From f052b1e4fcec837f819fe05dbd38a0ed87e39333 Mon Sep 17 00:00:00 2001 From: PiBa-NL Date: Sun, 14 Sep 2014 16:47:39 +0200 Subject: haproxy-devel improvements -server certificate check options -client-certificate support -logging options -unix sockets for faster backend>frontend communication --- config/haproxy-devel/haproxy_pool_edit.php | 177 ++++++++++++++++++++++------- 1 file changed, 137 insertions(+), 40 deletions(-) (limited to 'config/haproxy-devel/haproxy_pool_edit.php') diff --git a/config/haproxy-devel/haproxy_pool_edit.php b/config/haproxy-devel/haproxy_pool_edit.php index cabc6e52..aa1fa5da 100644 --- a/config/haproxy-devel/haproxy_pool_edit.php +++ b/config/haproxy-devel/haproxy_pool_edit.php @@ -46,6 +46,10 @@ if (isset($_POST['id'])) $id = $_POST['id']; else $id = $_GET['id']; + +$tmp = get_backend_id($id); +if (is_numeric($tmp)) + $id = $tmp; if (isset($_GET['dup'])) $id = $_GET['dup']; @@ -53,57 +57,120 @@ if (isset($_GET['dup'])) global $simplefields; $simplefields = array( "name","balance","transparent_clientip","transparent_interface", -"check_type","checkinter","httpcheck_method","monitor_uri","monitor_httpversion","monitor_username","monitor_domain","monitor_agentport", +"check_type","checkinter","log-health-checks","httpcheck_method","monitor_uri","monitor_httpversion","monitor_username","monitor_domain","monitor_agentport", "agent_check","agent_port","agent_inter", "connection_timeout","server_timeout","retries", "stats_enabled","stats_username","stats_password","stats_uri","stats_scope","stats_realm","stats_admin","stats_node","stats_desc","stats_refresh", "persist_stick_expire","persist_stick_tablesize","persist_stick_length","persist_stick_cookiename","persist_sticky_type", "persist_cookie_enabled","persist_cookie_name","persist_cookie_mode","persist_cookie_cachable", -"strict_transport_security" +"strict_transport_security","cookie_attribute_secure" ); +$primaryfrontends = get_haproxy_frontends(); +$none = array(); +$none['']['name']="Address+Port:"; +$primaryfrontends = $none + $primaryfrontends; + $fields_servers=array(); $fields_servers[0]['name']="status"; $fields_servers[0]['columnheader']="Mode"; $fields_servers[0]['colwidth']="5%"; $fields_servers[0]['type']="select"; -$fields_servers[0]['size']="5"; +$fields_servers[0]['size']="70px"; $fields_servers[0]['items']=&$a_servermodes; $fields_servers[1]['name']="name"; $fields_servers[1]['columnheader']="Name"; $fields_servers[1]['colwidth']="20%"; $fields_servers[1]['type']="textbox"; $fields_servers[1]['size']="30"; -$fields_servers[2]['name']="address"; -$fields_servers[2]['columnheader']="Address"; -$fields_servers[2]['colwidth']="10%"; -$fields_servers[2]['type']="textbox"; -$fields_servers[2]['size']="20"; -$fields_servers[3]['name']="port"; -$fields_servers[3]['columnheader']="Port"; -$fields_servers[3]['colwidth']="5%"; +$fields_servers[2]['name']="forwardto"; +$fields_servers[2]['columnheader']="Forwardto"; +$fields_servers[2]['colwidth']="15%"; +$fields_servers[2]['type']="select"; +$fields_servers[2]['size']="100px"; +$fields_servers[2]['items']=&$primaryfrontends; +$fields_servers[3]['name']="address"; +$fields_servers[3]['columnheader']="Address"; +$fields_servers[3]['colwidth']="10%"; $fields_servers[3]['type']="textbox"; -$fields_servers[3]['size']="5"; -$fields_servers[4]['name']="ssl"; -$fields_servers[4]['columnheader']="SSL"; +$fields_servers[3]['size']="20"; +$fields_servers[4]['name']="port"; +$fields_servers[4]['columnheader']="Port"; $fields_servers[4]['colwidth']="5%"; -$fields_servers[4]['type']="checkbox"; -$fields_servers[4]['size']="30"; -$fields_servers[5]['name']="weight"; -$fields_servers[5]['columnheader']="Weight"; -$fields_servers[5]['colwidth']="8%"; -$fields_servers[5]['type']="textbox"; -$fields_servers[5]['size']="5"; -$fields_servers[6]['name']="cookie"; -$fields_servers[6]['columnheader']="Cookie"; -$fields_servers[6]['colwidth']="10%"; +$fields_servers[4]['type']="textbox"; +$fields_servers[4]['size']="5"; +$fields_servers[5]['name']="ssl"; +$fields_servers[5]['columnheader']="SSL"; +$fields_servers[5]['colwidth']="5%"; +$fields_servers[5]['type']="checkbox"; +$fields_servers[5]['size']="30"; +$fields_servers[6]['name']="weight"; +$fields_servers[6]['columnheader']="Weight"; +$fields_servers[6]['colwidth']="8%"; $fields_servers[6]['type']="textbox"; -$fields_servers[6]['size']="10"; -$fields_servers[7]['name']="advanced"; -$fields_servers[7]['columnheader']="Advanced"; -$fields_servers[7]['colwidth']="15%"; -$fields_servers[7]['type']="textbox"; -$fields_servers[7]['size']="20"; +$fields_servers[6]['size']="5"; + +$listitem_none['']['name']="None"; + +$certs_ca = haproxy_get_certificates('ca'); +$certs_ca = $listitem_none + $certs_ca; +$certs_client = haproxy_get_certificates('server,user'); +$certs_client = $listitem_none + $certs_client; +$certs_crl = haproxy_get_crls(); +$certs_crl = $listitem_none + $certs_crl; + +$fields_servers_details=array(); +$fields_servers_details[0]['name']="sslserververify"; +$fields_servers_details[0]['columnheader']="Check certificate"; +$fields_servers_details[0]['description']="SSL servers only, The server certificate will be verified against the CA and CRL certificate configured below."; +$fields_servers_details[0]['colwidth']="5%"; +$fields_servers_details[0]['type']="checkbox"; +$fields_servers_details[0]['size']="5"; +$fields_servers_details[1]['name']="verifyhost"; +$fields_servers_details[1]['columnheader']="Certificate check CN"; +$fields_servers_details[1]['description']="SSL servers only, when set, must match the hostnames in the subject and subjectAlternateNames of the certificate provided by the server."; +$fields_servers_details[1]['colwidth']="5%"; +$fields_servers_details[1]['type']="textbox"; +$fields_servers_details[1]['size']="50"; +$fields_servers_details[2]['name']="ssl-server-ca"; +$fields_servers_details[2]['columnheader']="CA"; +$fields_servers_details[2]['description']="SSL servers only, Select the CA authority to check the server certificate against."; +$fields_servers_details[2]['colwidth']="15%"; +$fields_servers_details[2]['type']="select"; +$fields_servers_details[2]['size']="200px"; +$fields_servers_details[2]['items']=$certs_ca; +$fields_servers_details[3]['name']="ssl-server-crl"; +$fields_servers_details[3]['columnheader']="CRL"; +$fields_servers_details[3]['description']="SSL servers only, Select the CRL to check revoked certificates."; +$fields_servers_details[3]['colwidth']="15%"; +$fields_servers_details[3]['type']="select"; +$fields_servers_details[3]['size']="200px"; +$fields_servers_details[3]['items']=$certs_crl; +$fields_servers_details[4]['name']="ssl-server-clientcert"; +$fields_servers_details[4]['columnheader']="Client certificate"; +$fields_servers_details[4]['description']="SSL servers only, This certificate will be sent if the server send a client certificate request."; +$fields_servers_details[4]['colwidth']="15%"; +$fields_servers_details[4]['type']="select"; +$fields_servers_details[4]['size']="200px"; +$fields_servers_details[4]['items']=$certs_client; +$fields_servers_details[5]['name']="cookie"; +$fields_servers_details[5]['columnheader']="Cookie"; +$fields_servers_details[5]['description']="Persistence only, Used to identify server when cookie persistence is configured for the backend."; +$fields_servers_details[5]['colwidth']="10%"; +$fields_servers_details[5]['type']="textbox"; +$fields_servers_details[5]['size']="10"; +$fields_servers_details[6]['name']="maxconn"; +$fields_servers_details[6]['columnheader']="Max conn"; +$fields_servers_details[6]['description']="Tuning, If the number of incoming concurrent requests goes higher than this value, they will be queued"; +$fields_servers_details[6]['colwidth']="15%"; +$fields_servers_details[6]['type']="textbox"; +$fields_servers_details[6]['size']="10"; +$fields_servers_details[7]['name']="advanced"; +$fields_servers_details[7]['columnheader']="Advanced"; +$fields_servers_details[7]['description']="Advanced, Allows for adding custom HAProxy settings to the server. These are passed as written, use escaping where needed."; +$fields_servers_details[7]['colwidth']="15%"; +$fields_servers_details[7]['type']="textbox"; +$fields_servers_details[7]['size']="80"; if (isset($id) && $a_pools[$id]) { $pconfig['advanced'] = base64_decode($a_pools[$id]['advanced']); @@ -183,7 +250,7 @@ if ($_POST) { if (($_POST['name'] == $config['installedpackages']['haproxy']['ha_pools']['item'][$i]['name']) && ($i != $id)) $input_errors[] = "This pool name has already been used. Pool names must be unique."; - $a_servers = haproxy_htmllist_get_values($fields_servers); + $a_servers = haproxy_htmllist_get_values(array_merge($fields_servers,$fields_servers_details)); foreach($a_servers as $server){ $server_name = $server['name']; $server_address = $server['address']; @@ -193,8 +260,14 @@ if ($_POST) { if (preg_match("/[^a-zA-Z0-9\.\-_]/", $server_name)) $input_errors[] = "The field 'Name' contains invalid characters."; - if (!is_ipaddr($server_address) && !is_hostname($server_address)) - $input_errors[] = "The field 'Address' is not a valid ip address or hostname."; + if (!isset($server['forwardto']) || $server['forwardto'] == "") { + if (!is_ipaddr($server_address) && !is_hostname($server_address) && !haproxy_is_frontendname($server_address)) + $input_errors[] = "The field 'Address' for server $server_name is not a valid ip address or hostname." . $server_address; + } else { + if ( ($server_address && $server_address != "") || ($server_port && !is_numeric($server_port))) { + $input_errors[] = "'Address' and 'port' should be empty when a 'Forwardto' frontend is chosen other than 'Address+Port'."; + } + } if (!preg_match("/.{2,}/", $server_name)) $input_errors[] = "The field 'Name' is required (and must be at least 2 characters)."; @@ -209,7 +282,7 @@ if ($_POST) { if ($_POST['strict_transport_security'] !== "" && !is_numeric($_POST['strict_transport_security'])) $input_errors[] = "The field 'Strict-Transport-Security' is not empty or a number."; - if (!$input_errors) { +// if (!$input_errors) { $pool = array(); if(isset($id) && $a_pools[$id]) $pool = $a_pools[$id]; @@ -244,7 +317,7 @@ if ($_POST) { } else { $a_pools[] = $pool; } - + if (!$input_errors) { if ($changecount > 0) { touch($d_haproxyconfdirty_path); write_config($changedesc); @@ -276,6 +349,7 @@ foreach($simplefields as $field){ ?>