From e201bd35511e1a000ffa21a4194d234634cfd76c Mon Sep 17 00:00:00 2001 From: Viacheslav Hletenko Date: Fri, 19 May 2023 09:57:11 +0000 Subject: T5222: Refactoring load-balancing reverse-proxy Improve and refactoring "load-balancing reverse-proxy" - replace 'reverse-proxy server ' => 'reverse-proxy service ' - replace 'reverse-proxy global-parameters tls ' => 'reverse-proxy global-parameters tls-version-min xxx' => 'reverse-proxy global-parameters ssl-bind-ciphers xxx' - replace 'reverse-proxy service https rule set server 'xxx' => 'reverse-proxy service https rule set backend 'xxx' 'service https rule domain-name xxx' set as multinode --- .../include/haproxy/rule-backend.xml.i | 131 +++++++++++++++++++ .../include/haproxy/rule-frontend.xml.i | 131 +++++++++++++++++++ interface-definitions/include/haproxy/rule.xml.i | 130 ------------------- .../load-balancing-haproxy.xml.in | 141 ++++++++++----------- 4 files changed, 329 insertions(+), 204 deletions(-) create mode 100644 interface-definitions/include/haproxy/rule-backend.xml.i create mode 100644 interface-definitions/include/haproxy/rule-frontend.xml.i delete mode 100644 interface-definitions/include/haproxy/rule.xml.i (limited to 'interface-definitions') diff --git a/interface-definitions/include/haproxy/rule-backend.xml.i b/interface-definitions/include/haproxy/rule-backend.xml.i new file mode 100644 index 000000000..a6832d693 --- /dev/null +++ b/interface-definitions/include/haproxy/rule-backend.xml.i @@ -0,0 +1,131 @@ + + + + Proxy rule number + + u32:1-10000 + Number for this proxy rule + + + + + Proxy rule number must be between 1 and 10000 + + + + + Domain name to match + + txt + Domain address to match + + + + + + + + + + Proxy modifications + + + + + Set URL location + + url + Set URL location + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + Server name + + [-_a-zA-Z0-9]+ + + Server name must be alphanumeric and can contain hyphen and underscores + + + + + + + SSL match options + + req-ssl-sni ssl-fc-sni + + + req-ssl-sni + SSL Server Name Indication (SNI) request match + + + ssl-fc-sni + SSL frontend connection Server Name Indication match + + + ssl-fc-sni-end + SSL frontend match end of connection Server Name Indication + + + (req-ssl-sni|ssl-fc-sni|ssl-fc-sni-end) + + + + + + URL path match + + + + + Begin URL match + + url + Begin URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + End URL match + + url + End URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + Exactly URL match + + url + Exactly URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + + + diff --git a/interface-definitions/include/haproxy/rule-frontend.xml.i b/interface-definitions/include/haproxy/rule-frontend.xml.i new file mode 100644 index 000000000..001ae2d80 --- /dev/null +++ b/interface-definitions/include/haproxy/rule-frontend.xml.i @@ -0,0 +1,131 @@ + + + + Proxy rule number + + u32:1-10000 + Number for this proxy rule + + + + + Proxy rule number must be between 1 and 10000 + + + + + Domain name to match + + txt + Domain address to match + + + + + + + + + + Proxy modifications + + + + + Set URL location + + url + Set URL location + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + Backend name + + [-_a-zA-Z0-9]+ + + Server name must be alphanumeric and can contain hyphen and underscores + + + + + + + SSL match options + + req-ssl-sni ssl-fc-sni + + + req-ssl-sni + SSL Server Name Indication (SNI) request match + + + ssl-fc-sni + SSL frontend connection Server Name Indication match + + + ssl-fc-sni-end + SSL frontend match end of connection Server Name Indication + + + (req-ssl-sni|ssl-fc-sni|ssl-fc-sni-end) + + + + + + URL path match + + + + + Begin URL match + + url + Begin URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + End URL match + + url + End URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + Exactly URL match + + url + Exactly URL + + + ^\/[\w\-.\/]+$ + + Incorrect URL format + + + + + + + + diff --git a/interface-definitions/include/haproxy/rule.xml.i b/interface-definitions/include/haproxy/rule.xml.i deleted file mode 100644 index 9d9f63c9c..000000000 --- a/interface-definitions/include/haproxy/rule.xml.i +++ /dev/null @@ -1,130 +0,0 @@ - - - - Proxy rule number - - u32:1-10000 - Number for this proxy rule - - - - - Proxy rule number must be between 1 and 10000 - - - - - Domain name to match - - txt - Domain address to match - - - - - - - - - Proxy modifications - - - - - Set URL location - - url - Set URL location - - - ^\/[\w\-.\/]+$ - - Incorrect URL format - - - - - Server name - - [-_a-zA-Z0-9]+ - - Server name must be alphanumeric and can contain hyphen and underscores - - - - - - - SSL match options - - req-ssl-sni ssl-fc-sni - - - req-ssl-sni - SSL Server Name Indication (SNI) request match - - - ssl-fc-sni - SSL frontend connection Server Name Indication match - - - ssl-fc-sni-end - SSL frontend match end of connection Server Name Indication - - - (req-ssl-sni|ssl-fc-sni|ssl-fc-sni-end) - - - - - - URL path match - - - - - Begin URL match - - url - Begin URL - - - ^\/[\w\-.\/]+$ - - Incorrect URL format - - - - - - End URL match - - url - End URL - - - ^\/[\w\-.\/]+$ - - Incorrect URL format - - - - - - Exactly URL match - - url - Exactly URL - - - ^\/[\w\-.\/]+$ - - Incorrect URL format - - - - - - - - diff --git a/interface-definitions/load-balancing-haproxy.xml.in b/interface-definitions/load-balancing-haproxy.xml.in index f0c0ee8ce..e295dcb63 100644 --- a/interface-definitions/load-balancing-haproxy.xml.in +++ b/interface-definitions/load-balancing-haproxy.xml.in @@ -7,9 +7,9 @@ Configure reverse-proxy - + - Frontend server name + Frontend service name #include @@ -37,7 +37,7 @@ #include #include #include - #include + #include Redirect HTTP to HTTPS @@ -102,7 +102,7 @@ - #include + #include Backend server name @@ -161,78 +161,71 @@ - + - Transport Layer Security (TLS) options + Cipher algorithms ("cipher suite") used during SSL/TLS handshake for all frontend servers + + ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 + + + ecdhe-ecdsa-aes128-gcm-sha256 + ecdhe-ecdsa-aes128-gcm-sha256 + + + ecdhe-rsa-aes128-gcm-sha256 + ecdhe-rsa-aes128-gcm-sha256 + + + ecdhe-ecdsa-aes256-gcm-sha384 + ecdhe-ecdsa-aes256-gcm-sha384 + + + ecdhe-rsa-aes256-gcm-sha384 + ecdhe-rsa-aes256-gcm-sha384 + + + ecdhe-ecdsa-chacha20-poly1305 + ecdhe-ecdsa-chacha20-poly1305 + + + ecdhe-rsa-chacha20-poly1305 + ecdhe-rsa-chacha20-poly1305 + + + dhe-rsa-aes128-gcm-sha256 + dhe-rsa-aes128-gcm-sha256 + + + dhe-rsa-aes256-gcm-sha384 + dhe-rsa-aes256-gcm-sha384 + + + (ecdhe-ecdsa-aes128-gcm-sha256|ecdhe-rsa-aes128-gcm-sha256|ecdhe-ecdsa-aes256-gcm-sha384|ecdhe-rsa-aes256-gcm-sha384|ecdhe-ecdsa-chacha20-poly1305|ecdhe-rsa-chacha20-poly1305|dhe-rsa-aes128-gcm-sha256|dhe-rsa-aes256-gcm-sha384) + + - - - - Cipher algorithms ("cipher suite") used during SSL/TLS handshake for all frontend servers - - ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 - - - ecdhe-ecdsa-aes128-gcm-sha256 - ecdhe-ecdsa-aes128-gcm-sha256 - - - ecdhe-rsa-aes128-gcm-sha256 - ecdhe-rsa-aes128-gcm-sha256 - - - ecdhe-ecdsa-aes256-gcm-sha384 - ecdhe-ecdsa-aes256-gcm-sha384 - - - ecdhe-rsa-aes256-gcm-sha384 - ecdhe-rsa-aes256-gcm-sha384 - - - ecdhe-ecdsa-chacha20-poly1305 - ecdhe-ecdsa-chacha20-poly1305 - - - ecdhe-rsa-chacha20-poly1305 - ecdhe-rsa-chacha20-poly1305 - - - dhe-rsa-aes128-gcm-sha256 - dhe-rsa-aes128-gcm-sha256 - - - dhe-rsa-aes256-gcm-sha384 - dhe-rsa-aes256-gcm-sha384 - - - (ecdhe-ecdsa-aes128-gcm-sha256|ecdhe-rsa-aes128-gcm-sha256|ecdhe-ecdsa-aes256-gcm-sha384|ecdhe-rsa-aes256-gcm-sha384|ecdhe-ecdsa-chacha20-poly1305|ecdhe-rsa-chacha20-poly1305|dhe-rsa-aes128-gcm-sha256|dhe-rsa-aes256-gcm-sha384) - - - - ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 - - - - Specify the minimum required TLS version - - 1.2 1.3 - - - 1.2 - TLS v1.2 - - - 1.3 - TLS v1.3 - - - (1.2|1.3) - - - 1.3 - - - + ecdhe-ecdsa-aes128-gcm-sha256 ecdhe-rsa-aes128-gcm-sha256 ecdhe-ecdsa-aes256-gcm-sha384 ecdhe-rsa-aes256-gcm-sha384 ecdhe-ecdsa-chacha20-poly1305 ecdhe-rsa-chacha20-poly1305 dhe-rsa-aes128-gcm-sha256 dhe-rsa-aes256-gcm-sha384 + + + + Specify the minimum required TLS version + + 1.2 1.3 + + + 1.2 + TLS v1.2 + + + 1.3 + TLS v1.3 + + + (1.2|1.3) + + + 1.3 + #include -- cgit v1.2.3