diff options
| author | Christian Breunig <christian@breunig.cc> | 2026-10-19 20:59:03 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2026-10-19 20:59:03 +0200 |
| commit | 5777c0e5a6abd404fcd72e38dcecf2338fcf5926 (patch) | |
| tree | df1e31b354a1f3c896b560cad92569f32903381e /src | |
| parent | 063dbd32777d83635ac1ca82bc25fbb56bebb035 (diff) | |
| parent | e18992ca19b64561e873957a4c2590487601f4f5 (diff) | |
| download | vyos-1x-5777c0e5a6abd404fcd72e38dcecf2338fcf5926.tar.gz vyos-1x-5777c0e5a6abd404fcd72e38dcecf2338fcf5926.zip | |
Merge pull request #5529 from ch4nn0n/T9097-haproxy-check-ssl
haproxy: T9097: add ssl checks-only for TLS health checks
Diffstat (limited to 'src')
| -rw-r--r-- | src/conf_mode/load-balancing_haproxy.py | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/src/conf_mode/load-balancing_haproxy.py b/src/conf_mode/load-balancing_haproxy.py index 3a7fa7f01..cd43d47fc 100644 --- a/src/conf_mode/load-balancing_haproxy.py +++ b/src/conf_mode/load-balancing_haproxy.py @@ -142,6 +142,18 @@ def verify(lb): if {'no_verify', 'ca_certificate'} <= set(back_config['ssl']): raise ConfigError(f'backend {back} cannot have both ssl options no-verify and ca-certificate set!') + if 'checks_only' in back_config['ssl']: + if not {'no_verify', 'ca_certificate'} & set(back_config['ssl']): + raise ConfigError( + f'backend {back} ssl option checks-only requires no-verify or ca-certificate!' + ) + if not any( + 'check' in server for server in back_config['server'].values() + ): + raise ConfigError( + f'backend {back} ssl option checks-only requires at least one server with check enabled!' + ) + tmp = dict_search('ssl.ca_certificate', back_config) if tmp: verify_pki_ca_certificate(lb, tmp) |