netbird/plugins
0
0
Fork 0
mirror of https://github.com/netbirdio/plugins.git synced 2026-05-22 18:44:07 -07:00
Code Issues Packages Projects Releases Wiki Activity

net/haproxy: add global SSL default values, refs #375

Browse Source
This commit is contained in:
Frank Wall
2017-11-18 00:51:25 +01:00
parent d231f77062
commit f7afbc30b7
3 changed files with 63 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
+24
View File
@@ -86,6 +86,30 @@
<help><![CDATA[These lines will be added to the global settings of to the HAProxy configuration file.<br/><div class="text-info"><b>NOTE:</b> The syntax will not be checked, use at your own risk!</div>]]></help>
<advanced>true</advanced>
</field>
<field>
<label>SSL default settings</label>
<type>header</type>
</field>
<field>
<id>haproxy.general.tuning.ssl_defaultsEnabled</id>
<label>Enabled</label>
<type>checkbox</type>
<help><![CDATA[Enable global SSL default values.]]></help>
</field>
<field>
<id>haproxy.general.tuning.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
<field>
<id>haproxy.general.tuning.ssl_cipherList</id>
<label>Cipher List</label>
<type>text</type>
<help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
</field>
</subtab>
<subtab id="haproxy-general-defaults" description="Default Parameters">
<field>
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+25
View File
@@ -79,6 +79,31 @@
<customOptions type="TextField">
<Required>N</Required>
</customOptions>
<ssl_defaultsEnabled type="BooleanField">
<default>0</default>
<Required>Y</Required>
</ssl_defaultsEnabled>
<ssl_bindOptions type="OptionField">
<Required>N</Required>
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
<Multiple>Y</Multiple>
<OptionValues>
<no-sslv3>no-sslv3</no-sslv3>
<no-tlsv10>no-tlsv10</no-tlsv10>
<no-tlsv11>no-tlsv11</no-tlsv11>
<no-tlsv12>no-tlsv12</no-tlsv12>
<no-tls-tickets>no-tls-tickets</no-tls-tickets>
<force-sslv3>force-sslv3</force-sslv3>
<force-tlsv10>force-tlsv10</force-tlsv10>
<force-tlsv11>force-tlsv11</force-tlsv11>
<force-tlsv12>force-tlsv12</force-tlsv12>
<strict-sni>strict-sni</strict-sni>
</OptionValues>
</ssl_bindOptions>
<ssl_cipherList type="TextField">
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
<Required>N</Required>
</ssl_cipherList>
</tuning>
<defaults>
<maxConnections type="IntegerField">
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+14
View File
@@ -518,6 +518,20 @@ global
{% endif %}
{% endfor %}
{% endif %}
{# # ssl default settings #}
{% if OPNsense.HAProxy.general.tuning.ssl_defaultsEnabled|default("") == '1' %}
{% if OPNsense.HAProxy.general.tuning.ssl_bindOptions|default("") != "" %}
{% set bindopts = [] %}
{% for bindopt in OPNsense.HAProxy.general.tuning.ssl_bindOptions.split(",") %}
{% do bindopts.append(bindopt) %}
{% endfor %}
ssl-default-bind-options {{ bindopts|join(' ') }}
{% endif %}
{% if OPNsense.HAProxy.general.tuning.ssl_cipherList|default("") != "" %}
ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }}
{% endif %}
{% endif %}
{# # pass-through options #}
{% if OPNsense.HAProxy.general.tuning.customOptions|default("") != "" %}
# WARNING: pass through options below this line
{% for customOpt in OPNsense.HAProxy.general.tuning.customOptions.split("\n") %}