net/haproxy: does not render `verify` clause correctly on mode TCP with https checks

[cruwe]

First and foremost, thank you very much for developing opnsense and it's plugins and making it available to the general public.

Important notices
Before you add a new report, we ask you kindly to acknowledge the following:

[x] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md

[x] I have searched the existing issues and I'm convinced that mine is new.

[x] The title contains the plugin to which this issue belongs

Describe the bug

I noticed the issue on

• os-haproxy: 2.20,
• haproxy: 2.0.13 and
• opnsense: 20.1.2.

For me, this is a "first attempt" at using the haproxy plugin, I do not know if the issue is present on other versions or not.

The use case is as such: Backends (here k8s api server) expose a port (6443) with https. The haproxy should not terminate https, but pass TCP through. The health-check, however, should be http(s) and verify the certificate against a non-public CA.

When in "Real Server -> Edit Server" the checkbox "Verify SSL Certificate" is selected and a the corresponding CA is given at "SSL Verify CA", the verify required ca-file clause is not rendered into haproxy,conf unless the checkbox "SSL" is ticked.

When the "SSL"-checkbox is ticked, SSL is terminated at the haproxy instance.

Manually inserting the "Option pass-through" verify required ca-file /etc/ssl/cert.pem renders haproxy.conf correctly.

To Reproduce
cf. above

Expected behavior

Naively, I would expect "Verify SSL Certificate" to have an effect even when haproxy is meant to pass TCP through, as I monkey-patched into the haproxy.conf (ab?)using "Options pass-through".

In any case, thank you very much for your effort and your concern. Cheers

[fraenki]

The haproxy should not terminate https, but pass TCP through. The health-check, however, should be http(s) and verify the certificate against a non-public CA.

So to sum it up: server communication is in TCP mode, but your health check uses HTTPS and only this health check traffic should use SSL verification. I assume in your health check you have "Force SSL" enabled. Is this correct?

I've added two commits to address this issue:

• Commit 744f17a enables SSL verification for a server when "Force SSL" is enabled in the associated health check.
• Commit 25c3c1f uses the systems local Root CA Certificates (/etc/ssl/cert.pem) for SSL verification when no CA was selected.

This results in the following diff in my test configuration:

-    server web_test 10.11.12.13:443 check inter 2s downinter 2s fall 5 rise 5 check-ssl
+    server web_test 10.11.12.13:443 check inter 2s downinter 2s fall 5 rise 5 check-ssl   verify required ca-file /etc/ssl/cert.pem

You can apply the changes locally:

opnsense-patch -c plugins 744f17a1
opnsense-patch -c plugins 25c3c1ff

Please let me know if it works as intended, or if anything else is missing to make it work for your use-case.

as I monkey-patched into the haproxy.conf (ab?)using "Options pass-through"

The "options pass-through" exists solely for this reason: to get the job done when a feature is missing or a bug is found. It's meant as a short-term quick fix. You are not abusing it, because you've created this issue. :) Thanks!

[cruwe]

Hi,

thank you very much for taking an interest.

Your assumptions about my use case where an exact match and your patches caused the plugin to render haproxy.cfg as I wanted.

Thank you very much! Cheers!

[fraenki]

Thanks for reporting back. This will be available in the upcoming os-haproxy 2.22.