From 55bcce55dabc3a08534e90323e98dc30bc180154 Mon Sep 17 00:00:00 2001
From: Frank Wall <fw@moov.de>
Date: Sat, 13 Jan 2018 14:48:20 +0100
Subject: [PATCH] net/haproxy: add new HTTP timeout settings, refs #202

---
 .../OPNsense/HAProxy/forms/dialogFrontend.xml      | 14 ++++++++++++++
 .../mvc/app/models/OPNsense/HAProxy/HAProxy.xml    | 10 ++++++++++
 .../templates/OPNsense/HAProxy/haproxy.conf        |  6 ++++++
 3 files changed, 30 insertions(+)

diff --git a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
index 3c069d9d9..6fc2948a1 100644
--- a/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
+++ b/net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
@@ -145,6 +145,20 @@
         <help><![CDATA[Set the maximum inactivity time on the client side. Defaults to milliseconds. Optionally the unit may be specified as either "d", "h", "m", "s", "ms" or "us".]]></help>
         <advanced>true</advanced>
     </field>
+    <field>
+        <id>frontend.tuning_timeoutHttpReq</id>
+        <label>HTTP Request Timeout</label>
+        <type>text</type>
+        <help><![CDATA[Set the maximum allowed time to wait for a complete HTTP request. In order to offer DoS protection, it may be required to lower the maximum accepted time to receive a complete HTTP request without affecting the client timeout. This helps protecting against established connections on which nothing is sent. Defaults to milliseconds. Optionally the unit may be specified as either "d", "h", "m", "s", "ms" or "us".]]></help>
+        <advanced>true</advanced>
+    </field>
+    <field>
+        <id>frontend.tuning_timeoutHttpKeepAlive</id>
+        <label>HTTP Keep-Alive Timeout</label>
+        <type>text</type>
+        <help><![CDATA[Set the maximum allowed time to wait for a new HTTP request to appear. Defaults to milliseconds. Optionally the unit may be specified as either "d", "h", "m", "s", "ms" or "us".]]></help>
+        <advanced>true</advanced>
+    </field>
     <field>
         <label>Logging Options</label>
         <type>header</type>
diff --git a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
index 5952c48e6..c7717b67d 100644
--- a/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
+++ b/net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
@@ -381,6 +381,16 @@
                     <ValidationMessage>Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us".</ValidationMessage>
                     <Required>N</Required>
                 </tuning_timeoutClient>
+                <tuning_timeoutHttpReq type="TextField">
+                    <mask>/^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u</mask>
+                    <ValidationMessage>Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us".</ValidationMessage>
+                    <Required>N</Required>
+                </tuning_timeoutHttpReq>
+                <tuning_timeoutHttpKeepAlive type="TextField">
+                    <mask>/^([0-9]{1,8}(?:us|ms|s|m|h|d)?)/u</mask>
+                    <ValidationMessage>Should be a number between 1 and 8 characters, optionally followed by either "d", "h", "m", "s", "ms" or "us".</ValidationMessage>
+                    <Required>N</Required>
+                </tuning_timeoutHttpKeepAlive>
                 <logging_dontLogNull type="BooleanField">
                     <default>0</default>
                     <Required>Y</Required>
diff --git a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
index 90c7c9883..ccaefda24 100644
--- a/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
+++ b/net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
@@ -651,6 +651,12 @@ frontend {{frontend.name}}
     timeout client {{frontend.tuning_timeoutClient}}
 {%       elif OPNsense.HAProxy.general.defaults.timeoutClient is defined %}
     timeout client {{OPNsense.HAProxy.general.defaults.timeoutClient}}
+{%       endif %}
+{%       if frontend.tuning_timeoutHttpReq|default("") != "" and frontend.mode == 'http' %}
+    timeout http-request {{frontend.tuning_timeoutHttpReq}}
+{%       endif %}
+{%       if frontend.tuning_timeoutHttpKeepAlive|default("") != "" and frontend.mode == 'http' %}
+    timeout http-keep-alive {{frontend.tuning_timeoutHttpKeepAlive}}
 {%       endif %}
     # logging options
 {%       if frontend.logging_dontLogNull=='1' %}