Merge pull request #4806 from alexandr-san4ez/T7906-current

haproxy: T7906: Probing of a port other than the one to which normal traffic is sent

3 files changed, 89 insertions, 4 deletions

diff --git a/data/templates/load-balancing/haproxy.cfg.j2 b/data/templates/load-balancing/haproxy.cfg.j2
index c73f71722..79fb5e369 100644
--- a/data/templates/load-balancing/haproxy.cfg.j2
+++ b/data/templates/load-balancing/haproxy.cfg.j2
@@ -250,7 +250,30 @@ backend {{ back }}
 {%         if back_config.server is vyos_defined %}
 {%             set ssl_back =  'ssl ca-file /run/haproxy/' ~ back_config.ssl.ca_certificate ~ '.pem' if back_config.ssl.ca_certificate is vyos_defined else ('ssl verify none' if back_config.ssl.no_verify is vyos_defined else '') %}
 {%             for server, server_config in back_config.server.items() %}
-    server {{ server }} {{ server_config.address }}:{{ server_config.port }}{{ ' check' if server_config.check is vyos_defined }}{{ ' backup' if server_config.backup is vyos_defined }}{{ ' send-proxy' if server_config.send_proxy is vyos_defined }}{{ ' send-proxy-v2' if server_config.send_proxy_v2 is vyos_defined }} {{ ssl_back }}
+{%                 set address = server_config.address %}
+{%                 set port = server_config.port %}
+{#                 Build optional flags #}
+{%                 set flags = [] %}
+{%                 if server_config.check is vyos_defined %}
+{%                     set _ = flags.append('check') %}
+{#                     Build nested 'check port' flag like this: '... check port 8080' #}
+{%                     if server_config.check.port is vyos_defined %}
+{%                         set _ = flags.extend(['port', server_config.check.port]) %}
+{%                     endif %}
+{%                 endif %}
+{%                 if server_config.backup is vyos_defined %}
+{%                     set _ = flags.append('backup') %}
+{%                 endif %}
+{%                 if server_config.send_proxy is vyos_defined %}
+{%                     set _ = flags.append('send-proxy') %}
+{%                 endif %}
+{%                 if server_config.send_proxy_v2 is vyos_defined %}
+{%                     set _ = flags.append('send-proxy-v2') %}
+{%                 endif %}
+{%                 if ssl_back %}
+{%                     set _ = flags.append(ssl_back) %}
+{%                 endif %}
+    server {{ server }} {{ address }}:{{ port }} {{ flags | select | join(' ') }}
 {%             endfor %}
 {%         endif %}
 {%         if back_config.timeout.check is vyos_defined %}
diff --git a/interface-definitions/load-balancing_haproxy.xml.in b/interface-definitions/load-balancing_haproxy.xml.in
index 399197366..163ffa869 100644
--- a/interface-definitions/load-balancing_haproxy.xml.in
+++ b/interface-definitions/load-balancing_haproxy.xml.in
@@ -253,12 +253,14 @@
                       <valueless/>
                     </properties>
                   </leafNode>
-                  <leafNode name="check">
+                  <node name="check">
                     <properties>
                       <help>Active health check backend server</help>
-                      <valueless/>
                     </properties>
-                  </leafNode>
+                    <children>
+                      #include <include/port-number.xml.i>
+                    </children>
+                  </node>
                   #include <include/port-number.xml.i>
                   <leafNode name="send-proxy">
                     <properties>
diff --git a/smoketest/scripts/cli/test_load-balancing_haproxy.py b/smoketest/scripts/cli/test_load-balancing_haproxy.py
index 8efa259f5..8223c6f60 100755
--- a/smoketest/scripts/cli/test_load-balancing_haproxy.py
+++ b/smoketest/scripts/cli/test_load-balancing_haproxy.py
@@ -488,6 +488,66 @@ class TestLoadBalancingReverseProxy(VyOSUnitTestSHIM.TestCase):
         config = read_file(HAPROXY_CONF)
         self.assertIn(f'option smtpchk', config)
 
+    def test_reverse_proxy_tcp_health_checks_custom_port(self):
+        # Define variables
+        service = 'my-tcp-api'
+        mode = 'tcp'
+        front_port = '9000'
+        backend = 'bk-01'
+        balance = 'round-robin'
+        servers = [
+            ('srv01', '192.0.2.11', '9001', '9011'),
+            ('srv02', '192.0.2.12', '9002', None),
+            ('srv03', '192.0.2.13', '9003', '9013'),
+        ]
+
+        # Configure frontend
+        self.cli_set(base_path + ['service', service, 'backend', backend])
+        self.cli_set(base_path + ['service', service, 'mode', mode])
+        self.cli_set(base_path + ['service', service, 'port', front_port])
+
+        # Configure backend
+        self.cli_set(base_path + ['backend', backend, 'balance', balance])
+        self.cli_set(base_path + ['backend', backend, 'mode', mode])
+
+        # Configure backend servers
+        for name, addr, port, check_port in servers:
+            base_server_path = base_path + ['backend', backend, 'server', name]
+            self.cli_set(base_server_path + ['address', addr])
+            self.cli_set(base_server_path + ['port', port])
+
+            if check_port:
+                self.cli_set(base_server_path + ['check', 'port', check_port])
+            else:
+                self.cli_set(base_server_path + ['check'])
+
+        # Commit and read config
+        self.cli_commit()
+        config = read_file(HAPROXY_CONF)
+        config_lines = [line.strip() for line in config.splitlines()]
+
+        # Validate Frontend
+        self.assertIn(f'frontend {service}', config)
+        self.assertIn(f'bind [::]:{front_port} v4v6', config)
+        self.assertIn(f'mode {mode}', config)
+        self.assertIn(f'default_backend {backend}', config)
+
+        # Validate Backend
+        self.assertIn(f'backend {backend}', config)
+        self.assertIn('balance roundrobin', config)
+        self.assertIn(f'mode {mode}', config)
+
+        # Validate backend servers
+        for name, addr, port, check_port in servers:
+            with self.subTest(name=name):
+                expected_line = f'server {name} {addr}:{port}'
+                if check_port:
+                    expected_line += f' check port {check_port}'
+                else:
+                    expected_line += f' check'
+
+                self.assertIn(expected_line, config_lines)
+
     def test_reverse_proxy_logging(self):
         # Setup base
         self.base_config()