aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--config/arping/arping.xml4
-rw-r--r--config/freeradius2/freeradiuseapconf.xml2
-rw-r--r--config/haproxy-devel/pkg/haproxy.inc17
-rw-r--r--config/haproxy-devel/pkg/haproxy_utils.inc41
-rw-r--r--config/haproxy-devel/www/haproxy_listeners_edit.php3
-rw-r--r--config/haproxy-devel/www/haproxy_pool_edit.php2
-rw-r--r--pkg_config.10.xml6
7 files changed, 43 insertions, 32 deletions
diff --git a/config/arping/arping.xml b/config/arping/arping.xml
index 02531b76..c8ab9931 100644
--- a/config/arping/arping.xml
+++ b/config/arping/arping.xml
@@ -47,7 +47,7 @@
<faq>Currently there are no FAQ items provided.</faq>
<name>arping</name>
<version>2.6.0.2</version>
- <title>Services: ARPing</title>
+ <title>Diagnostics: ARPing</title>
<savetext>ARPing</savetext>
<preoutput>yes</preoutput>
<donotsave>true</donotsave>
@@ -55,7 +55,7 @@
<menu>
<name>Arping</name>
<tooltiptext>Host to arp ping</tooltiptext>
- <section>Services</section>
+ <section>Diagnostics</section>
<url><![CDATA[/pkg_edit.php?xml=arping.xml&id=0]]></url>
</menu>
<tabs>
diff --git a/config/freeradius2/freeradiuseapconf.xml b/config/freeradius2/freeradiuseapconf.xml
index 947ef6b9..a5ea88bd 100644
--- a/config/freeradius2/freeradiuseapconf.xml
+++ b/config/freeradius2/freeradiuseapconf.xml
@@ -470,7 +470,7 @@
<field>
<fielddescr>Microsoft Statement of Health (SoH) Support</fielddescr>
<fieldname>vareapconfpeapsohenable</fieldname>
- <description><![CDATA[You can accept/reject clients based on Microsoft's Statement of Health, such as if they are missing Windows updates, don't have a firewall enabled, antivirus not in line with policy, etc. You need to change server-file for your needs. It cannot be changed from GUI and will be deleted after package reinstallation. (/usr/local/etc/raddb/sites-available/soh). (Default: no)]]></description>
+ <description><![CDATA[You can accept/reject clients based on Microsoft's Statement of Health, such as if they are missing Windows updates, don't have a firewall enabled, antivirus not in line with policy, etc. You need to change server-file for your needs. It cannot be changed from GUI and will be deleted after package reinstallation. (/usr/local/etc/raddb/sites-available/soh). (Default: Disable)]]></description>
<type>select</type>
<default_value>Disable</default_value>
<options>
diff --git a/config/haproxy-devel/pkg/haproxy.inc b/config/haproxy-devel/pkg/haproxy.inc
index 6e07625f..eceef783 100644
--- a/config/haproxy-devel/pkg/haproxy.inc
+++ b/config/haproxy-devel/pkg/haproxy.inc
@@ -957,18 +957,23 @@ function haproxy_write_certificate_crl($filename, $crlid, $append = false) {
unset($crl);
}
-function haproxy_write_certificate_fullchain($filename, $certid, $append = false) {
+function haproxy_write_certificate_fullchain($filename, $certid, $append = false, $skiproot = true) {
$cert = haproxy_lookup_cert($certid);
$certcontent = base64_decode($cert['crt']);
if (isset($cert['prv']))
$certcontent .= "\r\n".base64_decode($cert['prv']);
- $certchaincontent = ca_chain($cert);
- if ($certchaincontent != "") {
- $certcontent .= "\r\n" . $certchaincontent;
+ $ca = $cert;
+ while(!empty($ca['caref'])) {
+ $ca = lookup_ca($ca['caref']);
+ if ($ca) {
+ if ($skiproot && (cert_get_subject($ca['crt']) == cert_get_issuer($ca['crt'])))
+ break;
+ $certcontent .= "\r\n" . base64_decode($ca['crt']);
+ } else
+ break;
}
- unset($certchaincontent);
$flags = $append ? FILE_APPEND : 0;
file_put_contents($filename, $certcontent, $flags);
unset($certcontent);
@@ -1155,7 +1160,7 @@ function haproxy_writeconf($configpath) {
if ($frontend['sslocsp'] == 'yes') {
if (!empty(haproxy_getocspurl($filename))) {
haproxy_write_certificate_issuer($filename . ".issuer", $frontend['ssloffloadcert']);
- touch($filename . ".ocsp");
+ touch($filename . ".ocsp");//create initial empty file. this will trigger updates, and inform haproxy it 'should' be using ocsp
}
}
diff --git a/config/haproxy-devel/pkg/haproxy_utils.inc b/config/haproxy-devel/pkg/haproxy_utils.inc
index 3d841a25..ec72b986 100644
--- a/config/haproxy-devel/pkg/haproxy_utils.inc
+++ b/config/haproxy-devel/pkg/haproxy_utils.inc
@@ -39,32 +39,37 @@ class haproxy_utils {
public function query_dns($host, $querytype="A,AAAA") {
$result = array();
$types = explode(',',$querytype);
- $recordtypes = 0;
+ $recordtype = 0;
foreach($types as $type){
switch ($type) {
case 'A':
- $recordtypes += DNS_A;
+ $recordtype = DNS_A;
break;
case 'AAAA':
- $recordtypes += DNS_AAAA;
+ $recordtype = DNS_AAAA;
break;
}
- }
- if ($recordtypes == 0)
- return $result;
-
- $dnsresult = dns_get_record($host, $recordtypes);
- foreach($dnsresult as $item) {
- $newitem["typeid"] = $item['type'];
- switch ($item['type']) {
- case 'A':
- $newitem["data"] = $item['ip'];
- break;
- case 'AAAA':
- $newitem["data"] = $item['ipv6'];
- break;
+ if ($recordtype != 0) {
+ //query one type at a time, querying multiple types in one call dns_get_record fails if one is not present..
+ $errreporting = error_reporting();
+ error_reporting($errreporting & ~E_WARNING);// dns_get_record throws a warning if nothing is resolved..
+ $dnsresult = dns_get_record($host, $recordtype);
+ error_reporting($errreporting);
+ if (is_array($dnsresult)) {
+ foreach($dnsresult as $item) {
+ $newitem["typeid"] = $item['type'];
+ switch ($item['type']) {
+ case 'A':
+ $newitem["data"] = $item['ip'];
+ break;
+ case 'AAAA':
+ $newitem["data"] = $item['ipv6'];
+ break;
+ }
+ $result[] = $newitem;
+ }
+ }
}
- $result[] = $newitem;
}
return $result;
}
diff --git a/config/haproxy-devel/www/haproxy_listeners_edit.php b/config/haproxy-devel/www/haproxy_listeners_edit.php
index 5b726d08..6998e099 100644
--- a/config/haproxy-devel/www/haproxy_listeners_edit.php
+++ b/config/haproxy-devel/www/haproxy_listeners_edit.php
@@ -811,7 +811,8 @@ $primaryfrontends = get_haproxy_frontends($excludefrontend);
<input type='text' name='dcertadv' size="64" id='dcertadv' <?if(isset($pconfig['dcertadv'])) echo 'value="'.htmlspecialchars($pconfig['dcertadv']).'"';?> />
<br/>
NOTE: Paste additional ssl options(without commas) to include on ssl listening options.<br/>
- some options: force-sslv3, force-tlsv10 force-tlsv11 force-tlsv12 no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
+ some options: force-sslv3, force-tlsv10 force-tlsv11 force-tlsv12 no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets<br/>
+ Example: no-sslv3 ciphers EECDH+aRSA+AES:TLSv1+kRSA+AES:TLSv1+kRSA+3DES
</td>
</tr>
<tr class="haproxy_ssloffloading_enabled haproxy_primary">
diff --git a/config/haproxy-devel/www/haproxy_pool_edit.php b/config/haproxy-devel/www/haproxy_pool_edit.php
index 5e38b12d..0824e45c 100644
--- a/config/haproxy-devel/www/haproxy_pool_edit.php
+++ b/config/haproxy-devel/www/haproxy_pool_edit.php
@@ -961,7 +961,7 @@ set by the 'retries' parameter.</div>
<td colspan="2" valign="top" class="listtopic">Advanced</td>
</tr>
<tr class="" align="left" id='Strict-Transport-Security'>
- <td width="22%" valign="top" class="vncell">Strict-Transport-Security</td>
+ <td width="22%" valign="top" class="vncell">HSTS Strict-Transport-Security</td>
<td width="78%" class="vtable" colspan="2">
When configured enables "HTTP Strict Transport Security" leave empty to disable. (only used on 'http' frontends)<br/>
<b>WARNING! the domain will only work over https with a valid certificate!</b><br/>
diff --git a/pkg_config.10.xml b/pkg_config.10.xml
index 6fcc9b65..d963f1d7 100644
--- a/pkg_config.10.xml
+++ b/pkg_config.10.xml
@@ -175,7 +175,7 @@
Supports ACLs for smart backend switching.]]></descr>
<website>http://haproxy.1wt.eu/</website>
<category>Services</category>
- <version>0.24</version>
+ <version>0.26</version>
<status>Release</status>
<required_version>2.2</required_version>
<config_file>https://packages.pfsense.org/packages/config/haproxy-devel/haproxy.xml</config_file>
@@ -189,7 +189,7 @@
<custom_name>haproxy-devel</custom_name>
<port>net/haproxy-devel</port>
</build_pbi>
- <build_options>WITH_OPENSSL_PORT=yes;haproxy_UNSET_FORCE=DPCRE;haproxy_SET_FORCE=OPENSSL SPCRE</build_options>
+ <build_options>WITH_OPENSSL_PORT=yes;haproxy_UNSET_FORCE=DPCRE;haproxy_SET_FORCE=OPENSSL SPCRE LUA</build_options>
</package>
<package>
<name>Apache with mod_security-dev</name>
@@ -262,7 +262,7 @@
<ports_after>net/avahi-app devel/dbus</ports_after>
</build_pbi>
<depends_on_package_pbi>avahi-0.6.31-##ARCH##.pbi</depends_on_package_pbi>
- <version>v1.09</version>
+ <version>1.09</version>
<status>BETA</status>
<required_version>2.2</required_version>
<config_file>https://packages.pfsense.org/packages/config/avahi/avahi.xml</config_file>
generated by cgit v1.2.3 (git 2.25.1) at 2024-08-20 11:39:35 +0000