Merge pull request #4659 from sarthurdev/T7715

haproxy: T7715: Add rule matching on subdomains

5 files changed, 39 insertions, 28 deletions

diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2
index b4c3505c9..c73f71722 100644
--- a/data/templates/load-balancing/haproxy.cfg.j2
+++ b/data/templates/load-balancing/haproxy.cfg.j2
@@ -121,12 +121,16 @@ frontend {{ front }}
     # rule {{ rule }}
 {%                 if rule_config.domain_name is vyos_defined %}
 {%                     set rule_options = 'hdr(host)' %}
+{%                     set domain_prefix = '' %}
 {%                     if rule_config.ssl is vyos_defined %}
 {%                         set ssl_rule_translate = {'req-ssl-sni': 'req_ssl_sni', 'ssl-fc-sni': 'ssl_fc_sni', 'ssl-fc-sni-end': 'ssl_fc_sni_end'} %}
 {%                         set rule_options = ssl_rule_translate[rule_config.ssl] %}
 {%                     endif %}
+{%                     if rule_config.wildcard_domain is vyos_defined %}
+{%                         set domain_prefix = '-m end .' %}
+{%                     endif %}
 {%                     for domain in rule_config.domain_name %}
-    acl {{ rule }} {{ rule_options }} -i {{ domain }}
+    acl {{ rule }} {{ rule_options }} -i {{ domain_prefix }}{{ domain }}
 {%                     endfor %}
 {%                 endif %}
 {# path url #}
@@ -217,12 +221,16 @@ backend {{ back }}
 {%             for rule, rule_config in back_config.rule.items() %}
 {%                 if rule_config.domain_name is vyos_defined and rule_config.set.server is vyos_defined %}
 {%                     set rule_options = 'hdr(host)' %}
+{%                     set domain_prefix = '' %}
 {%                     if rule_config.ssl is vyos_defined %}
 {%                         set ssl_rule_translate = {'req-ssl-sni': 'req_ssl_sni', 'ssl-fc-sni': 'ssl_fc_sni', 'ssl-fc-sni-end': 'ssl_fc_sni_end'} %}
 {%                         set rule_options = ssl_rule_translate[rule_config.ssl] %}
 {%                     endif %}
+{%                     if rule_config.wildcard_domain is vyos_defined %}
+{%                         set domain_prefix = '-m end .' %}
+{%                     endif %}
 {%                     for domain in rule_config.domain_name %}
-    acl {{ rule }} {{ rule_options }} -i {{ domain }}
+    acl {{ rule }} {{ rule_options }} -i {{ domain_prefix }}{{ domain }}
 {%                     endfor %}
     use-server {{ rule_config.set.server }} if {{ rule }}
 {%                 endif %}
diff --git a/interface-definitions/include/haproxy/rule-backend.xml.i b/interface-definitions/include/haproxy/rule-backend.xml.i
index 5faf09a96..20263c23c 100644
--- a/interface-definitions/include/haproxy/rule-backend.xml.i
+++ b/interface-definitions/include/haproxy/rule-backend.xml.i
@@ -12,19 +12,7 @@
     <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage>
   </properties>
   <children>
-    <leafNode name="domain-name">
-      <properties>
-        <help>Domain name to match</help>
-        <valueHelp>
-          <format>txt</format>
-          <description>Domain address to match</description>
-        </valueHelp>
-        <constraint>
-          <validator name="fqdn"/>
-        </constraint>
-        <multi/>
-      </properties>
-    </leafNode>
+    #include <include/haproxy/rule-match-domain.xml.i>
     <node name="set">
       <properties>
         <help>Proxy modifications</help>
diff --git a/interface-definitions/include/haproxy/rule-frontend.xml.i b/interface-definitions/include/haproxy/rule-frontend.xml.i
index d2e7a38c3..6237fd44b 100644
--- a/interface-definitions/include/haproxy/rule-frontend.xml.i
+++ b/interface-definitions/include/haproxy/rule-frontend.xml.i
@@ -12,19 +12,7 @@
     <constraintErrorMessage>Proxy rule number must be between 1 and 10000</constraintErrorMessage>
   </properties>
   <children>
-    <leafNode name="domain-name">
-      <properties>
-        <help>Domain name to match</help>
-        <valueHelp>
-          <format>txt</format>
-          <description>Domain address to match</description>
-        </valueHelp>
-        <constraint>
-          <validator name="fqdn"/>
-        </constraint>
-        <multi/>
-      </properties>
-    </leafNode>
+    #include <include/haproxy/rule-match-domain.xml.i>
     <node name="set">
       <properties>
         <help>Proxy modifications</help>
diff --git a/interface-definitions/include/haproxy/rule-match-domain.xml.i b/interface-definitions/include/haproxy/rule-match-domain.xml.i
new file mode 100644
index 000000000..2ec61a940
--- /dev/null
+++ b/interface-definitions/include/haproxy/rule-match-domain.xml.i
@@ -0,0 +1,21 @@
+<!-- include start from haproxy/rule-match-domain.xml.i -->
+<leafNode name="domain-name">
+    <properties>
+    <help>Domain name to match</help>
+    <valueHelp>
+        <format>txt</format>
+        <description>Domain address to match</description>
+    </valueHelp>
+    <constraint>
+        <validator name="fqdn"/>
+    </constraint>
+    <multi/>
+    </properties>
+</leafNode>
+<leafNode name="wildcard-domain">
+    <properties>
+    <help>Match subdomains of specified domain(s)</help>
+    <valueless/>
+    </properties>
+</leafNode>
+<!-- include end -->
diff --git a/smoketest/scripts/cli/test_load-balancing_haproxy.py b/smoketest/scripts/cli/test_load-balancing_haproxy.py
index a63a3e7f1..2bc11638e 100755
--- a/smoketest/scripts/cli/test_load-balancing_haproxy.py
+++ b/smoketest/scripts/cli/test_load-balancing_haproxy.py
@@ -202,6 +202,7 @@ class TestLoadBalancingReverseProxy(VyOSUnitTestSHIM.TestCase):
         rule_ten = '10'
         rule_twenty = '20'
         rule_thirty = '30'
+        rule_forty = '40'
         send_proxy = 'send-proxy'
         max_connections = '1000'
 
@@ -216,6 +217,9 @@ class TestLoadBalancingReverseProxy(VyOSUnitTestSHIM.TestCase):
         self.cli_set(base_path + ['service', frontend, 'rule', rule_twenty, 'set', 'backend', bk_second_name])
         self.cli_set(base_path + ['service', frontend, 'rule', rule_thirty, 'url-path', 'end', '/test'])
         self.cli_set(base_path + ['service', frontend, 'rule', rule_thirty, 'set', 'backend', bk_second_name])
+        self.cli_set(base_path + ['service', frontend, 'rule', rule_forty, 'domain-name', domain_bk_second])
+        self.cli_set(base_path + ['service', frontend, 'rule', rule_forty, 'set', 'backend', bk_second_name])
+        self.cli_set(base_path + ['service', frontend, 'rule', rule_forty, 'wildcard-domain'])
 
         self.cli_set(back_base + [bk_first_name, 'mode', mode])
         self.cli_set(back_base + [bk_first_name, 'server', bk_first_name, 'address', bk_server_first])
@@ -248,6 +252,8 @@ class TestLoadBalancingReverseProxy(VyOSUnitTestSHIM.TestCase):
         self.assertIn(f'use_backend {bk_second_name} if {rule_twenty}', config)
         self.assertIn(f'acl {rule_thirty} path -i -m end /test', config)
         self.assertIn(f'use_backend {bk_second_name} if {rule_thirty}', config)
+        self.assertIn(f'acl {rule_forty} hdr(host) -i -m end .{domain_bk_second}', config)
+        self.assertIn(f'use_backend {bk_second_name} if {rule_forty}', config)
 
         # Backend
         self.assertIn(f'backend {bk_first_name}', config)