Copyright (C) 2008 Remco Hoef All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ $shortcut_section = "haproxy"; require("guiconfig.inc"); require_once("haproxy.inc"); require_once("haproxy_utils.inc"); require_once("haproxy_htmllist.inc"); require_once("pkg_haproxy_tabs.inc"); $d_haproxyconfdirty_path = $g['varrun_path'] . "/haproxy.conf.dirty"; if (!is_array($config['installedpackages']['haproxy']['ha_pools']['item'])) { $config['installedpackages']['haproxy']['ha_pools']['item'] = array(); } $a_pools = &$config['installedpackages']['haproxy']['ha_pools']['item']; if (isset($_POST['id'])) $id = $_POST['id']; else $id = $_GET['id']; if (isset($_GET['dup'])) $id = $_GET['dup']; global $simplefields; $simplefields = array( "name","cookie","balance","transparent_clientip","transparent_interface", "check_type","checkinter","httpcheck_method","monitor_uri","monitor_httpversion","monitor_username","monitor_domain","monitor_agentport", "agent_check","agent_port","agent_inter", "connection_timeout","server_timeout","retries", "stats_enabled","stats_username","stats_password","stats_uri","stats_realm","stats_admin","stats_node_enabled","stats_node","stats_desc","stats_refresh"); $fields_servers=array(); $fields_servers[0]['name']="name"; $fields_servers[0]['columnheader']="Name"; $fields_servers[0]['colwidth']="20%"; $fields_servers[0]['type']="textbox"; $fields_servers[0]['size']="30"; $fields_servers[1]['name']="address"; $fields_servers[1]['columnheader']="Address"; $fields_servers[1]['colwidth']="10%"; $fields_servers[1]['type']="textbox"; $fields_servers[1]['size']="20"; $fields_servers[2]['name']="port"; $fields_servers[2]['columnheader']="Port"; $fields_servers[2]['colwidth']="5%"; $fields_servers[2]['type']="textbox"; $fields_servers[2]['size']="5"; $fields_servers[3]['name']="ssl"; $fields_servers[3]['columnheader']="SSL"; $fields_servers[3]['colwidth']="5%"; $fields_servers[3]['type']="checkbox"; $fields_servers[3]['size']="30"; $fields_servers[4]['name']="weight"; $fields_servers[4]['columnheader']="Weight"; $fields_servers[4]['colwidth']="8%"; $fields_servers[4]['type']="textbox"; $fields_servers[4]['size']="5"; $fields_servers[5]['name']="status"; $fields_servers[5]['columnheader']="Mode"; $fields_servers[5]['colwidth']="5%"; $fields_servers[5]['type']="select"; $fields_servers[5]['size']="5"; $fields_servers[5]['items']=&$a_servermodes; $fields_servers[6]['name']="advanced"; $fields_servers[6]['columnheader']="Advanced"; $fields_servers[6]['colwidth']="15%"; $fields_servers[6]['type']="textbox"; $fields_servers[6]['size']="20"; if (isset($id) && $a_pools[$id]) { $pconfig['advanced'] = base64_decode($a_pools[$id]['advanced']); $pconfig['advanced_backend'] = base64_decode($a_pools[$id]['advanced_backend']); $pconfig['a_servers']=&$a_pools[$id]['ha_servers']['item']; foreach($simplefields as $stat) $pconfig[$stat] = $a_pools[$id][$stat]; } if (isset($_GET['dup'])) unset($id); $changedesc = "Services: HAProxy: Backend server pool: "; $changecount = 0; if ($_POST) { $changecount++; unset($input_errors); $pconfig = $_POST; $reqdfields = explode(" ", "name"); $reqdfieldsn = explode(",", "Name"); do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); if ($_POST['stats_enabled']) { $reqdfields = explode(" ", "name stats_username stats_password stats_uri stats_realm"); $reqdfieldsn = explode(",", "Name,Stats Username,Stats Password,Stats Uri,Stats Realm"); do_input_validation($_POST, $reqdfields, $reqdfieldsn, &$input_errors); } if (preg_match("/[^a-zA-Z0-9\.\-_]/", $_POST['name'])) $input_errors[] = "The field 'Name' contains invalid characters."; if ($_POST['checkinter'] !== "" && !is_numeric($_POST['checkinter'])) $input_errors[] = "The field 'Check frequency' value is not a number."; if ($_POST['connection_timeout'] !== "" && !is_numeric($_POST['connection_timeout'])) $input_errors[] = "The field 'Connection timeout' value is not a number."; if ($_POST['server_timeout'] !== "" && !is_numeric($_POST['server_timeout'])) $input_errors[] = "The field 'Server timeout' value is not a number."; if ($_POST['retries'] !== "" && !is_numeric($_POST['retries'])) $input_errors[] = "The field 'Retries' value is not a number."; // the colon ":" is invalid in the username, other than that pretty much any character can be used. if (preg_match("/[^a-zA-Z0-9!-\/;-~ ]/", $_POST['stats_username'])) $input_errors[] = "The field 'Stats Username' contains invalid characters."; // the colon ":" can also be used in the password if (preg_match("/[^a-zA-Z0-9!-~ ]/", $_POST['stats_password'])) $input_errors[] = "The field 'Stats Password' contains invalid characters."; /* Ensure that our pool names are unique */ for ($i=0; isset($config['installedpackages']['haproxy']['ha_pools']['item'][$i]); $i++) if (($_POST['name'] == $config['installedpackages']['haproxy']['ha_pools']['item'][$i]['name']) && ($i != $id)) $input_errors[] = "This pool name has already been used. Pool names must be unique."; $a_servers = haproxy_htmllist_get_values($fields_servers); foreach($a_servers as $server){ $server_name = $server['name']; $server_address = $server['address']; $server_port = $server['port']; $server_weight = $server['weight']; if (preg_match("/[^a-zA-Z0-9\.\-_]/", $server_name)) $input_errors[] = "The field 'Name' contains invalid characters."; if (!is_ipaddr($server_address)) $input_errors[] = "The field 'Address' is not a valid ip address."; if (!preg_match("/.{2,}/", $server_name)) $input_errors[] = "The field 'Name' is required (and must be at least 2 characters)."; if (!preg_match("/.{2,}/", $server_address)) $input_errors[] = "The field 'Address' is required (and must be at least 2 characters)."; if (!is_numeric($server_weight)) $input_errors[] = "The field 'Weight' value is not a number."; if ($server_port && !is_numeric($server_port)) $input_errors[] = "The field 'Port' value is not a number."; } if (!$input_errors) { $pool = array(); if(isset($id) && $a_pools[$id]) $pool = $a_pools[$id]; if ($pool['name'] != $_POST['name']) { // name changed: if (!is_array($config['installedpackages']['haproxy']['ha_backends']['item'])) { $config['installedpackages']['haproxy']['ha_backends']['item'] = array(); } $a_backend = &$config['installedpackages']['haproxy']['ha_backends']['item']; for ( $i = 0; $i < count($a_backend); $i++) { if ($a_backend[$i]['backend_serverpool'] == $pool['name']) $a_backend[$i]['backend_serverpool'] = $_POST['name']; } } if($pool['name'] != "") $changedesc .= " modified pool: '{$pool['name']}'"; $pool['ha_servers']['item']=$a_servers; update_if_changed("name", $pool['name'], $_POST['name']); update_if_changed("cookie", $pool['cookie'], $_POST['cookie']); update_if_changed("advanced", $pool['advanced'], base64_encode($_POST['advanced'])); update_if_changed("advanced_backend", $pool['advanced_backend'], base64_encode($_POST['advanced_backend'])); update_if_changed("checkinter", $pool['checkinter'], $_POST['checkinter']); update_if_changed("monitor_uri", $pool['monitor_uri'], $_POST['monitor_uri']); global $simplefields; foreach($simplefields as $stat) update_if_changed($stat, $pool[$stat], $_POST[$stat]); if (isset($id) && $a_pools[$id]) { $a_pools[$id] = $pool; } else { $a_pools[] = $pool; } if ($changecount > 0) { touch($d_haproxyconfdirty_path); write_config($changedesc); /* echo "
";
			print_r($config);
			echo "
"; */ } header("Location: haproxy_pools.php"); exit; } $pconfig['a_servers']=&$a_pools[$id]['ha_servers']['item']; } $pfSversion = str_replace("\n", "", file_get_contents("/etc/version")); if(strstr($pfSversion, "1.2")) $one_two = true; $closehead = false; $pgtitle = "HAProxy: Backend server pool: Edit"; include("head.inc"); // 'processing' done, make all simple fields usable in html. foreach($simplefields as $field){ $pconfig[$field] = htmlspecialchars($pconfig[$field]); } ?>

Edit HAProxy Backend server pool
Name size="16" maxlength="16" />
Cookie size="64" />
This value will be checked in incoming requests, and the first operational pool possessing the same value will be selected. In return, in cookie insertion or rewrite modes, this value will be assigned to the cookie sent to the client. There is nothing wrong in having several servers sharing the same cookie value, and it is in fact somewhat common between normal and backup servers. See also the "cookie" keyword in backend section.
Server list
Balance
/>Round robin Each server is used in turns, according to their weights. This is the smoothest and fairest algorithm when the server's processing time remains equally distributed. This algorithm is dynamic, which means that server weights may be adjusted on the fly for slow starts for instance.
/>Static Round Robin Each server is used in turns, according to their weights. This algorithm is as similar to roundrobin except that it is static, which means that changing a server's weight on the fly will have no effect. On the other hand, it has no design limitation on the number of servers, and when a server goes up, it is always immediately reintroduced into the farm, once the full map is recomputed. It also uses slightly less CPU to run (around -1%).
/>Least Connections The server with the lowest number of connections receives the connection. Round-robin is performed within groups of servers of the same load to ensure that all servers will be used. Use of this algorithm is recommended where very long sessions are expected, such as LDAP, SQL, TSE, etc... but is not very well suited for protocols using short sessions such as HTTP. This algorithm is dynamic, which means that server weights may be adjusted on the fly for slow starts for instance.
/>Source The source IP address is hashed and divided by the total weight of the running servers to designate which server will receive the request. This ensures that the same client IP address will always reach the same server as long as no server goes down or up. If the hash result changes due to the number of running servers changing, many clients will be directed to a different server. This algorithm is generally used in TCP mode where no cookie may be inserted. It may also be used on the Internet to provide a best-effort stickyness to clients which refuse session cookies. This algorithm is static, which means that changing a server's weight on the fly will have no effect.
Transparent ClientIP onclick='updatevisibility();' /> Use Client-IP to connect to backend servers.
$name) { $interfaces2[$key]['name'] = $name; } echo_html_select("transparent_interface",$interfaces2,$pconfig['transparent_interface']?$pconfig['transparent_interface']:"lan","","updatevisibility();"); ?>Interface that will connect to the backend server. (this will generally be your LAN or OPT1(dmz) interface)

Connect transparently to the backend server's so the connection seams to come straight from the client ip address. For proper workings this requires the reply's traffic to pass through pfSense by means of correct routing. (uses the option "source 0.0.0.0 usesrc clientip")

Note : When this is enabled for a single backend HAProxy will run as 'root', which reduces security.
Per server pass thru ' size="64" />
NOTE: paste text into this box that you would like to pass thru. Applied to each 'server' line.
Backend pass thru
NOTE: paste text into this box that you would like to pass thru. Applied to the backend section.
 
Health checking
Health check method
Check frequency size="20" /> milliseconds
For HTTP/HTTPS defaults to 1000 if left blank. For TCP no check will be performed if left empty.
Http check method
OPTIONS is the method usually best to perform server checks, HEAD and GET can also be used
Http check URI size="64" />
Defaults to / if left blank.
Http check version size="64" />
Defaults to "HTTP/1.0" if left blank. Note that the Host field is mandatory in HTTP/1.1, and as a trick, it is possible to pass it after "\r\n" following the version string like this:
    "HTTP/1.1\r\nHost:\ www"
Also some hosts might require an accept parameter like this:
    "HTTP/1.0\r\nHost:\ webservername:8080\r\nAccept:\ */*"
Check with Username size="64" onchange="updatevisibility();" onkeyup="updatevisibility();" />
This is the username which will be used when connecting to MySQL/PostgreSQL server.
USE mysql;
CREATE USER ''@'<pfSenseIP>';
FLUSH PRIVILEGES;
Domain size="64" />
Agentport size="64" />
Fill in the TCP portnumber the healthcheck should be performed on.
 
Agent checks
Use agent checks onclick='updatevisibility();' /> Use a TCP connection to read an ASCII string of the form 100%,75%,drain,down (more about this in the haproxy manual)
Agent port size="64" />
Fill in the TCP portnumber the healthcheck should be performed on.
Agent interval size="64" />
Interval between two agent checks, defaults to 2000 ms.
 
Advanced settings
Connection timeout size="20" />
the time (in milliseconds) we give up if the connection does not complete within (default 30000).
Server timeout size="20" />
the time (in milliseconds) we accept to wait for data from the server, or for the server to accept data (default 30000).
Retries size="20" />
After a connection failure to a server, it is possible to retry, potentially on another server. This is useful if health-checks are too rare and you don't want the clients to see the failures. The number of attempts to reconnect is set by the 'retries' parameter.
 
Statistics
Stats Enabled onclick='updatevisibility();' />
Stats Realm size="64" />
EXAMPLE: haproxystats
Stats Uri size="64" />
EXAMPLE: /haproxy?stats
Stats Username size="64" />
Stats Password size="64" />
Stats Admin />
Stats Enable Node Name />
Stats Node size="64" />
The node name is displayed in the stats and helps to differentiate which server in a cluster is actually serving clients.
Leave blank to use the system name.
Stats Description size="64" />
Stats Refresh size="10" maxlength="30" />
Specify the refresh rate of the stats page in seconds, or specified time unit (us, ms, s, m, h, d).