upstream/opnsense-plugins
1
0
Fork 0
mirror of https://github.com/opnsense/plugins.git synced 2026-06-03 13:59:06 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

net/haproxy: make SSL params configurable, closes #375

Browse source
This commit is contained in:
Frank Wall 2017-11-18 00:15:11 +01:00
parent f9740debb2
commit 29f56908dd
4 changed files with 89 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

41
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
View file

@ -45,17 +45,17 @@
<type>dropdown</type>
<help><![CDATA[Set the default Backend Pool to use for this Public Service.]]></help>
</field>
<field>
<label>SSL Offloading</label>
<type>header</type>
<style>mode_table table_http table_ssl</style>
</field>
<field>
<id>frontend.ssl_enabled</id>
<label>Enabled</label>
<label>Enable SSL offloading</label>
<type>checkbox</type>
<help>Enable SSL offloading</help>
</field>
<field>
<label>SSL Offloading</label>
<type>header</type>
<style>mode_table table_http table_ssl table_ssl_true</style>
</field>
<field>
<id>frontend.ssl_certificates</id>
<label>Certificates</label>
@ -74,11 +74,36 @@
</field>
<field>
<id>frontend.ssl_customOptions</id>
<label>Advanced SSL options</label>
<label>SSL option pass-through</label>
<type>text</type>
<help><![CDATA[Specify additional SSL parameters such as force-sslv3, force-tlsv10, force-tlsv11, force-tlsv12, no-sslv3, no-tlsv10, no-tlsv11, no-tlsv12, no-tls-tickets or customize the list of SSL ciphers.<br/>Example: no-sslv3 ciphers HIGH:!DSS:!aNULL@STRENGTH<br/>]]></help>
<help><![CDATA[Pass additional SSL parameters to the HAProxy configuration.]]></help>
<advanced>true</advanced>
</field>
<field>
<id>frontend.ssl_advancedEnabled</id>
<label>Enable Advanced settings</label>
<type>checkbox</type>
<help><![CDATA[Enable advanced SSL settings.]]></help>
</field>
<field>
<label>Advanced SSL settings</label>
<type>header</type>
<style>mode_table table_http table_ssl table_ssl_advanced table_ssl_advanced_true</style>
</field>
<field>
<id>frontend.ssl_bindOptions</id>
<label>Bind options</label>
<type>select_multiple</type>
<style>tokenize</style>
<allownew>true</allownew>
<help><![CDATA[Used to enforce or disable certain SSL options.]]></help>
</field>
<field>
<id>frontend.ssl_cipherList</id>
<label>Cipher List</label>
<type>text</type>
<help><![CDATA[It sets the default string describing the list of cipher algorithms ("cipher suite") that are negotiated during the SSL/TLS handshake.]]></help>
</field>
<field>
<label>Tuning Options</label>
<type>header</type>

25
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
View file

@ -298,6 +298,31 @@
<ssl_customOptions type="TextField">
<Required>N</Required>
</ssl_customOptions>
<ssl_advancedEnabled type="BooleanField">
<default>0</default>
<Required>Y</Required>
</ssl_advancedEnabled>
<ssl_bindOptions type="OptionField">
<Required>N</Required>
<default>no-sslv3,no-tlsv10,no-tls-tickets</default>
<Multiple>Y</Multiple>
<OptionValues>
<no-sslv3>no-sslv3</no-sslv3>
<no-tlsv10>no-tlsv10</no-tlsv10>
<no-tlsv11>no-tlsv11</no-tlsv11>
<no-tlsv12>no-tlsv12</no-tlsv12>
<no-tls-tickets>no-tls-tickets</no-tls-tickets>
<force-sslv3>force-sslv3</force-sslv3>
<force-tlsv10>force-tlsv10</force-tlsv10>
<force-tlsv11>force-tlsv11</force-tlsv11>
<force-tlsv12>force-tlsv12</force-tlsv12>
<strict-sni>strict-sni</strict-sni>
</OptionValues>
</ssl_bindOptions>
<ssl_cipherList type="TextField">
<default>ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256</default>
<Required>N</Required>
</ssl_cipherList>
<tuning_maxConnections type="IntegerField">
<MinimumValue>1</MinimumValue>
<MaximumValue>500000</MaximumValue>

16
net/haproxy/src/opnsense/mvc/app/views/OPNsense/HAProxy/index.volt
View file

@ -186,6 +186,22 @@ POSSIBILITY OF SUCH DAMAGE.
$("."+service_id).show();
});
$("#frontend\\.mode").change();
// show/hide SSL offloading
$("#frontend\\.ssl_enabled").change(function(){
var service_id = 'table_ssl_' + $(this).is(':checked');
$(".table_ssl").hide();
$("."+service_id).show();
});
$("#frontend\\.ssl_enabled").change();
// show/hide advanced SSL settings
$("#frontend\\.ssl_advancedEnabled").change(function(){
var service_id = 'table_ssl_advanced_' + $(this).is(':checked');
$(".table_ssl_advanced").hide();
$("."+service_id).show();
});
$("#frontend\\.ssl_advancedEnabled").change();
})
// hook into on-show event for dialog to extend layout.

19
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
View file

@ -571,22 +571,33 @@ defaults
# Frontend: {{frontend.name}} ({{frontend.description}})
frontend {{frontend.name}}
{% set ssl_certs = [] %}
{% set ssl_options = [] %}
{% if frontend.ssl_enabled == '1' %}
{# # check if ssl certs are configured #}
{% if frontend.ssl_certificates|default("") != "" %}
{# # NOTE: Cert lists are generated by exportCerts.php #}
{% do ssl_certs.append('crt-list /var/etc/haproxy/ssl/' ~ frontend.id ~ '.crtlist') %}
{% endif %}
{# # advanced ssl options #}
{# # advanced ssl parameters (pass-through) #}
{% if frontend.ssl_customOptions|default("") != "" %}
{# # add a space to separate it from other ssl params #}
{% set ssl_options = frontend.ssl_customOptions ~ ' ' %}
{% do ssl_options.append(frontend.ssl_customOptions ~ ' ') %}
{% endif %}
{# # advanced ssl settings #}
{% if frontend.ssl_advancedEnabled|default("") == '1' %}
{% if frontend.ssl_bindOptions|default("") != "" %}
{% for bindopt in frontend.ssl_bindOptions.split(",") %}
{% do ssl_options.append(bindopt) %}
{% endfor %}
{% endif %}
{% if frontend.ssl_cipherList|default("") != "" %}
{% do ssl_options.append('ciphers ' ~ frontend.ssl_cipherList) %}
{% endif %}
{% endif %}
{% endif %}
{# # bind/listen configuration #}
{% if frontend.bind|default("") != "" %}
{% for bind in frontend.bind.split(",") %}
bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options }}{{ssl_certs|join(' ')}} {% endif %}
bind {{bind}} name {{bind}} {% if frontend.bindOptions|default("") != "" %}{{ frontend.bindOptions }} {% endif %}{% if frontend.ssl_enabled == '1' and ssl_certs|default("") != "" %}ssl {{ ssl_options|join(' ') }} {{ ssl_certs|join(' ') }} {% endif %}
{% endfor %}
{% endif %}