From 1685999b9dd5cc659d99901d2eada79a8fa98c16 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Fri, 24 Jul 2020 23:23:30 +0200 Subject: [PATCH 1/8] net/haproxy: honor sort order of all rules, fixes #1925, refs #999 This partially reverts 1f9250e15bdca9601535378b8a5b72fa3ab557f6. --- .../templates/OPNsense/HAProxy/haproxy.conf | 16 +++------------- 1 file changed, 3 insertions(+), 13 deletions(-) diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index d3d429689..bb61aa948 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -44,7 +44,6 @@ {# # remember all ACLs to avoid duplicate declarations #} {% set acls_seen = [] %} {% set global_action_options = [] %} -{% set global_use_options = [] %} {% for action in linkedData.split(",") %} {% set action_data = helpers.getUUID(action) %} {# # collect ACLs for this action #} @@ -307,11 +306,10 @@ {% if acl_errors|int == 0 %} {% set action_enabled = '1' %} {% set action_options = [] %} -{% set use_options = [] %} {% if action_data.type == 'use_backend' %} {% if action_data.use_backend|default("") != "" %} {% set acl_backend_data = helpers.getUUID(action_data.use_backend) %} -{% do use_options.append('use_backend ' ~ acl_backend_data.name) %} +{% do action_options.append('use_backend ' ~ acl_backend_data.name) %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -319,7 +317,7 @@ {% elif action_data.type == 'use_server' %} {% if action_data.use_server|default("") != "" %} {% set server_data = helpers.getUUID(action_data.use_server) %} -{% do use_options.append('use-server ' ~ server_data.name) %} +{% do action_options.append('use-server ' ~ server_data.name) %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -337,7 +335,7 @@ {% set defaultbackend_option = '' %} {% endif %} {# # Finally add map file to config #} -{% do use_options.append('use_backend %[req.hdr(host),lower,map_dom(' ~ mapfile_path ~ defaultbackend_option ~ ')]') %} +{% do action_options.append('use_backend %[req.hdr(host),lower,map_dom(' ~ mapfile_path ~ defaultbackend_option ~ ')]') %} {% else %} {% set action_enabled = '0' %} # ERROR: missing parameters @@ -554,10 +552,6 @@ {% do global_action_options.append(comment_lines|join('\n')) %} {% do global_action_options.append(([action_options|join(' '), acl_line]|join(' '))) %} {% endif %} -{% if use_options|length > 0 %} -{% do global_use_options.append(comment_lines|join('\n')) %} -{% do global_use_options.append(([use_options|join(' '), acl_line]|join(' '))) %} -{% endif %} {% else %} # ACTION INVALID: {{action_data.name}} {% endif %} @@ -569,10 +563,6 @@ {% if global_action_options|length > 0 %} {{global_action_options|join('\n' + ' ')}} - -{% endif %} -{% if global_use_options|length > 0 %} - {{global_use_options|join('\n' + ' ')}} {% endif %} {% else %} # ERROR: AclsAndActions called with empty data From d90832d346c023ebab34c8fd535f521c79811fe9 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 26 Jul 2020 17:09:43 +0200 Subject: [PATCH 2/8] net/haproxy: bump version --- net/haproxy/Makefile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/haproxy/Makefile b/net/haproxy/Makefile index b07f11984..13cc033de 100644 --- a/net/haproxy/Makefile +++ b/net/haproxy/Makefile @@ -1,5 +1,5 @@ PLUGIN_NAME= haproxy -PLUGIN_VERSION= 2.23 +PLUGIN_VERSION= 2.24 PLUGIN_COMMENT= Reliable, high performance TCP/HTTP load balancer PLUGIN_DEPENDS= haproxy PLUGIN_MAINTAINER= opnsense@moov.de From 903e64c4481f0c4eae239d41f4dd91130a911684 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 26 Jul 2020 17:51:56 +0200 Subject: [PATCH 3/8] net/haproxy: add http-[request|response] set-var, refs #1796 --- .../OPNsense/HAProxy/forms/dialogAction.xml | 44 +++++++++++++++++++ .../app/models/OPNsense/HAProxy/HAProxy.xml | 42 +++++++++++++++++- .../templates/OPNsense/HAProxy/haproxy.conf | 14 ++++++ 3 files changed, 99 insertions(+), 1 deletion(-) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml index 5a7881def..c10565e9f 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogAction.xml @@ -203,6 +203,28 @@ text + + + header + + + + action.http_request_set_var_scope + + dropdown + + + + action.http_request_set_var_name + + text + + + action.http_request_set_var_expr + + text + + header @@ -310,6 +332,28 @@ text + + + header + + + + action.http_response_set_var_scope + + dropdown + + + + action.http_response_set_var_name + + text + + + action.http_response_set_var_expr + + text + + header diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index e06699a61..d7968fcdf 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1829,6 +1829,7 @@ http-request header replace http-request header replace value http-request set-path + http-request set-var http-response allow http-response deny http-response lua script @@ -1837,7 +1838,8 @@ http-response header delete http-response header replace http-response header replace value - Set HTTP status code in response + http-response set-status + http-response set-var tcp-request connection accept tcp-request connection reject tcp-request content accept @@ -1934,6 +1936,25 @@ /^.{1,4096}$/u N + + N + txn + + variable is shared with the whole process + variable is shared with the whole session + variable is shared with the transaction (request/response) + variable is shared only during request processing + variable is shared only during response processing + + + + /^.{1,4096}$/u + N + + + /^.{1,4096}$/u + N + /^.{1,4096}$/u N @@ -1984,6 +2005,25 @@ /^.{1,4096}$/u N + + N + txn + + variable is shared with the whole process + variable is shared with the whole session + variable is shared with the transaction (request/response) + variable is shared only during request processing + variable is shared only during response processing + + + + /^.{1,4096}$/u + N + + + /^.{1,4096}$/u + N + /^.{1,4096}$/u N diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index bb61aa948..f1abab9d0 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -415,6 +415,13 @@ {% set action_enabled = '0' %} # ERROR: missing parameters {% endif %} +{% elif action_data.type == 'http-request_set-var' %} +{% if action_data.http_request_set_var_scope|default("") != "" and action_data.http_request_set_var_name|default("") != "" and action_data.http_request_set_var_expr|default("") != "" %} +{% do action_options.append('http-request set-var(' ~ action_data.http_request_set_var_scope ~ '.' ~ action_data.http_request_set_var_name ~ ') ' ~ action_data.http_request_set_var_expr) %} +{% else %} +{% set action_enabled = '0' %} + # ERROR: missing parameters +{% endif %} {% elif action_data.type == 'http-response_allow' %} {% do action_options.append('http-response allow') %} {% elif action_data.type == 'http-response_deny' %} @@ -473,6 +480,13 @@ {% set action_enabled = '0' %} # ERROR: missing parameters {% endif %} +{% elif action_data.type == 'http-response_set-var' %} +{% if action_data.http_response_set_var_scope|default("") != "" and action_data.http_response_set_var_name|default("") != "" and action_data.http_response_set_var_expr|default("") != "" %} +{% do action_options.append('http-response set-var(' ~ action_data.http_response_set_var_scope ~ '.' ~ action_data.http_response_set_var_name ~ ') ' ~ action_data.http_response_set_var_expr) %} +{% else %} +{% set action_enabled = '0' %} + # ERROR: missing parameters +{% endif %} {% elif action_data.type == 'tcp-request_connection_accept' %} {% do action_options.append('tcp-request connection accept') %} {% elif action_data.type == 'tcp-request_connection_reject' %} From d7be04b57e2f4959e253510c4ba7e2634c06d8ef Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Sun, 26 Jul 2020 23:23:07 +0200 Subject: [PATCH 4/8] net/haproxy: allow to add groups as userlists, refs #1796 --- .../OPNsense/HAProxy/forms/dialogGroup.xml | 6 +++ .../app/models/OPNsense/HAProxy/HAProxy.xml | 6 ++- .../templates/OPNsense/HAProxy/haproxy.conf | 42 ++++++++++++++----- 3 files changed, 42 insertions(+), 12 deletions(-) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml index d868a472d..dd8956ffb 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogGroup.xml @@ -24,4 +24,10 @@ true Type username or choose from list. + + group.add_userlist + + checkbox + Usually HAproxy userlists are created automatically in a context sensitive way. This option adds this group as userlist, so that it can be referenced in rules/conditions. All special and non-alphanumeric characters will be removed from the userlist name. + diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index d7968fcdf..584a74bba 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1,6 +1,6 @@ //OPNsense/HAProxy - 2.8.0 + 2.9.0 the HAProxy load balancer @@ -2219,6 +2219,10 @@ Y N + + 0 + N + diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index f1abab9d0..ac4f9d200 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -729,7 +729,7 @@ {% endif %} {% endfor %} {% else %} - # WARNING: UserlistAddUsers called with empty user data + # NOTE: UserlistAddUsers called with empty user data {% endif %} {# # process all group members #} {% if linkedGroupData is defined %} @@ -758,20 +758,32 @@ {% endif %} {% endfor %} {% else %} - # WARNING: UserlistAddUsers called with empty group data + # NOTE: UserlistAddUsers called with empty group data {% endif %} {%- endmacro %} -{# Macro expects a backend or frontend object. #} -{% macro AddUserlist(proxy) -%} -{% if proxy is defined %} -{% if (proxy.enabled|default("") == '1' and proxy.mode|default("") == 'http' and proxy.basicAuthEnabled|default("") == '1') %} +{# Macro expects a backend/frontend (type 1) or group object (type 2). #} +{% macro AddUserlist(type,object) -%} +{% if (type == '1' and object is defined) %} +{# # frontend/backend object #} +{% if (object.enabled|default("") == '1' and object.mode|default("") == 'http' and object.basicAuthEnabled|default("") == '1') %} {# # call macro to generate list of unique users #} -{% set userlist_result = UserlistAddUsers(proxy.basicAuthUsers,proxy.basicAuthGroups) %} +{% set userlist_result = UserlistAddUsers(object.basicAuthUsers,object.basicAuthGroups) %} {# # check result, skip when empty #} {% if (userlist_result is defined and userlist_result|default("") != "" )%} -userlist list_{{proxy.id}} - # Origin: {{proxy.name}} +userlist list_{{object.id}} + # Origin: {{object.name}} +{{userlist_result}} +{% endif %} +{% endif %} +{% elif (type == '2' and object is defined) %} +{# # group object #} +{% if (object.enabled|default("") == '1' and object.add_userlist|default("") == '1') %} +{# # call macro to generate list of unique users #} +{% set userlist_result = UserlistAddUsers(object.members) %} +{# # check result, skip when empty #} +{% if (userlist_result is defined and userlist_result|default("") != "" ) %} +userlist {{object.name | regex_replace ("[^A-Za-z0-9]","")}} {{userlist_result}} {% endif %} {% endif %} @@ -951,17 +963,25 @@ userlist acl_{{acl.id}} {% endfor %} {% endif %} +{% if helpers.exists('OPNsense.HAProxy.groups') %} +# userlists generated from groups +{% for group in helpers.toList('OPNsense.HAProxy.groups.group') %} +{# # call macro to generate userlist #} +{{ AddUserlist('2',group) -}} +{% endfor %} +{% endif %} + # autogenerated entries for config in backends/frontends {% if helpers.exists('OPNsense.HAProxy.frontends') %} {% for frontend in helpers.toList('OPNsense.HAProxy.frontends.frontend') %} {# # call macro to generate userlist #} -{{ AddUserlist(frontend) -}} +{{ AddUserlist('1',frontend) -}} {% endfor %} {% endif %} {% if helpers.exists('OPNsense.HAProxy.backends') %} {% for backend in helpers.toList('OPNsense.HAProxy.backends.backend') %} {# # call macro to generate userlist #} -{{ AddUserlist(backend) -}} +{{ AddUserlist('1',backend) -}} {% endfor %} {% endif %} From 89737ebe2c4a36ceb79a9ae48ec832452e983210 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 18 Aug 2020 17:40:21 +0200 Subject: [PATCH 5/8] net/haproxy: add support for resolvers, refs #1787 --- .../HAProxy/Api/SettingsController.php | 30 +++++++++ .../OPNsense/HAProxy/IndexController.php | 1 + .../OPNsense/HAProxy/forms/dialogBackend.xml | 7 ++ .../OPNsense/HAProxy/forms/dialogResolver.xml | 54 +++++++++++++++ .../app/models/OPNsense/HAProxy/HAProxy.xml | 66 ++++++++++++++++++- .../app/models/OPNsense/HAProxy/Menu/Menu.xml | 1 + .../mvc/app/views/OPNsense/HAProxy/index.volt | 53 ++++++++++++++- .../templates/OPNsense/HAProxy/haproxy.conf | 39 +++++++++++ 8 files changed, 249 insertions(+), 2 deletions(-) create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php index 7779d14d5..ef5f8f65d 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/Api/SettingsController.php @@ -379,4 +379,34 @@ class SettingsController extends ApiMutableModelControllerBase { return $this->searchBase('users.user', array('enabled', 'name', 'description'), 'name'); } + + public function getresolverAction($uuid = null) + { + return $this->getBase('resolver', 'resolvers.resolver', $uuid); + } + + public function setresolverAction($uuid) + { + return $this->setBase('resolver', 'resolvers.resolver', $uuid); + } + + public function addresolverAction() + { + return $this->addBase('resolver', 'resolvers.resolver'); + } + + public function delresolverAction($uuid) + { + return $this->delBase('resolvers.resolver', $uuid); + } + + public function toggleresolverAction($uuid, $enabled = null) + { + return $this->toggleBase('resolvers.resolver', $uuid); + } + + public function searchresolversAction() + { + return $this->searchBase('resolvers.resolver', array('enabled', 'name', 'nameservers'), 'name'); + } } diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php index 020301521..1209f8ad0 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php @@ -57,6 +57,7 @@ class IndexController extends \OPNsense\Base\IndexController $this->view->formDialogErrorfile = $this->getForm("dialogErrorfile"); $this->view->formDialogMapfile = $this->getForm("dialogMapfile"); $this->view->formDialogCpu = $this->getForm("dialogCpu"); + $this->view->formDialogResolver = $this->getForm("dialogResolver"); // set additional view parameters $mdlHAProxy = new \OPNsense\HAProxy\HAProxy(); $this->view->showIntro = (string)$mdlHAProxy->general->showIntro; diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml index 380bcd365..8d4479ef5 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml @@ -54,6 +54,13 @@ Type server name or choose from list. + + backend.linkedResolver + + dropdown + + true + backend.source diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml new file mode 100644 index 000000000..a604d7d6f --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogResolver.xml @@ -0,0 +1,54 @@ +
+ + resolver.enabled + + checkbox + Enable this resolver configuration. + + + resolver.name + + text + Choose a name for this resolver configuration. + + + resolver.description + + text + Choose a optional description for this resolver configuration. + + + resolver.nameservers + + select_multiple + + true + true + + Enter ip:port here. Finish with TAB. + + + resolver.parse_resolv_conf + + checkbox + Add all nameservers found in /etc/resolv.conf to this resolver configuration. + + + resolver.resolve_retries + + text + + + + resolver.timeout_resolve + + text + + + + resolver.timeout_retry + + text + + +
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 584a74bba..3628b1adc 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -1,6 +1,6 @@ //OPNsense/HAProxy - 2.9.0 + 2.10.0 the HAProxy load balancer @@ -792,6 +792,18 @@ Y N + + + + + Related resolver not found + N + N + /^((([0-9a-zA-Z._\-\*:]+)))*/u lower @@ -2482,5 +2494,57 @@ + + + + Y + + + 1 + Y + + + /^[^\t^,^;^\.^\[^\]^\{^\}]{1,255}$/u + Should be a string between 1 and 255 characters. + Y + + + N + /^.{1,255}$/u + Should be a string between 1 and 255 characters. + + + N + Y + Y + /^((([0-9a-zA-Z._\-\*:\[\]]+:[0-9]+(-[0-9]+)?)([,]){0,1}))*/u + lower + Please provide a valid nameserver address, i.e. 127.0.0.1:53, [::1]:53 or 192.168.1.1:53. + + + 0 + Y + + + 3 + 0 + 100000 + Please specify a value between 0 and 100000. + N + + + 1s + /^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u + Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". + N + + + 1s + /^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u + Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us". + N + + + diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml index 15829a646..750fe00af 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/Menu/Menu.xml @@ -20,6 +20,7 @@ + diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt index 6cc446097..3e4086172 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt @@ -198,6 +198,19 @@ POSSIBILITY OF SUCH DAMAGE. } ); + $("#grid-resolvers").UIBootgrid( + { search:'/api/haproxy/settings/searchResolvers', + get:'/api/haproxy/settings/getResolver/', + set:'/api/haproxy/settings/setResolver/', + add:'/api/haproxy/settings/addResolver/', + del:'/api/haproxy/settings/delResolver/', + toggle:'/api/haproxy/settings/toggleResolver/', + options: { + rowCount:[10,25,50,100,500,1000] + } + } + ); + // hook into on-show event for dialog to extend layout. $('#DialogAcl').on('shown.bs.modal', function (e) { $("#acl\\.expression").change(function(){ @@ -538,6 +551,7 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._('Lua Scripts') }}
  • {{ lang._('Map Files') }}
  • {{ lang._('CPU Affinity Rules') }}
    • +
  • {{ lang._('Resolvers') }}
    • @@ -626,8 +640,9 @@ POSSIBILITY OF SUCH DAMAGE.
  • {{ lang._("%sLua scripts:%s Include your own Lua code/scripts to extend HAProxy's functionality. The Lua code can be used in certain %sRules%s, for example.") | format('', '', '', '') }}
  • {{ lang._("%sMap Files:%s A map allows to map a data in input to an other one on output. For example, this makes it possible to map a large number of domains to backend pools without using the GUI. Map files need to be used in %sRules%s, otherwise they are ignored.") | format('', '', '', '') }}
  • {{ lang._("%sCPU Affinity Rules:%s This feature makes it possible to bind HAProxy's processes/threads to a specific CPU (or a CPU set). Furthermore it is possible to select CPU Affinity Rules in %sPublic Services%s to restrict them to a certain set of processes/threads/CPUs.") | format('', '', '', '') }}
    • +
  • {{ lang._("%sResolvers:%s This feature allows in-depth configuration of how HAProxy handles name resolution and interacts with name resolvers (DNS). Each resolver configuration can be used in %sBackend Pools%s to apply individual name resolution configurations.") | format('', '', '', '') }}
    • -

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '') }}

    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sError Messages%s, %sLua Script%s and the %sMap Files%s features. More information on HAProxy's CPU Affinity is also available %shere%s, %shere%s and %shere%s. A detailed explanation of the resolvers feature can be found %shere%s.") | format('', '', '', '', '', '' ,'', '' ,'', '' ,'', '','', '') }}


    @@ -1067,6 +1082,41 @@ POSSIBILITY OF SUCH DAMAGE.
    + +
    + + + + + + + + + + + + + + + + + + + + +
    {{ lang._('Resolver ID') }}{{ lang._('Enabled') }}{{ lang._('Name') }}{{ lang._('Nameservers') }}{{ lang._('Commands') }}{{ lang._('ID') }}
    + + +
    + +
    +
    + + +
    +
    +
    +
    {# include dialogs #} @@ -1082,3 +1132,4 @@ POSSIBILITY OF SUCH DAMAGE. {{ partial("layout_partials/base_dialog",['fields':formDialogErrorfile,'id':'DialogErrorfile','label':lang._('Edit Error Message')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogMapfile,'id':'DialogMapfile','label':lang._('Edit Map File')])}} {{ partial("layout_partials/base_dialog",['fields':formDialogCpu,'id':'DialogCpu','label':lang._('Edit CPU Affinity Rule')])}} +{{ partial("layout_partials/base_dialog",['fields':formDialogResolver,'id':'DialogResolver','label':lang._('Edit Resolver')])}} diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index ac4f9d200..68f053356 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -998,6 +998,40 @@ userlist stats_auth {% endif %} {% endif %} +{# ############################### #} +{# RESOLVERS #} +{# ############################### #} + +{% if helpers.exists('OPNsense.HAProxy.resolvers') %} +{% for resolver in helpers.toList('OPNsense.HAProxy.resolvers.resolver') %} +{% if resolver.enabled == '1' %} +# Resolver: {{resolver.name}} +resolvers {{resolver.id}} +{% if resolver.nameservers|default("") != "" %} +{% for nameserver in resolver.nameservers.split(",") %} + nameserver {{nameserver}} {{nameserver}} +{% endfor %} +{% endif %} +{% if resolver.parse_resolv_conf|default("") == "1" %} + parse-resolv-conf +{% endif %} +{% if resolver.resolve_retries|default("") != "" %} + resolve_retries {{resolver.resolve_retries}} +{% endif %} +{% if resolver.timeout_resolve|default("") != "" %} + timeout resolve {{resolver.timeout_resolve}} +{% endif %} +{% if resolver.timeout_retry|default("") != "" %} + timeout retry {{resolver.timeout_retry}} +{% endif %} + +{% else %} +# Resolver (DISABLED): {{resolver.name}} + +{% endif %} +{% endfor %} +{%- endif -%} + {# ############################### #} {# FRONTENDS #} {# ############################### #} @@ -1454,6 +1488,11 @@ backend {{backend.name}} {% do server_options.append('verify none') %} {% endif %} {% endif %} +{# # resolver #} +{% if backend.linkedResolver|default("") != "" %} +{% set resolver_data = helpers.getUUID(backend.linkedResolver) %} +{% do server_options.append('resolvers ' ~ resolver_data.id) %} +{% endif %} {# # source address #} {% if backend.source|default("") != "" %} {# # prefer backend configuration #} From 66608b9dc99c53fab85e25dfdb6a5015d73be007 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Tue, 18 Aug 2020 18:05:01 +0200 Subject: [PATCH 6/8] net/haproxy: add support for init-addr, fixes #1787 --- .../app/controllers/OPNsense/HAProxy/forms/main.xml | 8 ++++++++ .../mvc/app/models/OPNsense/HAProxy/HAProxy.xml | 11 +++++++++++ .../service/templates/OPNsense/HAProxy/haproxy.conf | 3 +++ 3 files changed, 22 insertions(+) diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml index 15e2cbc43..c7145c790 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml @@ -227,6 +227,14 @@ dropdown     + + haproxy.general.defaults.init_addr + + select_multiple + + true + + haproxy.general.defaults.customOptions diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml index 3628b1adc..914f3b74d 100644 --- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml +++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml @@ -199,6 +199,17 @@ redispatch on the 3rd retry prior to the last retry + + N + last,libc + Y + Y + + last + libc + none + + N diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf index 68f053356..10dd9c495 100644 --- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf +++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf @@ -933,6 +933,9 @@ defaults {% if OPNsense.HAProxy.general.defaults.retries|default("") != "" %} retries {{OPNsense.HAProxy.general.defaults.retries}} {% endif %} +{% if OPNsense.HAProxy.general.defaults.init_addr|default("") != "" %} + default-server init-addr {{OPNsense.HAProxy.general.defaults.init_addr}} +{% endif %} {% if OPNsense.HAProxy.general.defaults.customOptions|default("") != "" %} # WARNING: pass through options below this line {% for customOpt in OPNsense.HAProxy.general.defaults.customOptions.split("\n") %} From 890394928ad884debdd233312b2f28f3a646fc38 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 20 Aug 2020 00:06:44 +0200 Subject: [PATCH 7/8] net/haproxy: streamline "settings" page, improve inline help, add new button --- .../OPNsense/HAProxy/IndexController.php | 28 +- .../OPNsense/HAProxy/forms/generalCache.xml | 30 ++ .../HAProxy/forms/generalDefaults.xml | 63 ++++ .../OPNsense/HAProxy/forms/generalLogging.xml | 31 ++ .../OPNsense/HAProxy/forms/generalPeers.xml | 56 +++ .../HAProxy/forms/generalSettings.xml | 30 ++ .../OPNsense/HAProxy/forms/generalStats.xml | 60 +++ .../OPNsense/HAProxy/forms/generalTuning.xml | 102 +++++ .../OPNsense/HAProxy/forms/main.xml | 356 ------------------ .../mvc/app/views/OPNsense/HAProxy/index.volt | 307 ++++++++++----- 10 files changed, 607 insertions(+), 456 deletions(-) create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml create mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml delete mode 100644 net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php index 1209f8ad0..141fac3e5 100644 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/IndexController.php @@ -44,20 +44,26 @@ class IndexController extends \OPNsense\Base\IndexController public function indexAction() { // include form definitions - $this->view->mainForm = $this->getForm("main"); - $this->view->formDialogFrontend = $this->getForm("dialogFrontend"); - $this->view->formDialogBackend = $this->getForm("dialogBackend"); - $this->view->formDialogServer = $this->getForm("dialogServer"); - $this->view->formDialogHealthcheck = $this->getForm("dialogHealthcheck"); - $this->view->formDialogAction = $this->getForm("dialogAction"); $this->view->formDialogAcl = $this->getForm("dialogAcl"); - $this->view->formDialogUser = $this->getForm("dialogUser"); - $this->view->formDialogGroup = $this->getForm("dialogGroup"); - $this->view->formDialogLua = $this->getForm("dialogLua"); - $this->view->formDialogErrorfile = $this->getForm("dialogErrorfile"); - $this->view->formDialogMapfile = $this->getForm("dialogMapfile"); + $this->view->formDialogAction = $this->getForm("dialogAction"); + $this->view->formDialogBackend = $this->getForm("dialogBackend"); $this->view->formDialogCpu = $this->getForm("dialogCpu"); + $this->view->formDialogErrorfile = $this->getForm("dialogErrorfile"); + $this->view->formDialogFrontend = $this->getForm("dialogFrontend"); + $this->view->formDialogGroup = $this->getForm("dialogGroup"); + $this->view->formDialogHealthcheck = $this->getForm("dialogHealthcheck"); + $this->view->formDialogLua = $this->getForm("dialogLua"); + $this->view->formDialogMapfile = $this->getForm("dialogMapfile"); $this->view->formDialogResolver = $this->getForm("dialogResolver"); + $this->view->formDialogServer = $this->getForm("dialogServer"); + $this->view->formDialogUser = $this->getForm("dialogUser"); + $this->view->generalCacheForm = $this->getForm("generalCache"); + $this->view->generalDefaultsForm = $this->getForm("generalDefaults"); + $this->view->generalLoggingForm = $this->getForm("generalLogging"); + $this->view->generalPeersForm = $this->getForm("generalPeers"); + $this->view->generalSettingsForm = $this->getForm("generalSettings"); + $this->view->generalStatsForm = $this->getForm("generalStats"); + $this->view->generalTuningForm = $this->getForm("generalTuning"); // set additional view parameters $mdlHAProxy = new \OPNsense\HAProxy\HAProxy(); $this->view->showIntro = (string)$mdlHAProxy->general->showIntro; diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml new file mode 100644 index 000000000..d9fd948b3 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalCache.xml @@ -0,0 +1,30 @@ +
    + + + header + + + haproxy.general.cache.enabled + + checkbox + + + + haproxy.general.cache.totalMaxSize + + text + + + + haproxy.general.cache.maxAge + + text + + + + haproxy.general.cache.maxObjectSize + + text + + +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml new file mode 100644 index 000000000..4a44e0aee --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalDefaults.xml @@ -0,0 +1,63 @@ +
    + + + header + + + haproxy.general.defaults.maxConnections + + text + + + + haproxy.general.defaults.timeoutClient + + text + + + + haproxy.general.defaults.timeoutConnect + + text + + + + haproxy.general.defaults.timeoutCheck + + text + + + + haproxy.general.defaults.timeoutServer + + text + + + + haproxy.general.defaults.retries + + text + + + + haproxy.general.defaults.redispatch + + dropdown + + + + haproxy.general.defaults.init_addr + + select_multiple + + true + + + + haproxy.general.defaults.customOptions + + textbox +
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     + true +     +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml new file mode 100644 index 000000000..cdc79ac14 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalLogging.xml @@ -0,0 +1,31 @@ +
    + + + header + + + haproxy.general.logging.host + + text + + + + haproxy.general.logging.facility + + dropdown + + + + haproxy.general.logging.level + + dropdown + + + + haproxy.general.logging.length + + text + + true + +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml new file mode 100644 index 000000000..f1091f4f3 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalPeers.xml @@ -0,0 +1,56 @@ +
    + + + header + + + haproxy.general.peers.enabled + + checkbox + + + + + header + + + haproxy.general.peers.name1 + + text + + + + haproxy.general.peers.listen1 + + text + + + + haproxy.general.peers.port1 + + text + + + + + header + + + haproxy.general.peers.name2 + + text + + + + haproxy.general.peers.listen2 + + text + + + + haproxy.general.peers.port2 + + text + + +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml new file mode 100644 index 000000000..78d7ce4b2 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalSettings.xml @@ -0,0 +1,30 @@ +
    + + + header + + + haproxy.general.enabled + + checkbox + Enable or disable the HAProxy service. + + + haproxy.general.gracefulStop + + checkbox + + + + haproxy.general.seamlessReload + + checkbox + + + + haproxy.general.showIntro + + checkbox + + +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml new file mode 100644 index 000000000..6832e1e17 --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalStats.xml @@ -0,0 +1,60 @@ +
    + + + header + + + haproxy.general.stats.enabled + + checkbox + + + + haproxy.general.stats.port + + text + + true + + + haproxy.general.stats.remoteEnabled + + checkbox + This may be a security risk if you do not enable authentication! Note that you need to add appropiate firewall rules for this to work.]]> + + + haproxy.general.stats.remoteBind + + select_multiple + + true + + Enter address:port here. Finish with TAB. + + + haproxy.general.stats.authEnabled + + checkbox + + + haproxy.general.stats.allowedUsers + + select_multiple + true + Type username or choose from list. + + + haproxy.general.stats.allowedGroups + + select_multiple + true + Type group or choose from list. + + + haproxy.general.stats.customOptions + + textbox +
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     + true +     +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml new file mode 100644 index 000000000..a5abb322c --- /dev/null +++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/generalTuning.xml @@ -0,0 +1,102 @@ +
    + + + header + + + haproxy.general.tuning.root + + checkbox +
    NOTE: Enabling root could be a security issue but it's required by some feature.
    ]]>     + true +     + + haproxy.general.tuning.nbproc + + text +
    NOTE: You may experience random issues in multi-process mode. For more information about the "nbproc" option please see the HAProxy Documentation.
    ]]>     + true +     + + haproxy.general.tuning.nbthread + + text + + + + haproxy.general.tuning.maxConnections + + text +
    NOTE: HAProxy will not be able to allocate enough memory if you set this value too high. Consider raising the settings for kern.maxfiles and kern.maxfilesperproc if you need to specify a non-default value.
    ]]>     +     + + haproxy.general.tuning.sslServerVerify + + dropdown + + + + haproxy.general.tuning.maxDHSize + + text +
    NOTE: Higher values will increase the CPU load. For more information about the "tune.ssl.default-dh-param" option please see the HAProxy Documentation.
    ]]>     +     + + haproxy.general.tuning.bufferSize + + text +
    NOTE: It is strongly recommended not to change this from the default value, as very low values will break some services such as statistics, and values larger than default size will increase memory usage, possibly causing the system to run out of memory.
    ]]>     + true +     + + haproxy.general.tuning.checkBufferSize + + text + + true + + + haproxy.general.tuning.luaMaxMem + + text + + true + + + haproxy.general.tuning.spreadChecks + + text + + + + haproxy.general.tuning.customOptions + + textbox +
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     + true +     + + + header + + + haproxy.general.tuning.ssl_defaultsEnabled + + checkbox + + + + haproxy.general.tuning.ssl_bindOptions + + select_multiple + + true + + + + haproxy.general.tuning.ssl_cipherList + + text + + +
    diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml deleted file mode 100644 index c7145c790..000000000 --- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml +++ /dev/null @@ -1,356 +0,0 @@ -
    - - - - haproxy.general.enabled - - checkbox - Enable or disable the HAProxy service. - - - haproxy.general.gracefulStop - - checkbox - - - - haproxy.general.seamlessReload - - checkbox - - - - haproxy.general.showIntro - - checkbox - - - - - - haproxy.general.peers.enabled - - checkbox - - - - - header - - - haproxy.general.peers.name1 - - text - - - - haproxy.general.peers.listen1 - - text - - - - haproxy.general.peers.port1 - - text - - - - - header - - - haproxy.general.peers.name2 - - text - - - - haproxy.general.peers.listen2 - - text - - - - haproxy.general.peers.port2 - - text - - - - - - - info - - - haproxy.general.tuning.root - - checkbox -
    NOTE: Enabling root could be a security issue but it's required by some feature.
    ]]>     - true -     - - haproxy.general.tuning.nbproc - - text -
    NOTE: You may experience random issues in multi-process mode. For more information about the "nbproc" option please see the HAProxy Documentation.
    ]]>     - true -     - - haproxy.general.tuning.nbthread - - text - - - - haproxy.general.tuning.maxConnections - - text -
    NOTE: HAProxy will not be able to allocate enough memory if you set this value too high. Consider raising the settings for kern.maxfiles and kern.maxfilesperproc if you need to specify a non-default value.
    ]]>     -     - - haproxy.general.tuning.sslServerVerify - - dropdown - - - - haproxy.general.tuning.maxDHSize - - text -
    NOTE: Higher values will increase the CPU load. For more information about the "tune.ssl.default-dh-param" option please see the HAProxy Documentation.
    ]]>     -     - - haproxy.general.tuning.bufferSize - - text -
    NOTE: It is strongly recommended not to change this from the default value, as very low values will break some services such as statistics, and values larger than default size will increase memory usage, possibly causing the system to run out of memory.
    ]]>     - true -     - - haproxy.general.tuning.checkBufferSize - - text - - true - - - haproxy.general.tuning.luaMaxMem - - text - - true - - - haproxy.general.tuning.spreadChecks - - text - - - - haproxy.general.tuning.customOptions - - textbox -
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     - true -     - - - header - - - haproxy.general.tuning.ssl_defaultsEnabled - - checkbox - - - - haproxy.general.tuning.ssl_bindOptions - - select_multiple - - true - - - - haproxy.general.tuning.ssl_cipherList - - text - - -     - - - - info - - - haproxy.general.defaults.maxConnections - - text - - - - haproxy.general.defaults.timeoutClient - - text - - - - haproxy.general.defaults.timeoutConnect - - text - - - - haproxy.general.defaults.timeoutCheck - - text - - - - haproxy.general.defaults.timeoutServer - - text - - - - haproxy.general.defaults.retries - - text - - - - haproxy.general.defaults.redispatch - - dropdown - - - - haproxy.general.defaults.init_addr - - select_multiple - - true - - - - haproxy.general.defaults.customOptions - - textbox -
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     - true -     -     - - - haproxy.general.logging.host - - text - - - - haproxy.general.logging.facility - - dropdown - - - - haproxy.general.logging.level - - dropdown - - - - haproxy.general.logging.length - - text - - true - - - - - haproxy.general.stats.enabled - - checkbox - - - - haproxy.general.stats.port - - text - - true - - - haproxy.general.stats.remoteEnabled - - checkbox - This may be a security risk if you do not enable authentication! Note that you need to add appropiate firewall rules for this to work.]]> - - - haproxy.general.stats.remoteBind - - select_multiple - - true - - Enter address:port here. Finish with TAB. - - - haproxy.general.stats.authEnabled - - checkbox - - - haproxy.general.stats.allowedUsers - - select_multiple - true - Type username or choose from list. - - - haproxy.general.stats.allowedGroups - - select_multiple - true - Type group or choose from list. - - - haproxy.general.stats.customOptions - - textbox -
    NOTE: The syntax will not be checked, use at your own risk!
    ]]>     - true -     -     - - - haproxy.general.cache.enabled - - checkbox - - - - haproxy.general.cache.totalMaxSize - - text - - - - haproxy.general.cache.maxAge - - text - - - - haproxy.general.cache.maxObjectSize - - text - - - -     -
    diff --git a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt index 3e4086172..59adaa892 100644 --- a/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt +++ b/net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt @@ -31,6 +31,7 @@ POSSIBILITY OF SUCH DAMAGE. $( document ).ready(function() { + // get general HAProxy settings var data_get_map = {'frm_haproxy':"/api/haproxy/settings/get"}; // load initial data @@ -298,7 +299,7 @@ POSSIBILITY OF SUCH DAMAGE. * Commands **********************************************************************/ - // Reconfigure haproxy - activate changes + // reconfigure haproxy to activate changes $('[id*="reconfigureAct"]').each(function(){ $(this).click(function(){ @@ -366,7 +367,7 @@ POSSIBILITY OF SUCH DAMAGE. }); }); - // Test configuration file + // test configuration file $('[id*="configtestAct"]').each(function(){ $(this).click(function(){ @@ -407,34 +408,115 @@ POSSIBILITY OF SUCH DAMAGE. }); }); - // form save event handlers for all defined forms - $('[id*="save_"]').each(function(){ + // save general settings and perform a config test + $('[id*="saveAndTestAct"]').each(function(){ $(this).click(function(){ - var frm_id = $(this).closest("form").attr("id"); - var frm_title = $(this).closest("form").attr("data-title"); + // extract the form id from the button id + var frm_id = "frm_" + $(this).attr("id").split('_')[1] - // set progress animation - $("#"+frm_id+"_progress").addClass("fa fa-spinner fa-pulse"); - - // save data for tab + // save data for this tab saveFormToEndpoint(url="/api/haproxy/settings/set",formid=frm_id,callback_ok=function(){ + // set progress animation + $('[id*="saveAndTestAct_progress"]').each(function(){ + $(this).addClass("fa fa-spinner fa-pulse"); + }); - // on correct save, perform reconfigure - ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { - if (status != "success" || data['status'] != 'ok') { + // on correct save, perform config test + ajaxCall(url="/api/haproxy/service/configtest", sendData={}, callback=function(data,status) { + if (data['result'].indexOf('ALERT') > -1) { BootstrapDialog.show({ - type: BootstrapDialog.TYPE_WARNING, - title: "{{ lang._('Error reconfiguring HAProxy') }}", - message: data['status'], + type: BootstrapDialog.TYPE_DANGER, + title: "{{ lang._('HAProxy config contains critical errors') }}", + message: data['result'], draggable: true }); - } else { - ajaxCall(url="/api/haproxy/service/status", sendData={}, callback=function(data,status) { - updateServiceStatusUI(data['status']); + } else if (data['result'].indexOf('WARNING') > -1) { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('HAProxy config contains minor errors') }}", + message: data['result'], + draggable: true }); } - // when done, disable progress animation. - $("#"+frm_id+"_progress").removeClass("fa fa-spinner fa-pulse"); + // when done, disable progress animation + $('[id*="saveAndTestAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + }); + }); + }); + }); + + // save general settings and reconfigure HAProxy + $('[id*="saveAndReconfigureAct"]').each(function(){ + $(this).click(function(){ + // extract the form id from the button id + var frm_id = "frm_" + $(this).attr("id").split('_')[1] + + // save data for this tab + saveFormToEndpoint(url="/api/haproxy/settings/set",formid=frm_id,callback_ok=function(){ + // set progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).addClass("fa fa-spinner fa-pulse"); + }); + + // on correct save, perform config test + ajaxCall(url="/api/haproxy/service/configtest", sendData={}, callback=function(data,status) { + // show warning in case of critical errors + if (data['result'].indexOf('ALERT') > -1) { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_DANGER, + title: "{{ lang._('HAProxy config contains critical errors') }}", + message: "{{ lang._('The HAProxy service may not be able to start due to critical errors. Try anyway?') }}", + buttons: [{ + label: '{{ lang._('Continue') }}', + cssClass: 'btn-primary', + action: function(dlg){ + ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { + if (status != "success" || data['status'] != 'ok') { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('Error reconfiguring HAProxy') }}", + message: data['status'], + draggable: true + }); + } + }); + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + dlg.close(); + } + }, { + icon: 'fa fa-trash-o', + label: '{{ lang._('Abort') }}', + action: function(dlg){ + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + dlg.close(); + } + }] + }); + } else { + ajaxCall(url="/api/haproxy/service/reconfigure", sendData={}, callback=function(data,status) { + if (status != "success" || data['status'] != 'ok') { + BootstrapDialog.show({ + type: BootstrapDialog.TYPE_WARNING, + title: "{{ lang._('Error reconfiguring HAProxy') }}", + message: data['status'], + draggable: true + }); + } + // when done, disable progress animation + $('[id*="saveAndReconfigureAct_progress"]').each(function(){ + $(this).removeClass("fa fa-spinner fa-pulse"); + }); + }); + } + //}); }); }); @@ -513,30 +595,24 @@ POSSIBILITY OF SUCH DAMAGE. - {# add automatically generated tabs #} - {% for tab in mainForm['tabs']|default([]) %} - {% if tab['subtabs']|default(false) %} - {# Tab with dropdown #} - - {% else %} - {# Standard Tab #} -
  • - - {{tab[1]}} - -
    • - {% endif %} - {% endfor %} +
  • {{ lang._('Add %sReal Servers:%s All physical or virtual servers that HAProxy should use to load balance between or proxy to.') | format('', '') }}
  • {{ lang._('Add %sBackend Pools:%s Group the previously added servers to build a server farm. All servers in a group usually deliver the same content. The Backend Pool takes care of health monitoring and load distribution. A Backend Pool must be configured even if you only have a single server.') | format('', '')}}
  • {{ lang._('Add %sPublic Services:%s The Public Service listens for client connections, optionally applies rules and forwards client request data to the selected Backend Pool for load balancing or proxying.') | format('', '') }}
    • -
  • {{ lang._('Lastly, enable HAProxy using the %sService Settings%s.') | format('', '') }}
    • +
  • {{ lang._('Lastly, enable HAProxy using the %sService%s settings page.') | format('', '') }}

    • {{ lang._('Please be aware that you need to %smanually%s add the required firewall rules for all configured services.') | format('', '') }}

    {{ lang._('Further information is available in our %sHAProxy plugin documentation%s and of course in the %sofficial HAProxy documentation%s. Be sure to report bugs and request features on our %sGitHub issue page%s. Code contributions are also very welcome!') | format('', '', '', '', '', '') }}

    @@ -631,6 +707,24 @@ POSSIBILITY OF SUCH DAMAGE. +
    +
    +

    {{ lang._('Settings') }}

    +

    {{ lang._("Manage HAProxy core configuration:") }}

    +
      +
    • {{ lang._("%sService:%s Basic service management and options to control HAProxy's restart behaviour.") | format('', '') }}
      • +
    • {{ lang._("%sGlobal Parameters:%s Tuning parameters and global defaults that cannot be overriden elsewhere.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sDefault Parameters:%s Define default parameters for all %sPublic Services%s, %sBackend Pools%s and %sReal Servers%s here. They may be overriden elsewhere.") | format('', '', '', '', '', '', '', '', '', '', '', '') }}
      • +
    • {{ lang._("%sLogging:%s Configure HAProxy's logging behaviour and enable remote logging.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sStatistics:%s This manages HAProxy's internal statistics reporting.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sCache:%s HAProxy's cache which was designed to perform cache on small objects (favicon, css, etc.). This is a minimalist low-maintenance cache which runs in RAM.") | format('', '', '', '') }}
      • +
    • {{ lang._("%sPeers:%s Configure a communication channel between two HAProxy instances. This will propagate entries of any data-types in stick-tables between these HAProxy instances over TCP connections in a multi-master fashion. Useful when aiming for a seamless failover in a HA setup.") | format('', '', '', '') }}
      • +
    +

    {{ lang._("For more details visit HAProxy's official documentation regarding the %sStatistics%s, %sCache%s and %sPeers%s features.") | format('', '', '', '', '', '') }}

    +
    +
    +
    +

    {{ lang._('Advanced Features') }}

    @@ -647,25 +741,7 @@ POSSIBILITY OF SUCH DAMAGE.
    - {# add automatically generated tabs #} - {% for tab in mainForm['tabs']|default([]) %} - {% if tab['subtabs']|default(false) %} - {# Tab with dropdown #} - {% for subtab in tab['subtabs']|default({})%} -
    - {{ partial("layout_partials/base_form",['fields':subtab[2],'id':'frm_'~subtab[0],'data_title':subtab[1],'apply_btn_id':'save_'~subtab[0]])}} -
    - {% endfor %} - {% endif %} - {% if tab['subtabs']|default(false)==false %} -
    - {{ partial("layout_partials/base_form",['fields':tab[2],'id':'frm_'~tab[0],'apply_btn_id':'save_'~tab[0]])}} -
    - {% endif %} - {% endfor %} -
    - @@ -689,7 +765,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -700,7 +775,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -724,7 +798,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -735,7 +808,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -761,7 +833,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -772,7 +843,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -795,7 +865,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -806,7 +875,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -829,7 +897,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -840,7 +907,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -863,7 +929,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -874,7 +939,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -898,7 +962,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -909,7 +972,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -933,7 +995,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -944,7 +1005,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -968,7 +1028,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -979,7 +1038,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1002,7 +1060,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1013,7 +1070,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1036,7 +1092,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1047,7 +1102,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1073,7 +1127,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1084,7 +1137,6 @@ POSSIBILITY OF SUCH DAMAGE.
    - @@ -1108,7 +1160,6 @@ POSSIBILITY OF SUCH DAMAGE.
    -
    @@ -1117,6 +1168,84 @@ POSSIBILITY OF SUCH DAMAGE.
    + + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalSettingsForm,'id':'frm_haproxy-general-settings'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalTuningForm,'id':'frm_haproxy-general-tuning'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalDefaultsForm,'id':'frm_haproxy-general-defaults'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalLoggingForm,'id':'frm_haproxy-general-logging'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalStatsForm,'id':'frm_haproxy-general-stats'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalCacheForm,'id':'frm_haproxy-general-cache'])}} +
    +
    + + +
    +
    +
    + +
    +
    + {{ partial("layout_partials/base_form",['fields':generalPeersForm,'id':'frm_haproxy-general-peers'])}} +
    +
    + + +
    +
    +
    {# include dialogs #} From 95b8cc6aa00e40e5a2edf11827561051ec4d4d34 Mon Sep 17 00:00:00 2001 From: Frank Wall Date: Thu, 20 Aug 2020 01:01:41 +0200 Subject: [PATCH 8/8] net/haproxy: add plugin changelog --- net/haproxy/pkg-descr | 242 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 241 insertions(+), 1 deletion(-) diff --git a/net/haproxy/pkg-descr b/net/haproxy/pkg-descr index 5a41f6ad0..be9ec9837 100644 --- a/net/haproxy/pkg-descr +++ b/net/haproxy/pkg-descr @@ -3,4 +3,244 @@ availability, load balancing, and proxying for TCP and HTTP-based applications. It is particularly suited for web sites crawling under very high loads while needing persistence or Layer7 processing. -WWW: https://haproxy.org/ +Plugin Changelog +================ + +2.24 + +Added: +* add support for http-request set-var and http-response set-var (#1796) +* add group as userlist to HAProxy config to make it usable in rules/conditions (#1796) +* add support for resolvers to customize how HAProxy handles name resolution (#1787) +* add support for init-addr to allow HAProxy to start when DNS does not resolve (#1787) + +Fixed: +* honor sort order of all rules, remove special handling of "use_[backend|server]" options (#1925) + +Changed: +* add "Save & Test syntax" button to all "Settings" pages +* add "introduction" page for Settings tab +* streamine "Settings" subtabs + +2.23 + +Fixed: +* add missing acl SNI regex text field (#1883) + +2.22 + +Added: +* enable SSL verification for a server when "Force SSL" is enabled in the associated health check (#1761) +* use the systems local Root CA Certificates for SSL verification when no CA was selected (#1761) + +Fixed: +* fix label of src_sess_cnt (#1780) +* fix invalid use of option httplog (resolves a warning in config test) +* fix invalid use of option forwardfor (resolves a warning in config test) + +2.21 + +Fixed: +* override "graceful" restart if required (#1745) + +2.20 + +Changed: +* update stats socket permission for easier (non-root) monitoring (#1232) + +2.19 + +Added: +* switch to HAProxy 2.0 release series (#1089) +* add support for the "max-object-size" cache configuration option (#1458) +* add end-to-end HTTP/2 support (details) +* add support for the random balancing algorithm (details) + +Fixed: +* fix IPv6 validation in frontends (#540) + +Changed: +* add IPv6 example to listen address help text +* update URLs to HAProxy 2.0 documentation +* frontends: move HTTP/2 option to HTTP settings +* change order of frontend options + +2.18 + +Added: +* add support for HAProxy cache (#1442) + +Changed: +* change http-reuse default (align with HAProxy's default value, #1439) + +2.17 + +Added: +* allow backends without servers (#1304) +* add support for deciphered SNI check in ACLs (#1365) +* allow to force SSL for health checks (#1282) + +Changed: +* improve wording for SNI conditions to differentiate between deciphered vs. not deciphered + +2.16 + +Fixed: +* allow hyphens in server, frontend and backend names (#1346) + +2.15 + +Added: +* rules can finally be sorted by using drag'n'drop (#582) +* added "enabled" field to servers (#1208) +* TCP inspection delays are supported in rules (#1188) + +Changed: +* server option "mode" is always visible, no longer requires "advanced mode" (#1208) +* most dropdown fields finally have alphanumeric sorting (#687, opnsense/core#3251) +* rules: align indentation of comments in haproxy.conf + +2.14 + +Fixed: +* bulk deleting does not work (#1164) + +Changed: +* migrate to mutable controller (required to fix #1164) + +2.13 + +Added: +* support multiple CAs for SSL verification for servers + +Fixed: +* fix export of CAs (#1074) + +Changed: +* export a frontend's default SSL certificate (#1088) +* it is no longer required to add a default SSL certificate to a frontend's "certificates" list (#1088) +* avoid duplicate entry in certlist file if a default SSL certificate is specified +* always show "Default certificate" option in frontends, it's no longer an "advanced" option + +2.12 + +Added: +* add support for HTTP/2 (#1047) + +2.11 + +Fixed: +* fix warning: a 'http-request' rule placed after a 'use_backend' rule will still be processed before (#999) +* fix wrong parameter name when using tcp-request content lua (#999) + +Changed: +* internal: trim whitespace, remove empty lines in haproxy.conf (#999) + +2.10 + +Added: +* add support for multithreading (available as new option in Settings -> Global Parameters) (#1003) +* add support for client certificate authentication (#426) +* add support for HTTP Basic Auth to frontends/backends/ACLs (#300) +* add basic user/group management functionality (supports Basic Auth as well as stats users) +* add new CPU Affinity Rules feature (which is a combination of HAProxy's cpu-map, bind-process and process options) (see #1003 for a short explanation) + +Fixed: +* function "http-request header-delete" generated a corrupted haproxy.conf (#882) + +Changed: +* migrate all stats users from old (and cumbersome) username:password format to new user management feature +* internal: use /tmp for autogenerated files (now they are automatically cleaned up on boot) +* internal: change filename of cert lists from id.crtlist to id.certlist + +2.9 + +Added: +* add "http-reuse" option (#836) + +2.8 + +Added: +* support truly seamless reloads (#224) +* add support for the "map" feature (#180) + +Fixed: +* fix reload of service template in "reconfigure" action (#690; introduced in 7381101) +* enabling "hard stop" mode resulted in an invalid "hardrestart" RC command + +Changed: +* use "reload" instead of "restart" RC action +* if "reload" fails, also issue a "restart" command (required when enabling seamless reloads) +* start progress animation (spinner) earlier when applying settings + +2.7 + +Added: +* support rise/fall parameters in backends and health checks +* support set-path in ACLs +* support for cookie-based persistence (#680) + +Fixed: +* fix X-Forwarded-For option disappeared (#647) +* fix validation for source address fields (#695) + +2.6 + +Added: +* add support for http-response set-status in ACLs to manipulate HTTP status codes + +Fixed: +* fix invalid backend name when using nbsrv in ACLs + +2.5 + +Added: +* add support for the PROXY protocol (i.e. in combination with postfix or dovecot) +* switch to HAProxy 1.8.4 + +2.4 + +Added: +* add support for "preload" and "includeSubDomains" HSTS options (#447) +* support session sync / HAProxy peers (#165) +* add new HTTP timeout options (to mitigate slowloris attacks) (#202) +* allow tracking additional values in stick-tables (#202) +* add stick-table config for frontends (optional, disabled by default) (#202) +* add support for many new conditions (#202) +* enable sticky counters for frontend stick-tables (required for new conditions) (#202) + +Changed: +* relax validation masks for several "name" fields (to allow more "special" characters) +* switch to new mutable service controller + +2.3 + +Added: +* new option to hide introduction pages (#340) + +Fixed: +* fix wrong introduction for "Advanced" tab (regression introduced in 8cdcbda) + +2.2 + +Fixed: +* fix for rules parameters (values could not be saved, leading to invalid rules) + +2.1 + +Fixed: +* do not enable HSTS unconditionally (now works as described in #380) +* enable HSTS only for HTTP frontends + +2.0 + +Added: +* new GUI to guide new users and improve general usability (#208) +* make server port optional (#341) +* new SSL settings for frontends (#380) +* new global SSL default values (#380) +* new option for HTTP Strict Transport Security (#380) + +Fixed: +* rephrase text to make it clear that aliases cannot be used (#360) +* rephrase text to make it clear that "use_server" will only work for backends (#361)