aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--config/haproxy-devel/haproxy.inc92
-rwxr-xr-xconfig/haproxy-devel/haproxy_global.php30
-rw-r--r--config/haproxy-devel/haproxy_listeners.php4
-rw-r--r--config/haproxy-devel/haproxy_listeners_edit.php21
-rw-r--r--config/haproxy-devel/haproxy_pool_edit.php63
5 files changed, 167 insertions, 43 deletions
diff --git a/config/haproxy-devel/haproxy.inc b/config/haproxy-devel/haproxy.inc
index 3a0ca782..2099f646 100644
--- a/config/haproxy-devel/haproxy.inc
+++ b/config/haproxy-devel/haproxy.inc
@@ -158,6 +158,88 @@ $a_sticky_type['stick_rdp_cookie'] = array('name' => 'Stick on RDP-cookie',
'descr' => "Uses a RDP-Cookie send by the mstsc client, note that not all clients send this.",
'cookiedescr' => 'EXAMPLE: msts or mstshash');
+if(!function_exists('group_ports')){
+// function group_ports() is present in pfSense 2.2 in util.inc
+/* create ranges of sequential port numbers (200:215) and remove duplicates */
+function group_ports($ports) {
+ if (!is_array($ports) || empty($ports))
+ return;
+
+ $uniq = array();
+ foreach ($ports as $port) {
+ if (is_portrange($port)) {
+ list($begin, $end) = explode(":", $port);
+ if ($begin > $end) {
+ $aux = $begin;
+ $begin = $end;
+ $end = $aux;
+ }
+ for ($i = $begin; $i <= $end; $i++)
+ if (!in_array($i, $uniq))
+ $uniq[] = $i;
+ } else if (is_port($port)) {
+ if (!in_array($port, $uniq))
+ $uniq[] = $port;
+ }
+ }
+ sort($uniq, SORT_NUMERIC);
+
+ $result = array();
+ foreach ($uniq as $idx => $port) {
+ if ($idx == 0) {
+ $result[] = $port;
+ continue;
+ }
+
+ $last = end($result);
+ if (is_portrange($last))
+ list($begin, $end) = explode(":", $last);
+ else
+ $begin = $end = $last;
+
+ if ($port == ($end+1)) {
+ $end++;
+ $result[count($result)-1] = "{$begin}:{$end}";
+ } else {
+ $result[] = $port;
+ }
+ }
+
+ return $result;
+}
+}
+
+function haproxy_portoralias_to_list($port_or_alias) {
+ // input: a port or aliasname: 80 https MyPortAlias
+ // returns: a array of ports and portranges 80 443 8000:8010
+ global $config;
+ $portresult = array();
+ if (is_alias($port_or_alias)) {
+ if (is_array($config['aliases']['alias'])) {
+ foreach ($config['aliases']['alias'] as $alias) {
+ if ($alias['name'] == $port_or_alias && preg_match("/port/i", $alias['type'])) {
+ $ports = explode(' ',$alias['address']);
+ foreach($ports as $port) {
+ $portresults = haproxy_portoralias_to_list($port);
+ $portresult = array_merge($portresult, $portresults);
+ }
+ return $portresult;
+ }
+ }
+ }
+ } else if (is_portrange($port_or_alias)) {
+ return (array)$port_or_alias;
+ } else if (is_port($port_or_alias)) {
+ if (getservbyname($port_or_alias, "tcp"))
+ return (array)getservbyname($port_or_alias, "tcp");
+ if (getservbyname($port_or_alias, "udp"))
+ return (array)getservbyname($port_or_alias, "udp");
+ return (array)$port_or_alias;
+ }
+ else
+ return null;
+}
+
function haproxy_custom_php_deinstall_command() {
exec("cd /var/db/pkg && pkg_delete `ls | grep haproxy`");
exec("rm /usr/local/pkg/haproxy*");
@@ -838,9 +920,13 @@ function haproxy_writeconf($configpath) {
// Process and add bind directives for ports
$ip = haproxy_interface_ip($bind['extaddr']);
if ($ip){
- foreach($ports as $port) {
- if($port) {
- $listenip .= "\tbind\t\t\t$ip:{$port} {$ssl_info} {$advanced_bind}\n";
+ foreach($ports as $alias_or_port) {
+ if($alias_or_port) {
+ $portsnumeric = group_ports(haproxy_portoralias_to_list($alias_or_port));
+ foreach($portsnumeric as $portnumeric) {
+ $portnumeric = str_replace(":","-",$portnumeric);
+ $listenip .= "\tbind\t\t\t$ip:{$portnumeric} {$ssl_info} {$advanced_bind}\n";
+ }
}
}
}
diff --git a/config/haproxy-devel/haproxy_global.php b/config/haproxy-devel/haproxy_global.php
index 5e4d96eb..44f01dc5 100755
--- a/config/haproxy-devel/haproxy_global.php
+++ b/config/haproxy-devel/haproxy_global.php
@@ -174,20 +174,6 @@ function enable_change(enable_change) {
<div id="mainarea">
<table class="tabcont" width="100%" border="0" cellpadding="6" cellspacing="0">
<tr>
- <td colspan="2" valign="top" class="listtopic">Recalculate certificate chain.</td>
- </tr>
- <tr>
- <td width="22%" valign="top" class="vncell">&nbsp;</td>
- <td width="78%" class="vtable">
- <input type="hidden" name="calculate_certificate_chain" id="calculate_certificate_chain" />
- <input type="button" class="formbtn" value="Recalculate certificate chains" onclick="$('calculate_certificate_chain').value='true';document.iform.submit();" />
- <br/>
- This can be required after certificates have been created or imported. As pfSense 2.1.0 currently does not
- always keep track of these dependencies which might be required to create a proper certificate chain when using SSLoffloading.
- </td>
- </tr>
-
- <tr>
<td colspan="2" valign="top" class="listtopic">General settings</td>
</tr>
<tr>
@@ -393,7 +379,8 @@ function enable_change(enable_change) {
<tr>
<td width="22%" valign="top" class="vncell">&nbsp;</td>
<td width="78%" class="vtable">
- <textarea name='advanced' rows="4" cols="70" id='advanced'><?php echo $pconfig['advanced']; ?></textarea>
+ <? $textrowcount = max(substr_count($pconfig['advanced'],"\n"), 2) + 2; ?>
+ <textarea name='advanced' rows="<?=$textrowcount;?>" cols="70" id='advanced'><?php echo $pconfig['advanced']; ?></textarea>
<br/>
NOTE: paste text into this box that you would like to pass thru in the global settings area.
</td>
@@ -404,6 +391,19 @@ function enable_change(enable_change) {
</td>
</tr>
<tr>
+ <td colspan="2" valign="top" class="listtopic">Recalculate certificate chain.</td>
+ </tr>
+ <tr>
+ <td width="22%" valign="top" class="vncell">&nbsp;</td>
+ <td width="78%" class="vtable">
+ <input type="hidden" name="calculate_certificate_chain" id="calculate_certificate_chain" />
+ <input type="button" class="formbtn" value="Recalculate certificate chains" onclick="$('calculate_certificate_chain').value='true';document.iform.submit();" />(Other changes on this page will be lost)
+ <br/>
+ This can be required after certificates have been created or imported. As pfSense 2.1.0 currently does not
+ always keep track of these dependencies which might be required to create a proper certificate chain when using SSLoffloading.
+ </td>
+ </tr>
+ <tr>
<td colspan="2" valign="top" class="listtopic">Configuration synchronization</td>
</tr>
<tr>
diff --git a/config/haproxy-devel/haproxy_listeners.php b/config/haproxy-devel/haproxy_listeners.php
index a9630b2d..b259c6fb 100644
--- a/config/haproxy-devel/haproxy_listeners.php
+++ b/config/haproxy-devel/haproxy_listeners.php
@@ -167,14 +167,14 @@ include("head.inc");
$acls = get_frontend_acls($frontend);
$isaclset = "";
foreach ($acls as $acl) {
- $isaclset .= "&#10;" . $acl['descr'];
+ $isaclset .= "&#10;" . htmlspecialchars($acl['descr']);
}
if ($isaclset)
echo "<img src=\"$img_acl\" title=\"" . gettext("acl's used") . ": {$isaclset}\" border=\"0\" />";
$isadvset = "";
- if ($frontend['advanced_bind']) $isadvset .= "Advanced bind: {$frontend['advanced_bind']}\r\n";
+ if ($frontend['advanced_bind']) $isadvset .= "Advanced bind: ".htmlspecialchars($frontend['advanced_bind'])."\r\n";
if ($frontend['advanced']) $isadvset .= "Advanced pass thru setting used\r\n";
if ($isadvset)
echo "<img src=\"$img_adv\" title=\"" . gettext("Advanced settings set") . ": {$isadvset}\" border=\"0\" />";
diff --git a/config/haproxy-devel/haproxy_listeners_edit.php b/config/haproxy-devel/haproxy_listeners_edit.php
index 2a9ac6b7..5bc039b7 100644
--- a/config/haproxy-devel/haproxy_listeners_edit.php
+++ b/config/haproxy-devel/haproxy_listeners_edit.php
@@ -57,8 +57,6 @@ function haproxy_js_acl_select($mode) {
return $seltext;
}
-$d_haproxyconfdirty_path = $g['varrun_path'] . "/haproxy.conf.dirty";
-
if (!is_array($config['installedpackages']['haproxy']['ha_backends']['item'])) {
$config['installedpackages']['haproxy']['ha_backends']['item'] = array();
}
@@ -157,8 +155,8 @@ if ($_POST) {
$ports = split(",", $_POST['port'] . ",");
foreach($ports as $port)
- if ($port && !is_numeric($port))
- $input_errors[] = "The field 'Port' value is not a number.";
+ if ($port && !is_numeric($port) && !is_portoralias($port))
+ $input_errors[] = "The field 'Port' value '".htmlspecialchars($port)."' is not a number or alias thereof.";
if ($_POST['client_timeout'] !== "" && !is_numeric($_POST['client_timeout']))
$input_errors[] = "The field 'Client timeout' value is not a number.";
@@ -249,6 +247,8 @@ $interfaces = haproxy_get_bindable_interfaces();
.haproxy_primary{}
.haproxy_secondary{display:none;}
</style>
+ <script type="text/javascript" src="/javascript/suggestions.js"></script>
+ <script type="text/javascript" src="/javascript/autosuggest.js"></script>
</head>
<body link="#0000CC" vlink="#0000CC" alink="#0000CC">
@@ -257,7 +257,6 @@ $interfaces = haproxy_get_bindable_interfaces();
<script type="text/javascript" src="/javascript/scriptaculous/scriptaculous.js"></script>
<?php endif; ?>
-
<script type="text/javascript">
function htmllist_get_select_options(tableId) {
var seltext;
@@ -446,8 +445,8 @@ $interfaces = haproxy_get_bindable_interfaces();
<tr class="haproxy_primary" align="left">
<td width="22%" valign="top" class="vncellreq">External port</td>
<td width="78%" class="vtable" colspan="2">
- <input name="port" type="text" <?if(isset($pconfig['port'])) echo "value=\"{$pconfig['port']}\"";?> size="10" maxlength="500" />
- <div>The port to listen to. To specify multiple ports, separate with a comma (,). EXAMPLE: 80,443</div>
+ <input name="port" id="port" type="text" <?if(isset($pconfig['port'])) echo "value=\"{$pconfig['port']}\"";?> size="10" maxlength="500" />
+ <div>The port to listen to. To specify multiple ports, separate with a comma (,). EXAMPLE: 80,8000</div>
</td>
</tr>
<tr class="haproxy_primary" align="left">
@@ -548,7 +547,8 @@ $interfaces = haproxy_get_bindable_interfaces();
<tr align="left">
<td width="22%" valign="top" class="vncell">Advanced pass thru</td>
<td width="78%" class="vtable" colspan="2">
- <textarea name='advanced' rows="4" cols="70" id='advanced'><?php echo htmlspecialchars($pconfig['advanced']); ?></textarea>
+ <? $textrowcount = max(substr_count($pconfig['advanced'],"\n"), 2) + 2; ?>
+ <textarea name='advanced' rows="<?=$textrowcount;?>" cols="70" id='advanced'><?php echo htmlspecialchars($pconfig['advanced']); ?></textarea>
<br/>
NOTE: paste text into this box that you would like to pass thru.
</td>
@@ -599,7 +599,7 @@ $interfaces = haproxy_get_bindable_interfaces();
<tr class="haproxy_ssloffloading_enabled haproxy_primary" align="left">
<td width="22%" valign="top" class="vncell">Advanced ssl options</td>
<td width="78%" class="vtable" colspan="2">
- <input type='text' name='dcertadv' size="64" id='dcertadv' <?if(isset($pconfig['dcertadv'])) echo "value=\"{$pconfig['dcertadv']}\"";?> maxlength="64" />
+ <input type='text' name='dcertadv' size="64" id='dcertadv' <?if(isset($pconfig['dcertadv'])) echo 'value="'.htmlspecialchars($pconfig['dcertadv']).'"';?> />
<br/>
NOTE: Paste additional ssl options(without commas) to include on ssl listening options.<br/>
some options: force-sslv3, force-tlsv10 force-tlsv11 force-tlsv12 no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets
@@ -640,6 +640,9 @@ $interfaces = haproxy_get_bindable_interfaces();
<script type="text/javascript">
totalrows = <?php echo $counter; ?>;
updatevisibility();
+
+ var customarray = <?= json_encode(get_alias_list(array("port", "url_ports", "urltable_ports"))) ?>;
+ var oTextbox1 = new AutoSuggestControl(document.getElementById("port"), new StateSuggestions(customarray));
</script>
<?php
haproxy_htmllist_js();
diff --git a/config/haproxy-devel/haproxy_pool_edit.php b/config/haproxy-devel/haproxy_pool_edit.php
index e546af22..726dab30 100644
--- a/config/haproxy-devel/haproxy_pool_edit.php
+++ b/config/haproxy-devel/haproxy_pool_edit.php
@@ -221,12 +221,8 @@ if ($_POST) {
$pool['ha_servers']['item']=$a_servers;
- update_if_changed("name", $pool['name'], $_POST['name']);
- update_if_changed("cookie", $pool['cookie'], $_POST['cookie']);
update_if_changed("advanced", $pool['advanced'], base64_encode($_POST['advanced']));
update_if_changed("advanced_backend", $pool['advanced_backend'], base64_encode($_POST['advanced_backend']));
- update_if_changed("checkinter", $pool['checkinter'], $_POST['checkinter']);
- update_if_changed("monitor_uri", $pool['monitor_uri'], $_POST['monitor_uri']);
global $simplefields;
foreach($simplefields as $stat)
@@ -308,6 +304,18 @@ foreach($simplefields as $field){
}
}
}
+ function toggleCSSdisplay(cssID)
+ {
+ var ss = document.styleSheets;
+ for (var i=0; i<ss.length; i++) {
+ var rules = ss[i].cssRules || ss[i].rules;
+ for (var j=0; j<rules.length; j++) {
+ if (rules[j].selectorText === cssID) {
+ rules[j].style.display = rules[j].style.display == "none" ? "" : "none";
+ }
+ }
+ }
+ }
function updatevisibility()
{
@@ -383,11 +391,36 @@ foreach($simplefields as $field){
</tr>
<tr align="left">
<td class="vncell" colspan="3"><strong>Server list</strong>
+ <span style="float:right;">
+ Toggle serverlist help. <a onclick="toggleCSSdisplay('.haproxy_help_serverlist');" title="<?php echo gettext("Help"); ?>"><img style="vertical-align:middle" src="/themes/<?php echo $g['theme']; ?>/images/icons/icon_help.gif" border="0" alt="help" /></a>
+ </span>
<?
$counter=0;
$a_servers = $pconfig['a_servers'];
haproxy_htmllist("tableA_servers", $a_servers, $fields_servers);
?>
+ <table class="haproxy_help_serverlist" style="border:1px dashed green" cellspacing="0">
+ <tr><td class="vncell">
+ Mode: </td><td class="vncell">Active: server will be used normally<br/>
+ Backup: server is only used in load balancing when all other non-backup servers are unavailable<br/>
+ Disabled: server is marked down in maintenance mode<br/>
+ Inactive: server will not be available for use
+ </td></tr><tr><td class="vncell">
+ Name: </td><td class="vncell">Used to as a name for the server in for example the stats<br/>EXAMPLE: MyWebServer
+ </td></tr><tr><td class="vncell">
+ Address: </td><td class="vncell">IP or hostname(only resolved on start-up.)<br/>EXAMPLE: 192.168.1.22 , fe80::1000:2000:3000:4000%em0 , WebServer1.localdomain
+ </td></tr><tr><td class="vncell">
+ Port: </td><td class="vncell">The port of the backend.<br/>EXAMPLE: 80 or 443<br/>
+ </td></tr><tr><td class="vncell">
+ SSL: </td><td class="vncell">Is the backend using SSL (commonly with port 443)<br/>
+ </td></tr><tr><td class="vncell">
+ Weight: </td><td class="vncell">A weight between 0 and 256, this setting can be used when multiple servers on different hardware need to be balanced with with a different part the traffic. A server with weight 0 wont get new traffic. Default if empty: 1
+ </td></tr><tr><td class="vncell">
+ Cookie: </td><td class="vncell">the value of the cookie used to identify a server (only when cookie-persistence is enabled below)
+ </td></tr><tr><td class="vncell">
+ Advanced: </td><td class="vncell">More advanced settings like rise,fall,error-limit,send-proxy and others can be configured here.<br/>For a full list of options see the <a target="_blank" href="http://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.2">HAProxy manual: Server and default-server options</a>
+ </td></tr>
+ </table>
</td>
</tr>
<tr align="left">
@@ -459,6 +492,7 @@ foreach($simplefields as $field){
<tr align="left">
<td width="22%" valign="top" class="vncell">Transparent ClientIP</td>
<td width="78%" class="vtable" colspan="2">
+ WARNING Activating this option will load rules in IPFW and might interfere with CaptivePortal and possibly other services due to the way server return traffic must be 'captured' with a automatically created fwd rule. This also breaks directly accessing the (web)server on the ports configured above. Also a automatic sloppy pf rule is made to allow HAProxy to server traffic.<br/>
<input id="transparent_clientip" name="transparent_clientip" type="checkbox" value="yes" <?php if ($pconfig['transparent_clientip']=='yes') echo "checked"; ?> onclick='updatevisibility();' />
Use Client-IP to connect to backend servers.
<div class="haproxy_transparent_clientip">
@@ -479,13 +513,13 @@ foreach($simplefields as $field){
For proper workings this requires the reply's traffic to pass through pfSense by means of correct routing.
(uses the option "source 0.0.0.0 usesrc clientip")
<br/><br/>
- Note : When this is enabled for a single backend HAProxy will run as 'root', which reduces security.
+ Note : When this is enabled for a single backend HAProxy will run as 'root' instead of chrooting to a lower privileged user, this reduces security in case of a a bit.
</td>
</tr>
<tr align="left">
<td width="22%" valign="top" class="vncell">Per server pass thru</td>
<td width="78%" class="vtable" colspan="2">
- <input type="text" name='advanced' id='advanced' value='<?php echo $pconfig['advanced']; ?>' size="64" />
+ <input type="text" name='advanced' id='advanced' value='<?php echo htmlspecialchars($pconfig['advanced']); ?>' size="64" />
<br/>
NOTE: paste text into this box that you would like to pass thru. Applied to each 'server' line.
</td>
@@ -494,7 +528,8 @@ foreach($simplefields as $field){
<tr align="left">
<td width="22%" valign="top" class="vncell">Backend pass thru</td>
<td width="78%" class="vtable" colspan="2">
- <textarea rows="4" cols="70" name='advanced_backend' id='advanced_backend'><?php echo $pconfig['advanced_backend']; ?></textarea>
+ <? $textrowcount = max(substr_count($pconfig['advanced_backend'],"\n"), 2) + 2; ?>
+ <textarea rows="<?=$textrowcount;?>" cols="70" name='advanced_backend' id='advanced_backend'><?php echo htmlspecialchars($pconfig['advanced_backend']); ?></textarea>
<br/>
NOTE: paste text into this box that you would like to pass thru. Applied to the backend section.
</td>
@@ -629,10 +664,10 @@ set by the 'retries' parameter.</div>
</td>
</tr>
<tr><td>&nbsp;</td></tr>
- <tr>
+ <tr>
<td colspan="2" valign="top" class="listtopic">Cookie persistence</td>
- </tr>
- <tr align="left">
+ </tr>
+ <tr align="left">
<td width="22%" valign="top" class="vncell">Cookie Enabled</td>
<td width="78%" class="vtable" colspan="2">
<input id="persist_cookie_enabled" name="persist_cookie_enabled" type="checkbox" value="yes" <?php if ($pconfig['persist_cookie_enabled']=='yes') echo "checked"; ?> onclick='updatevisibility();' />
@@ -664,7 +699,7 @@ set by the 'retries' parameter.</div>
<br/>
<textarea readonly="yes" cols="60" rows="2" id="persist_cookie_mode_description" name="persist_cookie_mode_description" style="padding:5px; border:1px dashed #990000; background-color: #ffffff; color: #000000; font-size: 8pt;"></textarea>
</td>
- </tr>
+ </tr>
<tr class="haproxy_cookie_visible" align="left">
<td width="22%" valign="top" class="vncell">Cookie Cachable</td>
<td width="78%" class="vtable" colspan="2">
@@ -673,11 +708,11 @@ set by the 'retries' parameter.</div>
</td>
</tr>
<tr><td>&nbsp;</td></tr>
- <tr>
+ <tr>
<td colspan="2" valign="top" class="listtopic">Stick-table persistence</td>
- </tr>
+ </tr>
<tr><td class="vncell"></td><td class="vncell">These options are used to make sure seperate requests from a single client go to the same backend. This can be required for servers that keep track of for example a shopping cart.</td></tr>
- <tr align="left">
+ <tr align="left">
<td width="22%" valign="top" class="vncell">Stick tables</td>
<td width="78%" class="vtable" colspan="2">
<?