upstream/opnsense-plugins
1
0
Fork 0
mirror of https://github.com/opnsense/plugins.git synced 2026-06-09 08:56:23 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

net/haproxy: support additional HSTS options, refs #447

Browse source
This commit is contained in:
Frank Wall 2018-01-12 22:52:41 +01:00
parent 79d4a7c79f
commit d2e057782d
3 changed files with 30 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
net/haproxy/src/opnsense/mvc/app/controllers/OPNsense/HAProxy/forms/dialogFrontend.xml
View file

@ -110,6 +110,18 @@
<type>checkbox</type>
<help><![CDATA[Enable HTTP Strict Transport Security.]]></help>
</field>
<field>
<id>frontend.ssl_hstsIncludeSubDomains</id>
<label>HSTS includeSubDomains</label>
<type>checkbox</type>
<help><![CDATA[Enable if all present and future subdomains will be HTTPS.]]></help>
</field>
<field>
<id>frontend.ssl_hstsPreload</id>
<label>HSTS preload</label>
<type>checkbox</type>
<help><![CDATA[Enable if you like this domain to be included in the HSTS preload list.]]></help>
</field>
<field>
<id>frontend.ssl_hstsMaxAge</id>
<label>HSTS max-age</label>

10
net/haproxy/src/opnsense/mvc/app/models/OPNsense/HAProxy/HAProxy.xml
View file

@ -1,6 +1,6 @@
<model>
<mount>//OPNsense/HAProxy</mount>
<version>2.0.1</version>
<version>2.1.0</version>
<description>
the HAProxy load balancer
</description>
@ -355,6 +355,14 @@
<default>1</default>
<Required>Y</Required>
</ssl_hstsEnabled>
<ssl_hstsIncludeSubDomains type="BooleanField">
<default>0</default>
<Required>N</Required>
</ssl_hstsIncludeSubDomains>
<ssl_hstsPreload type="BooleanField">
<default>0</default>
<Required>N</Required>
</ssl_hstsPreload>
<ssl_hstsMaxAge type="IntegerField">
<default>15768000</default>
<MinimumValue>1</MinimumValue>

10
net/haproxy/src/opnsense/service/templates/OPNsense/HAProxy/haproxy.conf
View file

@ -608,7 +608,15 @@ frontend {{frontend.name}}
{% endif %}
{# # HSTS #}
{% if frontend.ssl_hstsEnabled|default("") == '1' and frontend.mode == 'http' %}
http-response set-header Strict-Transport-Security max-age={{frontend.ssl_hstsMaxAge}}
{% set hsts_options = [] %}
{% do hsts_options.append('max-age=' ~ frontend.ssl_hstsMaxAge) %}
{% if frontend.ssl_hstsIncludeSubDomains|default("") == '1' %}
{% do hsts_options.append('; includeSubDomains') %}
{% endif %}
{% if frontend.ssl_hstsPreload|default("") == '1' %}
{% do hsts_options.append('; preload') %}
{% endif %}
http-response set-header Strict-Transport-Security "{{ hsts_options|join('') }}"
{% endif %}
{% endif %}
{% endif %}