summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--interface-definitions/https.xml18
-rw-r--r--python/vyos/defaults.py2
-rwxr-xr-xsrc/conf_mode/https.py61
3 files changed, 71 insertions, 10 deletions
diff --git a/interface-definitions/https.xml b/interface-definitions/https.xml
index 13d5c43ea..7a87133f3 100644
--- a/interface-definitions/https.xml
+++ b/interface-definitions/https.xml
@@ -9,7 +9,7 @@
<priority>1001</priority>
</properties>
<children>
- <leafNode name="listen-address">
+ <tagNode name="listen-addresses">
<properties>
<help>Addresses to listen for HTTPS requests</help>
<valueHelp>
@@ -20,13 +20,25 @@
<format>ipv6</format>
<description>HTTPS IPv6 address</description>
</valueHelp>
- <multi/>
+ <valueHelp>
+ <format>'*'</format>
+ <description>any</description>
+ </valueHelp>
<constraint>
<validator name="ipv4-address"/>
<validator name="ipv6-address"/>
+ <regex>^\\*$</regex>
</constraint>
</properties>
- </leafNode>
+ <children>
+ <leafNode name="server-names">
+ <properties>
+ <help>Server names: exact, wildcard, regex, or '_' (any)</help>
+ <multi/>
+ </properties>
+ </leafNode>
+ </children>
+ </tagNode>
<node name="certificates">
<properties>
<help>TLS certificates</help>
diff --git a/python/vyos/defaults.py b/python/vyos/defaults.py
index 3e4c02562..85d27d60d 100644
--- a/python/vyos/defaults.py
+++ b/python/vyos/defaults.py
@@ -29,7 +29,7 @@ cfg_vintage = 'vyatta'
commit_lock = '/opt/vyatta/config/.lock'
https_data = {
- 'listen_address' : [ '127.0.0.1' ]
+ 'listen_addresses' : { '*': ['_'] }
}
api_data = {
diff --git a/src/conf_mode/https.py b/src/conf_mode/https.py
index 289eacf69..d5aa1f5b3 100755
--- a/src/conf_mode/https.py
+++ b/src/conf_mode/https.py
@@ -40,12 +40,21 @@ server {
return 302 https://$server_name$request_uri;
}
+{% for addr, names in listen_addresses.items() %}
server {
# SSL configuration
#
+{% if addr == '*' %}
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
+{% else %}
+ listen {{ addr }}:443 ssl;
+{% endif %}
+
+{% for name in names %}
+ server_name {{ name }};
+{% endfor %}
{% if vyos_cert %}
include {{ vyos_cert.conf }};
@@ -57,9 +66,42 @@ server {
include snippets/snakeoil.conf;
{% endif %}
-{% for l_addr in listen_address %}
- server_name {{ l_addr }};
-{% endfor %}
+ # proxy settings for HTTP API, if enabled; 503, if not
+ location ~ /(retrieve|configure) {
+{% if api %}
+ proxy_pass http://localhost:{{ api.port }};
+ proxy_buffering off;
+{% else %}
+ return 503;
+{% endif %}
+ }
+
+ error_page 501 502 503 =200 @50*_json;
+
+ location @50*_json {
+ default_type application/json;
+ return 200 '{"error": "Start service in configuration mode: set service https api"}';
+ }
+
+}
+{% else %}
+server {
+ # SSL configuration
+ #
+ listen 443 ssl default_server;
+ listen [::]:443 ssl default_server;
+
+ server_name _;
+
+{% if vyos_cert %}
+ include {{ vyos_cert.conf }};
+{% else %}
+ #
+ # Self signed certs generated by the ssl-cert package
+ # Don't use them in a production server!
+ #
+ include snippets/snakeoil.conf;
+{% endif %}
# proxy settings for HTTP API, if enabled; 503, if not
location ~ /(retrieve|configure) {
@@ -79,6 +121,8 @@ server {
}
}
+
+{% endfor %}
"""
def get_config():
@@ -89,9 +133,14 @@ def get_config():
else:
conf.set_level('service https')
- if conf.exists('listen-address'):
- addrs = conf.return_values('listen-address')
- https['listen_address'] = addrs[:]
+ if conf.exists('listen-addresses'):
+ addrs = {}
+ for addr in conf.list_nodes('listen-addresses'):
+ addrs[addr] = ['_']
+ if conf.exists('listen-addresses {0} server-names'.format(addr)):
+ names = conf.return_values('listen-addresses {0} server-names'.format(addr))
+ addrs[addr] = names[:]
+ https['listen_addresses'] = addrs
if conf.exists('certificates'):
if conf.exists('certificates system-generated-certificate'):