From 23dd30112710363e4e7bf6de4c3c919ebf90279e Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Fri, 2 Feb 2018 23:17:01 +0100
Subject: [PATCH] net/haproxy: add support for the PROXY protocol

---
 .../controllers/OPNsense/HAProxy/forms/dialogBackend.xml   | 7 +++++++
 .../opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml   | 7 +++++++
 .../service/templates/OPNsense/HAProxy/haproxy.conf        | 6 ++++++
 3 files changed, 20 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
index 53320c994..5c6111295 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogBackend.xml
@@ -31,6 +31,13 @@
         <help><![CDATA[Define the load balancing algorithm to be used in a Backend Pool. See the <a target="_blank" href="http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#balance">HAProxy documentation</a> for a full description.]]></help>
         <hint>Choose a load balancing algorithm.</hint>
     </field>
+    <field>
+        <id>backend.proxyProtocol</id>
+        <label>Proxy Protocol</label>
+        <type>dropdown</type>
+        <help><![CDATA[Enforces use of the PROXY protocol over any connection established to the configured servers. The PROXY protocol informs the other end about the layer 3/4 addresses of the incoming connection, so that it can know the client's address or the public address it accessed to, whatever the upper layer protocol. This setting must not be used if the servers are not aware of the PROXY protocol. See the <a target="_blank" href="http://cbonte.github.io/haproxy-dconv/1.8/configuration.html#send-proxy">HAProxy documentation</a> for a full description.]]></help>
+        <advanced>true</advanced>
+    </field>
     <field>
         <id>backend.linkedServers</id>
         <label>Servers</label>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 50435b9c8..103a71e6d 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -620,6 +620,13 @@
                         <uri>URI Hash (only HTTP mode)</uri>
                     </OptionValues>
                 </algorithm>
+                <proxyProtocol type="OptionField">
+                    <Required>N</Required>
+                    <OptionValues>
+                        <v1>PROXY protocol version 1</v1>
+                        <v2>PROXY protocol version 2</v2>
+                    </OptionValues>
+                </proxyProtocol>
                 <linkedServers type="ModelRelationField">
                     <Model>
                         <template>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index a4b193405..05293721b 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -1053,6 +1053,12 @@ backend {{backend.name}}
 {%           elif server_data.source|default("") != "" %}
 {%             do server_options.append('source ' ~ server_data.source) %}
 {%           endif %}
+{#           # PROXY protocol #}
+{%           if backend.proxyProtocol|default("") == "v1" %}
+{%             do server_options.append('send-proxy') %}
+{%           elif backend.proxyProtocol|default("") == "v2" %}
+{%             do server_options.append('send-proxy-v2') %}
+{%           endif %}
 {#           # server advanced options #}
 {%           if server_data.advanced|default("") != "" %}
 {%             do server_options.append(server_data.advanced) %}