Copyright (C) 2008 Remco Hoef Copyright (C) 2013 PiBa-NL merging (some of the) "haproxy-devel" changes from: Marcello Coutinho All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ require("guiconfig.inc"); require_once("haproxy.inc"); function get_certificat_usage($refid) { $usage = array(); $cert = lookup_cert($refid); if (is_cert_revoked($cert)) $usage[] = "Revoked"; if (is_webgui_cert($refid)) $usage[] = "webConfigurator"; if (is_user_cert($refid)) $usage[] = "User Cert"; if (is_openvpn_server_cert($refid)) $usage[] = "OpenVPN Server"; if (is_openvpn_client_cert($refid)) $usage[] = "OpenVPN Client"; if (is_ipsec_cert($cert['refid'])) $usage[] = "IPsec Tunnel"; if (is_captiveportal_cert($refid)) $usage[] = "Captive Portal"; return $usage; } /// This function (is intendet to) provides a uniform way to retrieve a list of use selectable certificates function get_certificates_server($get_includeWebCert=false) { global $config; $certificates=array(); $a_cert = &$config['cert']; foreach ($a_cert as $cert) { if ($get_ca == false && is_webgui_cert($cert['refid'])) continue; $selected = ""; $caname = ""; $inuse = ""; $revoked = ""; $ca = lookup_ca($cert['caref']); if ($ca) $caname = " (CA: {$ca['descr']})"; if ($pconfig['certref'] == $cert['refid']) $selected = "selected"; if (cert_in_use($cert['refid'])) $inuse = " *In Use"; if (is_cert_revoked($cert)) $revoked = " *Revoked"; $usagestr=""; $usage = get_certificat_usage($cert['refid']); foreach($usage as $use){ $usagestr .= " " . $use; } if ($usagestr != "") $usagestr = " (".trim($usagestr).")"; $certificates[$cert['refid']] = $cert['descr'] . $caname . $inuse . $revoked . $usagestr; } return $certificates; } function echo_html_select($name, $keyvaluelist, $selected, $listEmptyMessage="") { if (count($keyvaluelist)>0){ echo ""; } else { echo $listEmptyMessage; } } function haproxy_acl_select($mode) { global $a_acltypes; $seltext = ''; foreach ($a_acltypes as $expr) { if ($expr['mode'] == '' || $expr['mode'] == $mode) $seltext .= ""; } return $seltext; } $d_haproxyconfdirty_path = $g['varrun_path'] . "/haproxy.conf.dirty"; if (!is_array($config['installedpackages']['haproxy']['ha_backends']['item'])) { $config['installedpackages']['haproxy']['ha_backends']['item'] = array(); } $a_backend = &$config['installedpackages']['haproxy']['ha_backends']['item']; $a_pools = &$config['installedpackages']['haproxy']['ha_pools']['item']; if (isset($_POST['id'])) $id = $_POST['id']; else $id = $_GET['id']; if (isset($_GET['dup'])) $id = $_GET['dup']; if (isset($id) && $a_backend[$id]) { $pconfig['name'] = $a_backend[$id]['name']; $pconfig['desc'] = $a_backend[$id]['desc']; $pconfig['status'] = $a_backend[$id]['status']; $pconfig['type'] = $a_backend[$id]['type']; $pconfig['forwardfor'] = $a_backend[$id]['forwardfor']; $pconfig['httpclose'] = $a_backend[$id]['httpclose']; $pconfig['type'] = $a_backend[$id]['type']; $pconfig['extaddr'] = $a_backend[$id]['extaddr']; $pconfig['backend_serverpool'] = $a_backend[$id]['backend_serverpool']; $pconfig['max_connections'] = $a_backend[$id]['max_connections']; $pconfig['client_timeout'] = $a_backend[$id]['client_timeout']; $pconfig['port'] = $a_backend[$id]['port']; $pconfig['a_acl']=&$a_backend[$id]['ha_acls']['item']; $pconfig['advanced'] = base64_decode($a_backend[$id]['advanced']); $pconfig['ssloffloadcert'] = $a_backend[$id]['ssloffloadcert']; $pconfig['dcertadv'] = $a_backend[$id]['dcertadv']; $pconfig['ssloffload'] = $a_backend[$id]['ssloffload']; } if (isset($_GET['dup'])) unset($id); $changedesc = "Services: HAProxy: Frontend"; $changecount = 0; if ($_POST) { $changecount++; unset($input_errors); $pconfig = $_POST; $reqdfields = explode(" ", "name type port max_connections"); $reqdfieldsn = explode(",", "Name,Type,Port,Max connections"); do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['name'])) $input_errors[] = "The field 'Name' contains invalid characters."; if (!is_numeric($_POST['max_connections'])) $input_errors[] = "The field 'Max connections' value is not a number."; $ports = split(",", $_POST['port'] . ","); foreach($ports as $port) if ($port && !is_numeric($port)) $input_errors[] = "The field 'Port' value is not a number."; if (!is_numeric($_POST['client_timeout'])) $input_errors[] = "The field 'Client timeout' value is not a number."; /* Ensure that our pool names are unique */ for ($i=0; isset($config['installedpackages']['haproxy']['ha_backends']['item'][$i]); $i++) if (($_POST['name'] == $config['installedpackages']['haproxy']['ha_backends']['item'][$i]['name']) && ($i != $id)) $input_errors[] = "This frontend name has already been used. Frontend names must be unique."; $a_acl=array(); $acl_names=array(); for($x=0; $x<99; $x++) { $acl_name=$_POST['acl_name'.$x]; $acl_expression=$_POST['acl_expression'.$x]; $acl_value=$_POST['acl_value'.$x]; if ($acl_name) { // check for duplicates if (in_array($acl_name, $acl_names)) { $input_errors[] = "The name '$acl_name' is duplicate."; } $acl_names[]=$acl_name; $acl=array(); $acl['name']=$acl_name; $acl['expression']=$acl_expression; $acl['value']=$acl_value; $a_acl[]=$acl; if (preg_match("/[^a-zA-Z0-9\.\-_]/", $acl_name)) $input_errors[] = "The field 'Name' contains invalid characters."; if (!preg_match("/.{2,}/", $acl_value)) $input_errors[] = "The field 'Value' is required."; if (!preg_match("/.{2,}/", $acl_name)) $input_errors[] = "The field 'Name' is required."; } } $pconfig['a_acl']=$a_acl; if (!$input_errors) { $backend = array(); if(isset($id) && $a_backend[$id]) $backend = $a_backend[$id]; if($backend['name'] != "") $changedesc .= " modified '{$backend['name']}' pool:"; update_if_changed("name", $backend['name'], $_POST['name']); update_if_changed("description", $backend['desc'], $_POST['desc']); update_if_changed("status", $backend['status'], $_POST['status']); update_if_changed("type", $backend['type'], $_POST['type']); update_if_changed("cookie_name", $backend['cookie_name'], $_POST['cookie_name']); update_if_changed("forwardfor", $backend['forwardfor'], $_POST['forwardfor']); update_if_changed("httpclose", $backend['httpclose'], $_POST['httpclose']); update_if_changed("type", $backend['type'], $_POST['type']); update_if_changed("port", $backend['port'], $_POST['port']); update_if_changed("extaddr", $backend['extaddr'], $_POST['extaddr']); update_if_changed("backend_serverpool", $backend['backend_serverpool'], $_POST['backend_serverpool']); update_if_changed("max_connections", $backend['max_connections'], $_POST['max_connections']); update_if_changed("client_timeout", $backend['client_timeout'], $_POST['client_timeout']); update_if_changed("advanced", $backend['advanced'], base64_encode($_POST['advanced'])); update_if_changed("ssloffloadcert", $backend['ssloffloadcert'], $_POST['ssloffloadcert']); update_if_changed("dcertadv", $backend['dcertadv'], $_POST['dcertadv']); update_if_changed("ssloffload", $backend['ssloffload'], $_POST['ssloffload']); $backend['ha_acls']['item'] = $a_acl; if (isset($id) && $a_backend[$id]) { $a_backend[$id] = $backend; } else { $a_backend[] = $backend; } if ($changecount > 0) { touch($d_haproxyconfdirty_path); write_config($changedesc); } header("Location: haproxy_listeners.php"); exit; } } $pfSversion = str_replace("\n", "", file_get_contents("/etc/version")); if(strstr($pfSversion, "1.2")) $one_two = true; $pgtitle = "HAProxy: Frontend: Edit"; include("head.inc"); ?>

Edit haproxy listener

Name

size="25" maxlength="25">

Description

size="64">

Status

External address

If you want this rule to apply to another IP address than the IP address of the interface chosen above, select it here (you need to define Virtual IP addresses on the first). Also note that if you are trying to redirect connections on the LAN select the "any" option.

External port

size="30" maxlength="500">

The port to listen to. To specify multiple ports, separate with a comma (,). EXAMPLE: 80,443

Backend server pool

Type

Access Control lists

>

Name

Expression

Value

For more information about ACL's please see HAProxy Documentation Section 7 - Using ACL's

Advanced settings
Max connections	size="10" maxlength="10">
Client timeout	size="10" maxlength="10"> the time (in milliseconds) we accept to wait for data from the client, or for the client to accept data (30000).
Use 'forwardfor' option	> The 'forwardfor' option creates an HTTP 'X-Forwarded-For' header which contains the client's IP address. This is useful to let the final web server know what the client address was (eg for statistics on domains)
Use 'httpclose' option	> The 'httpclose' option removes any 'Connection' header both ways, and adds a 'Connection: close' header in each direction. This makes it easier to disable HTTP keep-alive than the previous 4-rules block.
Advanced pass thru	<?php echo $pconfig['advanced']; ?> NOTE: paste text into this box that you would like to pass thru.

SSL Offloading
Use Offloading	onclick="updatevisibility();">Use Offloading The SSL Offloading will reduce web servers load by encrypt data to users on internet and send it without encrytion to internal servers.
Certificate	No Certificates defined. Create one under System > Cert Manager.'); ?> NOTE: choose the cert to use on this frontend.
Advanced ssl options	size="10" maxlength="64"> NOTE: Paste additional ssl options(without commas) to include on ssl listening options. some options: force-sslv3, force-tlsv10 force-tlsv11 force-tlsv12 no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 no-tls-tickets


NOTE: You must add a firewall rule permitting access to this frontend!