From f7afbc30b753c9ace466709f484c95e47ab2c67c Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 18 Nov 2017 00:51:25 +0100
Subject: [PATCH] net/haproxy: add global SSL default values, refs #375

---
 .../OPNsense/HAProxy/forms/main.xml           | 24 ++++++++++++++++++
 .../app/models/OPNsense/HAProxy/HAProxy.xml   | 25 +++++++++++++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf   | 14 +++++++++++
 3 files changed, 63 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
index bfe9c6e35..3a48bfaeb 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/main.xml
@@ -86,6 +86,30 @@
                 <help><![CDATA[These lines will be added to the global settings of to the HAProxy configuration file.<br/><div class="text-info"><b>NOTE:</b> The syntax will not be checked, use at your own risk!</div>]]></help>
                 <advanced>true</advanced>
             </field>
+            <field>
+                <label>SSL default settings</label>
+                <type>header</type>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_defaultsEnabled</id>
+                <label>Enabled</label>
+                <type>checkbox</type>
+                <help><![CDATA[Enable global SSL default values.]]></help>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_bindOptions</id>
+                <label>Bind options</label>
+                <type>select_multiple</type>
+                <style>tokenize</style>
+                <allownew>true</allownew>
+                <help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
+            </field>
+            <field>
+                <id>haproxy.general.tuning.ssl_cipherList</id>
+                <label>Cipher List</label>
+                <type>text</type>
+                <help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
+            </field>
         </subtab>
         <subtab id="haproxy-general-defaults" description="Default Parameters">
             <field>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 045076ccd..ae6724884 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -79,6 +79,31 @@
                 <customOptions type="TextField">
                     <Required>N</Required>
                 </customOptions>
+                <ssl_defaultsEnabled type="BooleanField">
+                    <default>0</default>
+                    <Required>Y</Required>
+                </ssl_defaultsEnabled>
+                <ssl_bindOptions type="OptionField">
+                    <Required>N</Required>
+                    <default>no-sslv3,no-tlsv10,no-tls-tickets</default>
+                    <Multiple>Y</Multiple>
+                    <OptionValues>
+                        <no-sslv3>no-sslv3</no-sslv3>
+                        <no-tlsv10>no-tlsv10</no-tlsv10>
+                        <no-tlsv11>no-tlsv11</no-tlsv11>
+                        <no-tlsv12>no-tlsv12</no-tlsv12>
+                        <no-tls-tickets>no-tls-tickets</no-tls-tickets>
+                        <force-sslv3>force-sslv3</force-sslv3>
+                        <force-tlsv10>force-tlsv10</force-tlsv10>
+                        <force-tlsv11>force-tlsv11</force-tlsv11>
+                        <force-tlsv12>force-tlsv12</force-tlsv12>
+                        <strict-sni>strict-sni</strict-sni>
+                    </OptionValues>
+                </ssl_bindOptions>
+                <ssl_cipherList type="TextField">
+                    <default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
+                    <Required>N</Required>
+                </ssl_cipherList>
             </tuning>
             <defaults>
                 <maxConnections type="IntegerField">
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 1d3f84f6f..d0aeb2f27 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -518,6 +518,20 @@ global
 {%     endif %}
 {%   endfor %}
 {% endif %}
+{# # ssl default settings #}
+{% if OPNsense.HAProxy.general.tuning.ssl_defaultsEnabled|default("") == '1' %}
+{%   if OPNsense.HAProxy.general.tuning.ssl_bindOptions|default("") != "" %}
+{%     set bindopts = [] %}
+{%     for bindopt in OPNsense.HAProxy.general.tuning.ssl_bindOptions.split(",") %}
+{%       do bindopts.append(bindopt) %}
+{%     endfor %}
+    ssl-default-bind-options {{ bindopts|join(' ') }}
+{%   endif %}
+{%   if OPNsense.HAProxy.general.tuning.ssl_cipherList|default("") != "" %}
+    ssl-default-bind-ciphers {{ OPNsense.HAProxy.general.tuning.ssl_cipherList }}
+{%   endif %}
+{% endif %}
+{# # pass-through options #}
 {% if OPNsense.HAProxy.general.tuning.customOptions|default("") != "" %}
     # WARNING: pass through options below this line
 {%   for customOpt in OPNsense.HAProxy.general.tuning.customOptions.split("\n") %}