f8f65d 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php @@ -379,4 +379,34 @@ class SettingsController extends ApiMutableModelControllerBase { return $this->searchBase('users.user', array('enabled', 'name', 'description'), 'name'); } + + public function getresolverAction($uuid = null) + { + return $this->getBase('resolver', 'resolvers.resolver', $uuid); + } + + public function setresolverAction($uuid) + { + return $this->setBase('resolver', 'resolvers.resolver', $uuid); + } + + public function addresolverAction() + { + return $this->addBase('resolver', 'resolvers.resolver'); + } + + public function delresolverAction($uuid) + { + return $this->delBase('resolvers.resolver', $uuid); + } + + public function toggleresolverAction($uuid, $enabled = null) + { + return $this->toggleBase('resolvers.resolver', $uuid); + } + + public function searchresolversAction() + { + return $this->searchBase('resolvers.resolver', array('enabled', 'name', 'nameservers'), 'name'); + } } diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php index 020301521..141fac3e5 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php @@ -44,19 +44,26 @@ class IndexController extends \OPNsense\Base\IndexController public function indexAction() { // include form definitions - $this->view->mainForm = $this->getForm("main"); - $this->view->formDialogFrontend = $this->getForm("dialogFrontend"); - $this->view->formDialogBackend = $this->getForm("dialogBackend"); - $this->view->formDialogServer = $this->getForm("dialogServer"); - $this->view->formDialogHealthcheck = $this->getForm("dialogHealthcheck"); - $this->view->formDialogAction = $this->getForm("dialogAction"); $this->view->formDialogAcl = $this->getForm("dialogAcl"); - $this->view->formDialogUser = $this->getForm("dialogUser"); - $this->view->formDialogGroup = $this->getForm("dialogGroup"); - $this->view->formDialogLua = $this->getForm("dialogLua"); - $this->view->formDialogErrorfile = $this->getForm("dialogErrorfile"); - $this->view->formDialogMapfile = $this->getForm("dialogMapfile"); + $this->view->formDialogAction = $this->getForm("dialogAction"); + $this->view->formDialogBackend = $this->getForm("dialogBackend"); $this->view->formDialogCpu = $this->getForm("dialogCpu"); + $this->view->formDialogErrorfile = $this->getForm("dialogErrorfile"); + $this->view->formDialogFrontend = $this->getForm("dialogFrontend"); + $this->view->formDialogGroup = $this->getForm("dialogGroup"); + $this->view->formDialogHealthcheck = $this->getForm("dialogHealthcheck"); + $this->view->formDialogLua = $this->getForm("dialogLua"); + $this->view->formDialogMapfile = $this->getForm("dialogMapfile"); + $this->view->formDialogResolver = $this->getForm("dialogResolver"); + $this->view->formDialogServer = $this->getForm("dialogServer"); + $this->view->formDialogUser = $this->getForm("dialogUser"); + $this->view->generalCacheForm = $this->getForm("generalCache"); + $this->view->generalDefaultsForm = $this->getForm("generalDefaults"); + $this->view->generalLoggingForm = $this->getForm("generalLogging"); + $this->view->generalPeersForm = $this->getForm("generalPeers"); + $this->view->generalSettingsForm = $this->getForm("generalSettings"); + $this->view->generalStatsForm = $this->getForm("generalStats"); + $this->view->generalTuningForm = $this->getForm("generalTuning"); // set additional view parameters $mdlHAProxy = new \OPNsense\HAProxy\HAProxy(); $this->view->showIntro = (string)$mdlHAProxy->general->showIntro; diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml index 5a7881def..c10565e9f 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml @@ -203,6 +203,28 @@ text + + + header + + + + action.http_request_set_var_scope + + dropdown + + + + action.http_request_set_var_name + + text + + + action.http_request_set_var_expr + + text + + header @@ -310,6 +332,28 @@ text + + + header + + + + action.http_response_set_var_scope + + dropdown + + + + action.http_response_set_var_name + + text + + + action.http_response_set_var_expr + + text + + header diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml index 380bcd365..8d4479ef5 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml @@ -54,6 +54,13 @@ Type server name or choose from list. + + backend.linkedResolver + + dropdown + + true + backend.source diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml index d868a472d..dd8956ffb 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml @@ -24,4 +24,10 @@ true Type username or choose from list. + + group.add_userlist + + checkbox + Usually HAproxy userlists are created automatically in a context sensitive way. This option adds this group as userlist, so that it can be referenced in rules/conditions. All special and non-alphanumeric characters will be removed from the userlist name. + diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml new file mode 100644 index 000000000..a604d7d6f --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml @@ -0,0 +1,54 @@ +
+ + resolver.enabled + + checkbox + Enable this resolver configuration. + + + resolver.name + + text + Choose a name for this resolver configuration. + + + resolver.description + + text + Choose a optional description for this resolver configuration. + + + resolver.nameservers + + select_multiple + + true + true + + Enter ip:port here. Finish with TAB. + + + resolver.parse_resolv_conf + + checkbox + Add all nameservers found in /etc/resolv.conf to this resolver configuration. + + + resolver.resolve_retries + + text + + + + resolver.timeout_resolve + + text + + + + resolver.timeout_retry + + text + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml new file mode 100644 index 000000000..d9fd948b3 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml @@ -0,0 +1,30 @@ +
+ + + header + + + haproxy.general.cache.enabled + + checkbox + + + + haproxy.general.cache.totalMaxSize + + text + + + + haproxy.general.cache.maxAge + + text + + + + haproxy.general.cache.maxObjectSize + + text + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml new file mode 100644 index 000000000..4a44e0aee --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml @@ -0,0 +1,63 @@ +
+ + + header + + + haproxy.general.defaults.maxConnections + + text + + + + haproxy.general.defaults.timeoutClient + + text + + + + haproxy.general.defaults.timeoutConnect + + text + + + + haproxy.general.defaults.timeoutCheck + + text + + + + haproxy.general.defaults.timeoutServer + + text + + + + haproxy.general.defaults.retries + + text + + + + haproxy.general.defaults.redispatch + + dropdown + + + + haproxy.general.defaults.init_addr + + select_multiple + + true + + + + haproxy.general.defaults.customOptions + + textbox +
NOTE: The syntax will not be checked, use at your own risk!
]]> + true + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml new file mode 100644 index 000000000..cdc79ac14 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml @@ -0,0 +1,31 @@ +
+ + + header + + + haproxy.general.logging.host + + text + + + + haproxy.general.logging.facility + + dropdown + + + + haproxy.general.logging.level + + dropdown + + + + haproxy.general.logging.length + + text + + true + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml new file mode 100644 index 000000000..f1091f4f3 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml @@ -0,0 +1,56 @@ +
+ + + header + + + haproxy.general.peers.enabled + + checkbox + + + + + header + + + haproxy.general.peers.name1 + + text + + + + haproxy.general.peers.listen1 + + text + + + + haproxy.general.peers.port1 + + text + + + + + header + + + haproxy.general.peers.name2 + + text + + + + haproxy.general.peers.listen2 + + text + + + + haproxy.general.peers.port2 + + text + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml new file mode 100644 index 000000000..78d7ce4b2 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml @@ -0,0 +1,30 @@ +
+ + + header + + + haproxy.general.enabled + + checkbox + Enable or disable the HAProxy service. + + + haproxy.general.gracefulStop + + checkbox + + + + haproxy.general.seamlessReload + + checkbox + + + + haproxy.general.showIntro + + checkbox + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml new file mode 100644 index 000000000..6832e1e17 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml @@ -0,0 +1,60 @@ +
+ + + header + + + haproxy.general.stats.enabled + + checkbox + + + + haproxy.general.stats.port + + text + + true + + + haproxy.general.stats.remoteEnabled + + checkbox + This may be a security risk if you do not enable authentication! Note that you need to add appropiate firewall rules for this to work.]]> + + + haproxy.general.stats.remoteBind + + select_multiple + + true + + Enter address:port here. Finish with TAB. + + + haproxy.general.stats.authEnabled + + checkbox + + + haproxy.general.stats.allowedUsers + + select_multiple + true + Type username or choose from list. + + + haproxy.general.stats.allowedGroups + + select_multiple + true + Type group or choose from list. + + + haproxy.general.stats.customOptions + + textbox +
NOTE: The syntax will not be checked, use at your own risk!
]]> + true + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml new file mode 100644 index 000000000..a5abb322c --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml @@ -0,0 +1,102 @@ +
+ + + header + + + haproxy.general.tuning.root + + checkbox +
NOTE: Enabling root could be a security issue but it's required by some feature.
]]> + true + + + haproxy.general.tuning.nbproc + + text +
NOTE: You may experience random issues in multi-process mode. For more information about the "nbproc" option please see the HAProxy Documentation.
]]> + true + + + haproxy.general.tuning.nbthread + + text + + + + haproxy.general.tuning.maxConnections + + text +
NOTE: HAProxy will not be able to allocate enough memory if you set this value too high. Consider raising the settings for kern.maxfiles and kern.maxfilesperproc if you need to specify a non-default value.
]]> + + + haproxy.general.tuning.sslServerVerify + + dropdown + + + + haproxy.general.tuning.maxDHSize + + text +
NOTE: Higher values will increase the CPU load. For more information about the "tune.ssl.default-dh-param" option please see the HAProxy Documentation.
]]> + + + haproxy.general.tuning.bufferSize + + text +
NOTE: It is strongly recommended not to change this from the default value, as very low values will break some services such as statistics, and values larger than default size will increase memory usage, possibly causing the system to run out of memory.
]]> + true + + + haproxy.general.tuning.checkBufferSize + + text + + true + + + haproxy.general.tuning.luaMaxMem + + text + + true + + + haproxy.general.tuning.spreadChecks + + text + + + + haproxy.general.tuning.customOptions + + textbox +
NOTE: The syntax will not be checked, use at your own risk!
]]> + true + + + + header + + + haproxy.general.tuning.ssl_defaultsEnabled + + checkbox + + + + haproxy.general.tuning.ssl_bindOptions + + select_multiple + + true + + + + haproxy.general.tuning.ssl_cipherList + + text + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml deleted file mode 100644 index 15e2cbc43..000000000 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml +++ /dev/null @@ -1,348 +0,0 @@ -
- - - - haproxy.general.enabled - - checkbox - Enable or disable the HAProxy service. - - - haproxy.general.gracefulStop - - checkbox - - - - haproxy.general.seamlessReload - - checkbox - - - - haproxy.general.showIntro - - checkbox - - - - - - haproxy.general.peers.enabled - - checkbox - - - - - header - - - haproxy.general.peers.name1 - - text - - - - haproxy.general.peers.listen1 - - text - - - - haproxy.general.peers.port1 - - text - - - - - header - - - haproxy.general.peers.name2 - - text - - - - haproxy.general.peers.listen2 - - text - - - - haproxy.general.peers.port2 - - text - - - - - - - info - - - haproxy.general.tuning.root - - checkbox -
NOTE: Enabling root could be a security issue but it's required by some feature.
]]> - true - - - haproxy.general.tuning.nbproc - - text -
NOTE: You may experience random issues in multi-process mode. For more information about the "nbproc" option please see the HAProxy Documentation.
]]> - true - - - haproxy.general.tuning.nbthread - - text - - - - haproxy.general.tuning.maxConnections - - text -
NOTE: HAProxy will not be able to allocate enough memory if you set this value too high. Consider raising the settings for kern.maxfiles and kern.maxfilesperproc if you need to specify a non-default value.
]]> - - - haproxy.general.tuning.sslServerVerify - - dropdown - - - - haproxy.general.tuning.maxDHSize - - text -
NOTE: Higher values will increase the CPU load. For more information about the "tune.ssl.default-dh-param" option please see the HAProxy Documentation.
]]> - - - haproxy.general.tuning.bufferSize - - text -
NOTE: It is strongly recommended not to change this from the default value, as very low values will break some services such as statistics, and values larger than default size will increase memory usage, possibly causing the system to run out of memory.
]]> - true - - - haproxy.general.tuning.checkBufferSize - - text - - true - - - haproxy.general.tuning.luaMaxMem - - text - - true - - - haproxy.general.tuning.spreadChecks - - text - - - - haproxy.general.tuning.customOptions - - textbox -
NOTE: The syntax will not be checked, use at your own risk!
]]> - true - - - - header - - - haproxy.general.tuning.ssl_defaultsEnabled - - checkbox - - - - haproxy.general.tuning.ssl_bindOptions - - select_multiple - - true - - - - haproxy.general.tuning.ssl_cipherList - - text - - - - - - - info - - - haproxy.general.defaults.maxConnections - - text - - - - haproxy.general.defaults.timeoutClient - - text - - - - haproxy.general.defaults.timeoutConnect - - text - - - - haproxy.general.defaults.timeoutCheck - - text - - - - haproxy.general.defaults.timeoutServer - - text - - - - haproxy.general.defaults.retries - - text - - - - haproxy.general.defaults.redispatch - - dropdown - - - - haproxy.general.defaults.customOptions - - textbox -
NOTE: The syntax will not be checked, use at your own risk!
]]> - true - - - - - haproxy.general.logging.host - - text - - - - haproxy.general.logging.facility - - dropdown - - - - haproxy.general.logging.level - - dropdown - - - - haproxy.general.logging.length - - text - - true - - - - - haproxy.general.stats.enabled - - checkbox - - - - haproxy.general.stats.port - - text - - true - - - haproxy.general.stats.remoteEnabled - - checkbox - This may be a security risk if you do not enable authentication! Note that you need to add appropiate firewall rules for this to work.]]> - - - haproxy.general.stats.remoteBind - - select_multiple - - true - - Enter address:port here. Finish with TAB. - - - haproxy.general.stats.authEnabled - - checkbox - - - haproxy.general.stats.allowedUsers - - select_multiple - true - Type username or choose from list. - - - haproxy.general.stats.allowedGroups - - select_multiple - true - Type group or choose from list. - - - haproxy.general.stats.customOptions - - textbox -
NOTE: The syntax will not be checked, use at your own risk!
]]> - true - - - - - haproxy.general.cache.enabled - - checkbox - - - - haproxy.general.cache.totalMaxSize - - text - - - - haproxy.general.cache.maxAge - - text - - - - haproxy.general.cache.maxObjectSize - - text - - - - -
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index e06699a61..914f3b74d 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1,6 +1,6 @@ //OPNsense/HAProxy - 2.8.0 + 2.10.0 the HAProxy load balancer @@ -199,6 +199,17 @@ redispatch on the 3rd retry prior to the last retry + + N + last,libc + Y + Y + + last + libc + none + + N @@ -792,6 +803,18 @@ Y N + + + + + Related resolver not found + N + N + /^((([0-9a-zA-Z._\-\*:]+)))*/u lower @@ -1829,6 +1852,7 @@ http-request header replace http-request header replace value http-request set-path + http-request set-var http-response allow http-response deny http-response lua script @@ -1837,7 +1861,8 @@ http-response header delete http-response header replace http-response header replace value - Set HTTP status code in response + http-response set-status + http-response set-var tcp-request connection accept tcp-request connection reject tcp-request content accept @@ -1934,6 +1959,25 @@ /^.{1,4096}$/u N + + N + txn + + variable is shared with the whole process + variable is shared with the whole session + variable is shared with the transaction (request/response) + variable is shared only during request processing + variable is shared only during response processing + + + + /^.{1,4096}$/u + N + + + /^.{1,4096}$/u + N + /^.{1,4096}$/u N @@ -1984,6 +2028,25 @@ /^.{1,4096}$/u N + + N + txn + + variable is shared with the whole process + variable is shared with the whole session + variable is shared with the transaction (request/response) + variable is shared only during request processing + variable is shared only during response processing + + + + /^.{1,4096}$/u + N + + + /^.{1,4096}$/u + N + /^.{1,4096}$/u N @@ -2179,6 +2242,10 @@ Y N + + 0 + N + @@ -2438,5 +2505,57 @@ + + + + Y + + + 1 + Y + + + /^[^\t^,^;^\.^\[^\]^\{^\}]{1,255}$/u + Should be a string between 1 and 255 characters. + Y + + + N + /^.{1,255}$/u + Should be a string between 1 and 255 characters. + + + N + Y + Y + /^((([0-9a-zA-Z._\-\*:\[\]]+:[0-9]+(-[0-9]+)?)([,]){0,1}))*/u + lower + Please provide a valid nameserver address, i.e. 127.0.0.1:53, [::1]:53 or 192.168.1.1:53. + + + 0 + Y + + + 3 + 0 + 100000 + Please specify a value between 0 and 100000. + N + + + 1s + /^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u + Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". + N + + + 1s + /^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u + Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". + N + + + diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml index 15829a646..750fe00af 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml @@ -20,6 +20,7 @@ + diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt index 6cc446097..59adaa892 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt @@ -31,6 +31,7 @@ POSSIBILITY OF SUCH DAMAGE. $( document ).ready(function() { + // get general HAProxy settings var data_get_map = {'frm_haproxy':"/api/haproxy/settings/get"}; // load initial data @@ -198,6 +199,19 @@ POSSIBILITY OF SUCH DAMAGE. } ); + $("#grid-resolvers").UIBootgrid( + { search:'/api/haproxy/settings/searchResolvers', + get:'/api/haproxy/settings/getResolver/', + set:'/api/haproxy/settings/setResolver/', + add:'/api/haproxy/settings/addResolver/', + del:'/api/haproxy/settings/delResolver/', + toggle:'/api/haproxy/settings/toggleResolver/', + options: { + rowCount:[10,25,50,100,500,1000] + } + } + ); + // hook into on-show event for dialog to extend layout. $('#DialogAcl').on('shown.bs.modal', function (e) { $("#acl\\.expression").change(function(){ @@ -285,7 +299,7 @@ POSSIBILITY OF SUCH DAMAGE. * Commands **********************************************************************/ - // Reconfigure haproxy - activate changes + // reconfigure haproxy to activate changes $('[id*="reconfigureAct"]').each(function(){ $(this).click(function(){ @@ -353,7 +367,7 @@ POSSIBILITY OF SUCH DAMAGE. }); }); - // Test configuration file + // test configuration file $('[id*="configtestAct"]').each(function(){ $(this).click(function(){ @@ -394,34 +408,115 @@ POSSIBILITY OF SUCH DAMAGE. }); }); - // form save event handlers for all defined forms - $('[id*="save_"]').each(function(){ + // save general settings and perform a config test + $('[id*="saveAndTestAct"]').each(function(){ $(this).click(function(){ - var frm_id = $(this).closest("form").attr("id"); - var frm_title = $(this).closest("form").attr("data-title"); + // extract the form id from the button id + var frm_id = "frm_" + $(this).attr("id").split('_')[1] - // set progress animation - $("#"+frm_id+"_progress").addClass("fa fa-spinner fa-pulse"); - - // save data for tab + // save data for this tab saveFormToEndpoint(url="/api/haproxy/settings/set",formid=frm_id,callback_ok=function(){ + // set progress animation + $('[id*="saveAndTestAct_progress"]').each(function(){ + $(this).addClass("fa fa-spinner fa-pulse"); + }); - // on correct save, perform reconfigure - ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { - if (status != "success" || data['status'] != 'ok') { + // on correct save, perform config test + ajaxCall(url="/api/haproxy/service/configtest", sendData={}, callback=function(data,status) { + if (data['result'].indexOf('ALERT') > -1) { BootstrapDialog.show({ - type: BootstrapDialog.TYPE_WARNING, - title: "{{ lang._('Error reconfiguring HAProxy') }}", - message: data['status'], + type: BootstrapDialog.TYPE_DANGER, + title: "{{ lang._('HAProxy config contains critical errors') }}", + message: data['result'], draggable: true }); - } else { - ajaxCall(url="/api/haproxy/service/status", sendData={}, callback=function(data,status) { - updateServiceStatusUI(data['status']); + } else if (data['result'].indexOf('WARNING') > -1) { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('HAProxy config contains minor errors') }}", + message: data['result'], + draggable: true }); } - // when done, disable progress animation. - $("#"+frm_id+"_progress").removeClass("fa fa-spinner fa-pulse"); + // when done, disable progress animation + $('[id*="saveAndTestAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + }); + }); + }); + }); + + // save general settings and reconfigure HAProxy + $('[id*="saveAndReconfigureAct"]').each(function(){ + $(this).click(function(){ + // extract the form id from the button id + var frm_id = "frm_" + $(this).attr("id").split('_')[1] + + // save data for this tab + saveFormToEndpoint(url="/api/haproxy/settings/set",formid=frm_id,callback_ok=function(){ + // set progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).addClass("fa fa-spinner fa-pulse"); + }); + + // on correct save, perform config test + ajaxCall(url="/api/haproxy/service/configtest", sendData={}, callback=function(data,status) { + // show warning in case of critical errors + if (data['result'].indexOf('ALERT') > -1) { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_DANGER, + title: "{{ lang._('HAProxy config contains critical errors') }}", + message: "{{ lang._('The HAProxy service may not be able to start due to critical errors. Try anyway?') }}", + buttons: [{ + label: '{{ lang._('Continue') }}', + cssClass: 'btn-primary', + action: function(dlg){ + ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { + if (status != "success" || data['status'] != 'ok') { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('Error reconfiguring HAProxy') }}", + message: data['status'], + draggable: true + }); + } + }); + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + dlg.close(); + } + }, { + icon: 'fa fa-trash-o', + label: '{{ lang._('Abort') }}', + action: function(dlg){ + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + dlg.close(); + } + }] + }); + } else { + ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { + if (status != "success" || data['status'] != 'ok') { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('Error reconfiguring HAProxy') }}", + message: data['status'], + draggable: true + }); + } + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + }); + } + //}); }); }); @@ -500,30 +595,24 @@ POSSIBILITY OF SUCH DAMAGE. - {# add automatically generated tabs #} - {% for tab in mainForm['tabs']|default([]) %} - {% if tab['subtabs']|default(false) %} - {# Tab with dropdown #} - - {% else %} - {# Standard Tab #} -
  • - - {{tab[1]}} - -
    • - {% endif %} - {% endfor %} +
  • {{ lang._('Lua Scripts') }}
  • {{ lang._('Map Files') }}
  • {{ lang._('CPU Affinity Rules') }}
    • +
  • {{ lang._('Resolvers') }}
    • @@ -552,7 +642,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._('Add %sReal Servers:%s All physical or virtual servers that HAProxy should use to load balance between or proxy to.') | format('', '') }}
  • {{ lang._('Add %sBackend Pools:%s Group the previously added servers to build a server farm. All servers in a group usually deliver the same content. The Backend Pool takes care of health monitoring and load distribution. A Backend Pool must be configured even if you only have a single server.') | format('', '')}}
  • {{ lang._('Add %sPublic Services:%s The Public Service listens for client connections, optionally applies rules and forwards client request data to the selected Backend Pool for load balancing or proxying.') | format('', '') }}
    • -
  • {{ lang._('Lastly, enable HAProxy using the %sService Settings%s.') | format('', '') }}
    • +
  • {{ lang._('Lastly, enable HAProxy using the %sService%s settings page.') | format('', '') }}

    • {{ lang._('Please be aware that you need to %smanually%s add the required firewall rules for all configured services.') | format('', '') }}

    {{ lang._('Further information is available in our %sHAProxy plugin documentation%s and of course in the %sofficial HAProxy documentation%s. Be sure to report bugs and request features on our %sGitHub issue page%s. Code contributions are also very welcome!') | format('', '', '', '', '', '') }}

    @@ -617,6 +707,24 @@ POSSIBILITY OF SUCH DAMAGE. +
    +
    +

    {{ lang._('Settings') }}

    +

    {{ lang._("Manage HAProxy core configuration:") }}

    +
      +
    • {{ lang._("%sService:%s Basic service management and options to control HAProxy's restart behaviour.") | format('', '') }}
      • +
    • {{ lang._("%sGlobal Parameters:%s Tuning parameters and global defaults that cannot be overriden elsewhere.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sDefault Parameters:%s Define default parameters for all %sPublic Services%s, %sBackend Pools%s and %sReal Servers%s here. They may be overriden elsewhere.") | format('', '', '', '', '', '', '', '', '', '', '', '') }}
      • +
    • {{ lang._("%sLogging:%s Configure HAProxy's logging behaviour and enable remote logging.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sStatistics:%s This manages HAProxy's internal statistics reporting.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sCache:%s HAProxy's cache which was designed to perform cache on small objects (favicon, css, etc.). This is a minimalist low-maintenance cache which runs in RAM.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sPeers:%s Configure a communication channel between two HAProxy instances. This will propagate entries of any data-types in stick-tables between these HAProxy instances over TCP connections in a multi-master fashion. Useful when aiming for a seamless failover in a HA setup.") | format('', '', '', '') }}
      • +
    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sStatistics%s, %sCache%s and %sPeers%s features.") | format('', '', '', '', '', '') }}

    +
    +
    +
    +

    {{ lang._('Advanced Features') }}

    @@ -626,31 +734,14 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._("%sLua scripts:%s Include your own Lua code/scripts to extend HAProxy's functionality. The Lua code can be used in certain %sRules%s, for example.") | format('', '', '', '') }}
  • {{ lang._("%sMap Files:%s A map allows to map a data in input to an other one on output. For example, this makes it possible to map a large number of domains to backend pools without using the GUI. Map files need to be used in %sRules%s, otherwise they are ignored.") | format('', '', '', '') }}
  • {{ lang._("%sCPU Affinity Rules:%s This feature makes it possible to bind HAProxy's processes/threads to a specific CPU (or a CPU set). Furthermore it is possible to select CPU Affinity Rules in %sPublic Services%s to restrict them to a certain set of processes/threads/CPUs.") | format('', '', '', '') }}
    • +
  • {{ lang._("%sResolvers:%s This feature allows in-depth configuration of how HAProxy handles name resolution and interacts with name resolvers (DNS). Each resolver configuration can be used in %sBackend Pools%s to apply individual name resolution configurations.") | format('', '', '', '') }}
    • -

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '') }}

    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s. A detailed explanation of the resolvers feature can be found %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '','', '') }}


    - {# add automatically generated tabs #} - {% for tab in mainForm['tabs']|default([]) %} - {% if tab['subtabs']|default(false) %} - {# Tab with dropdown #} - {% for subtab in tab['subtabs']|default({})%} -
    - {{ partial("layout_partials/base_form",['fields':subtab[2],'id':'frm_'~subtab[0],'data_title':subtab[1],'apply_btn_id':'save_'~subtab[0]])}} -
    - {% endfor %} - {% endif %} - {% if tab['subtabs']|default(false)==false %} -
    - {{ partial("layout_partials/base_form",['fields':tab[2],'id':'frm_'~tab[0],'apply_btn_id':'save_'~tab[0]])}} -
    - {% endif %} - {% endfor %} -
    - @@ -674,7 +765,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -685,7 +775,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -709,7 +798,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -720,7 +808,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -746,7 +833,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -757,7 +843,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -780,7 +865,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -791,7 +875,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -814,7 +897,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -825,7 +907,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -848,7 +929,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -859,7 +939,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -883,7 +962,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -894,7 +972,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -918,7 +995,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -929,7 +1005,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -953,7 +1028,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -964,7 +1038,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -987,7 +1060,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -998,7 +1070,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1021,7 +1092,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1032,7 +1102,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1058,7 +1127,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1067,6 +1135,117 @@ POSSIBILITY OF SUCH DAMAGE.
    + +
    + + + + + + + + + + + + + + + + + + + +
    {{ lang._('Resolver ID') }}{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Nameservers') }}{{ lang._('Commands') }}{{ lang._('ID') }}
    + + +
    +
    +
    + + +
    +
    +
    +
    + + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalSettingsForm,'id':'frm_haproxy-general-settings'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalTuningForm,'id':'frm_haproxy-general-tuning'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalDefaultsForm,'id':'frm_haproxy-general-defaults'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalLoggingForm,'id':'frm_haproxy-general-logging'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalStatsForm,'id':'frm_haproxy-general-stats'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalCacheForm,'id':'frm_haproxy-general-cache'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalPeersForm,'id':'frm_haproxy-general-peers'])}} +
    +
    + + +
    +
    +
    {# include dialogs #} @@ -1082,3 +1261,4 @@ POSSIBILITY OF SUCH DAMAGE. {{ partial("layout_partials/base_dialog",['fields':formDialogErrorfile,'id':'DialogErrorfile','label':lang._('Edit Error Message')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogMapfile,'id':'DialogMapfile','label':lang._('Edit Map File')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogCpu,'id':'DialogCpu','label':lang._('Edit CPU Affinity Rule')])}} +{{ partial("layout_partials/base_dialog",['fields':formDialogResolver,'id':'DialogResolver','label':lang._('Edit Resolver')])}} diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index d3d429689..10dd9c495 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -44,7 +44,6 @@ {# # remember all ACLs to avoid duplicate declarations #} {% set acls_seen = [] %} {% set global_action_options = [] %} -{% set global_use_options = [] %} {% for action in linkedData.split(",") %} {% set action_data = helpers.getUUID(action) %} {# # collect ACLs for this action #} @@ -307,11 +306,10 @@ {% if acl_errors|int == 0 %} {% set action_enabled = '1' %} {% set action_options = [] %} -{% set use_options = [] %} {% if action_data.type == 'use_backend' %} {% if action_data.use_backend|default("") != "" %} {% set acl_backend_data = helpers.getUUID(action_data.use_backend) %} -{% do use_options.append('use_backend ' ~ acl_backend_data.name) %} +{% do action_options.append('use_backend ' ~ acl_backend_data.name) %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -319,7 +317,7 @@ {% elif action_data.type == 'use_server' %} {% if action_data.use_server|default("") != "" %} {% set server_data = helpers.getUUID(action_data.use_server) %} -{% do use_options.append('use-server ' ~ server_data.name) %} +{% do action_options.append('use-server ' ~ server_data.name) %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -337,7 +335,7 @@ {% set defaultbackend_option = '' %} {% endif %} {# # Finally add map file to config #} -{% do use_options.append('use_backend %[req.hdr(host),lower,map_dom(' ~ mapfile_path ~ defaultbackend_option ~ ')]') %} +{% do action_options.append('use_backend %[req.hdr(host),lower,map_dom(' ~ mapfile_path ~ defaultbackend_option ~ ')]') %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -417,6 +415,13 @@ {% set action_enabled = '0' %} # ERROR: missing parameters {% endif %} +{% elif action_data.type == 'http-request_set-var' %} +{% if action_data.http_request_set_var_scope|default("") != "" and action_data.http_request_set_var_name|default("") != "" and action_data.http_request_set_var_expr|default("") != "" %} +{% do action_options.append('http-request set-var(' ~ action_data.http_request_set_var_scope ~ '.' ~ action_data.http_request_set_var_name ~ ') ' ~ action_data.http_request_set_var_expr) %} +{% else %} +{% set action_enabled = '0' %} + # ERROR: missing parameters +{% endif %} {% elif action_data.type == 'http-response_allow' %} {% do action_options.append('http-response allow') %} {% elif action_data.type == 'http-response_deny' %} @@ -475,6 +480,13 @@ {% set action_enabled = '0' %} # ERROR: missing parameters {% endif %} +{% elif action_data.type == 'http-response_set-var' %} +{% if action_data.http_response_set_var_scope|default("") != "" and action_data.http_response_set_var_name|default("") != "" and action_data.http_response_set_var_expr|default("") != "" %} +{% do action_options.append('http-response set-var(' ~ action_data.http_response_set_var_scope ~ '.' ~ action_data.http_response_set_var_name ~ ') ' ~ action_data.http_response_set_var_expr) %} +{% else %} +{% set action_enabled = '0' %} + # ERROR: missing parameters +{% endif %} {% elif action_data.type == 'tcp-request_connection_accept' %} {% do action_options.append('tcp-request connection accept') %} {% elif action_data.type == 'tcp-request_connection_reject' %} @@ -554,10 +566,6 @@ {% do global_action_options.append(comment_lines|join('\n')) %} {% do global_action_options.append(([action_options|join(' '), acl_line]|join(' '))) %} {% endif %} -{% if use_options|length > 0 %} -{% do global_use_options.append(comment_lines|join('\n')) %} -{% do global_use_options.append(([use_options|join(' '), acl_line]|join(' '))) %} -{% endif %} {% else %} # ACTION INVALID: {{action_data.name}} {% endif %} @@ -569,10 +577,6 @@ {% if global_action_options|length > 0 %} {{global_action_options|join('\n' + ' ')}} - -{% endif %} -{% if global_use_options|length > 0 %} - {{global_use_options|join('\n' + ' ')}} {% endif %} {% else %} # ERROR: AclsAndActions called with empty data @@ -725,7 +729,7 @@ {% endif %} {% endfor %} {% else %} - # WARNING: UserlistAddUsers called with empty user data + # NOTE: UserlistAddUsers called with empty user data {% endif %} {# # process all group members #} {% if linkedGroupData is defined %} @@ -754,20 +758,32 @@ {% endif %} {% endfor %} {% else %} - # WARNING: UserlistAddUsers called with empty group data + # NOTE: UserlistAddUsers called with empty group data {% endif %} {%- endmacro %} -{# Macro expects a backend or frontend object. #} -{% macro AddUserlist(proxy) -%} -{% if proxy is defined %} -{% if (proxy.enabled|default("") == '1' and proxy.mode|default("") == 'http' and proxy.basicAuthEnabled|default("") == '1') %} +{# Macro expects a backend/frontend (type 1) or group object (type 2). #} +{% macro AddUserlist(type,object) -%} +{% if (type == '1' and object is defined) %} +{# # frontend/backend object #} +{% if (object.enabled|default("") == '1' and object.mode|default("") == 'http' and object.basicAuthEnabled|default("") == '1') %} {# # call macro to generate list of unique users #} -{% set userlist_result = UserlistAddUsers(proxy.basicAuthUsers,proxy.basicAuthGroups) %} +{% set userlist_result = UserlistAddUsers(object.basicAuthUsers,object.basicAuthGroups) %} {# # check result, skip when empty #} {% if (userlist_result is defined and userlist_result|default("") != "" )%} -userlist list_{{proxy.id}} - # Origin: {{proxy.name}} +userlist list_{{object.id}} + # Origin: {{object.name}} +{{userlist_result}} +{% endif %} +{% endif %} +{% elif (type == '2' and object is defined) %} +{# # group object #} +{% if (object.enabled|default("") == '1' and object.add_userlist|default("") == '1') %} +{# # call macro to generate list of unique users #} +{% set userlist_result = UserlistAddUsers(object.members) %} +{# # check result, skip when empty #} +{% if (userlist_result is defined and userlist_result|default("") != "" ) %} +userlist {{object.name | regex_replace ("[^A-Za-z0-9]","")}} {{userlist_result}} {% endif %} {% endif %} @@ -917,6 +933,9 @@ defaults {% if OPNsense.HAProxy.general.defaults.retries|default("") != "" %} retries {{OPNsense.HAProxy.general.defaults.retries}} {% endif %} +{% if OPNsense.HAProxy.general.defaults.init_addr|default("") != "" %} + default-server init-addr {{OPNsense.HAProxy.general.defaults.init_addr}} +{% endif %} {% if OPNsense.HAProxy.general.defaults.customOptions|default("") != "" %} # WARNING: pass through options below this line {% for customOpt in OPNsense.HAProxy.general.defaults.customOptions.split("\n") %} @@ -947,17 +966,25 @@ userlist acl_{{acl.id}} {% endfor %} {% endif %} +{% if helpers.exists('OPNsense.HAProxy.groups') %} +# userlists generated from groups +{% for group in helpers.toList('OPNsense.HAProxy.groups.group') %} +{# # call macro to generate userlist #} +{{ AddUserlist('2',group) -}} +{% endfor %} +{% endif %} + # autogenerated entries for config in backends/frontends {% if helpers.exists('OPNsense.HAProxy.frontends') %} {% for frontend in helpers.toList('OPNsense.HAProxy.frontends.frontend') %} {# # call macro to generate userlist #} -{{ AddUserlist(frontend) -}} +{{ AddUserlist('1',frontend) -}} {% endfor %} {% endif %} {% if helpers.exists('OPNsense.HAProxy.backends') %} {% for backend in helpers.toList('OPNsense.HAProxy.backends.backend') %} {# # call macro to generate userlist #} -{{ AddUserlist(backend) -}} +{{ AddUserlist('1',backend) -}} {% endfor %} {% endif %} @@ -974,6 +1001,40 @@ userlist stats_auth {% endif %} {% endif %} +{# ############################### #} +{# RESOLVERS #} +{# ############################### #} + +{% if helpers.exists('OPNsense.HAProxy.resolvers') %} +{% for resolver in helpers.toList('OPNsense.HAProxy.resolvers.resolver') %} +{% if resolver.enabled == '1' %} +# Resolver: {{resolver.name}} +resolvers {{resolver.id}} +{% if resolver.nameservers|default("") != "" %} +{% for nameserver in resolver.nameservers.split(",") %} + nameserver {{nameserver}} {{nameserver}} +{% endfor %} +{% endif %} +{% if resolver.parse_resolv_conf|default("") == "1" %} + parse-resolv-conf +{% endif %} +{% if resolver.resolve_retries|default("") != "" %} + resolve_retries {{resolver.resolve_retries}} +{% endif %} +{% if resolver.timeout_resolve|default("") != "" %} + timeout resolve {{resolver.timeout_resolve}} +{% endif %} +{% if resolver.timeout_retry|default("") != "" %} + timeout retry {{resolver.timeout_retry}} +{% endif %} + +{% else %} +# Resolver (DISABLED): {{resolver.name}} + +{% endif %} +{% endfor %} +{%- endif -%} + {# ############################### #} {# FRONTENDS #} {# ############################### #} @@ -1430,6 +1491,11 @@ backend {{backend.name}} {% do server_options.append('verify none') %} {% endif %} {% endif %} +{# # resolver #} +{% if backend.linkedResolver|default("") != "" %} +{% set resolver_data = helpers.getUUID(backend.linkedResolver) %} +{% do server_options.append('resolvers ' ~ resolver_data.id) %} +{% endif %} {# # source address #} {% if backend.source|default("") != "" %} {# # prefer backend configuration #}