272 lines
14 KiB
Python
272 lines
14 KiB
Python
import os
|
|
|
|
HAPROXY_CFG = '/etc/haproxy/haproxy.cfg'
|
|
|
|
def is_frontend_exist(frontend_name, frontend_ip, frontend_port):
|
|
if not os.path.exists(HAPROXY_CFG):
|
|
return False
|
|
|
|
try:
|
|
with open(HAPROXY_CFG, 'r') as haproxy_cfg:
|
|
frontend_found = False
|
|
for line in haproxy_cfg:
|
|
if line.strip().startswith('frontend'):
|
|
_, existing_frontend_name = line.strip().split(' ', 1)
|
|
if existing_frontend_name.strip() == frontend_name:
|
|
frontend_found = True
|
|
else:
|
|
frontend_found = False
|
|
elif frontend_found and line.strip().startswith('bind'):
|
|
_, bind_info = line.strip().split(' ', 1)
|
|
existing_ip, existing_port = bind_info.split(':', 1)
|
|
if existing_ip.strip() == frontend_ip and existing_port.strip() == frontend_port:
|
|
return True
|
|
except Exception as e:
|
|
print(f"[HAPROXY_CONFIG] Error checking frontend: {e}", flush=True)
|
|
|
|
return False
|
|
|
|
def is_backend_exist(backend_name):
|
|
if not os.path.exists(HAPROXY_CFG):
|
|
return False
|
|
|
|
try:
|
|
with open(HAPROXY_CFG, 'r') as haproxy_cfg:
|
|
for line in haproxy_cfg:
|
|
line = line.strip()
|
|
if line.startswith('backend') and not line.startswith('#'):
|
|
parts = line.split()
|
|
if len(parts) >= 2 and parts[1] == backend_name:
|
|
return True
|
|
except Exception as e:
|
|
print(f"[HAPROXY_CONFIG] Error checking backend: {e}", flush=True)
|
|
|
|
return False
|
|
|
|
def count_frontends_and_backends():
|
|
if not os.path.exists(HAPROXY_CFG):
|
|
return 0, 0, 0, 0, 0
|
|
|
|
frontend_count = 0
|
|
backend_count = 0
|
|
acl_count = 0
|
|
layer7_count = 0
|
|
layer4_count = 0
|
|
|
|
try:
|
|
with open(HAPROXY_CFG, 'r') as haproxy_cfg:
|
|
content = haproxy_cfg.read()
|
|
lines = content.split('\n')
|
|
|
|
for line in lines:
|
|
line_stripped = line.strip()
|
|
if line_stripped.startswith('frontend'):
|
|
frontend_count += 1
|
|
if 'mode http' in content:
|
|
layer7_count += 1
|
|
elif 'mode tcp' in content:
|
|
layer4_count += 1
|
|
elif line_stripped.startswith('backend'):
|
|
backend_count += 1
|
|
elif line_stripped.startswith('acl'):
|
|
acl_count += 1
|
|
except Exception as e:
|
|
print(f"[HAPROXY_CONFIG] Error counting: {e}", flush=True)
|
|
|
|
return frontend_count, backend_count, acl_count, layer7_count, layer4_count
|
|
|
|
def sanitize_name(name):
|
|
"""Convert hostname/name to valid ACL name (replace special chars with underscores)"""
|
|
return name.replace('.', '_').replace('-', '_').replace('/', '_').replace(':', '_')
|
|
|
|
def update_haproxy_config(frontend_name, frontend_ip, frontend_port, lb_method, protocol, backend_name,
|
|
backend_servers, health_check, health_check_tcp, health_check_link, sticky_session,
|
|
add_header, header_name, header_value, sticky_session_type, is_acl, acl_name,
|
|
acl_action, acl_backend_name, use_ssl, ssl_cert_path, https_redirect, is_dos,
|
|
ban_duration, limit_requests, forward_for, is_forbidden_path, forbidden_name,
|
|
allowed_ip, forbidden_path, sql_injection_check, is_xss, is_remote_upload,
|
|
add_path_based, redirect_domain_name, root_redirect, redirect_to, is_webshells,
|
|
del_server_header=False, backend_ssl_redirect=False, ssl_redirect_backend_name='',
|
|
ssl_redirect_port='80', frontend_hostname='', add_custom_acl=False,
|
|
custom_acl_name='', custom_acl_type='path_beg', custom_acl_value='',
|
|
custom_acl_action='route', custom_acl_backend='', custom_acl_redirect_url=''):
|
|
|
|
os.makedirs(os.path.dirname(HAPROXY_CFG), exist_ok=True)
|
|
|
|
if is_backend_exist(backend_name):
|
|
return f"Backend {backend_name} already exists. Cannot add duplicate."
|
|
|
|
is_no_lb = lb_method == 'no-lb'
|
|
if is_no_lb and len(backend_servers) > 1:
|
|
backend_servers = backend_servers[:1]
|
|
|
|
try:
|
|
with open(HAPROXY_CFG, 'a') as haproxy_cfg:
|
|
# ===== PRIMARY FRONTEND =====
|
|
haproxy_cfg.write(f"\nfrontend {frontend_name}\n")
|
|
|
|
if is_frontend_exist(frontend_name, frontend_ip, frontend_port):
|
|
return "Frontend or Port already exists. Cannot add duplicate."
|
|
|
|
# Bind line
|
|
haproxy_cfg.write(f" bind {frontend_ip}:{frontend_port}")
|
|
|
|
if use_ssl:
|
|
haproxy_cfg.write(f" ssl crt {ssl_cert_path}")
|
|
|
|
haproxy_cfg.write("\n")
|
|
|
|
# HTTPS redirect (global)
|
|
if https_redirect:
|
|
haproxy_cfg.write(f" redirect scheme https code 301 if !{{ ssl_fc }}\n")
|
|
|
|
# Mode
|
|
haproxy_cfg.write(f" mode {protocol}\n")
|
|
|
|
# ===== HOSTNAME ACL =====
|
|
acl_name_sanitized = None
|
|
if frontend_hostname:
|
|
acl_name_sanitized = f"is_{sanitize_name(frontend_hostname)}"
|
|
haproxy_cfg.write(f" acl {acl_name_sanitized} hdr(host) -i {frontend_hostname}\n")
|
|
|
|
if is_no_lb:
|
|
haproxy_cfg.write(f" http-request set-header X-Forwarded-For %[src]\n")
|
|
if use_ssl:
|
|
haproxy_cfg.write(f" http-request set-header X-Forwarded-Proto https\n")
|
|
else:
|
|
haproxy_cfg.write(f" http-request set-header X-Forwarded-Proto http\n")
|
|
|
|
if del_server_header:
|
|
haproxy_cfg.write(f" http-response del-header Server\n")
|
|
else:
|
|
haproxy_cfg.write(f" balance {lb_method}\n")
|
|
|
|
if forward_for:
|
|
haproxy_cfg.write(f" option forwardfor\n")
|
|
|
|
if del_server_header:
|
|
haproxy_cfg.write(f" http-response del-header Server\n")
|
|
|
|
# DOS protection
|
|
if is_dos:
|
|
haproxy_cfg.write(f" stick-table type ip size 1m expire {ban_duration} store http_req_rate(1m)\n")
|
|
haproxy_cfg.write(f" http-request track-sc0 src\n")
|
|
haproxy_cfg.write(f" acl abuse sc_http_req_rate(0) gt {limit_requests}\n")
|
|
haproxy_cfg.write(f" http-request silent-drop if abuse\n")
|
|
|
|
# SQL Injection protection
|
|
if sql_injection_check:
|
|
haproxy_cfg.write(" acl is_sql_injection urlp_reg -i (union|select|insert|update|delete|drop|@@|1=1|`1)\n")
|
|
haproxy_cfg.write(" acl is_long_uri path_len gt 400\n")
|
|
haproxy_cfg.write(" acl semicolon_path path_reg -i ^.*;.*\n")
|
|
haproxy_cfg.write(" acl is_sql_injection2 urlp_reg -i (;|substring|extract|union\\s+all|order\\s+by)\\s+(\\d+|--\\+)\n")
|
|
haproxy_cfg.write(f" http-request deny if is_sql_injection or is_long_uri or semicolon_path or is_sql_injection2\n")
|
|
|
|
# XSS protection
|
|
if is_xss:
|
|
haproxy_cfg.write(" acl is_xss_attack urlp_reg -i (<|>|script|alert|onerror|onload|javascript)\n")
|
|
haproxy_cfg.write(" acl is_xss_attack_2 urlp_reg -i (<\\s*script\\s*|javascript:|<\\s*img\\s*src\\s*=|<\\s*a\\s*href\\s*=|<\\s*iframe\\s*src\\s*=|\\bon\\w+\\s*=|<\\s*input\\s*[^>]*\\s*value\\s*=|<\\s*form\\s*action\\s*=|<\\s*svg\\s*on\\w+\\s*=)\n")
|
|
haproxy_cfg.write(" acl is_xss_attack_hdr hdr_reg(Cookie|Referer|User-Agent) -i (<|>|script|alert|onerror|onload|javascript)\n")
|
|
haproxy_cfg.write(f" http-request deny if is_xss_attack or is_xss_attack_2 or is_xss_attack_hdr\n")
|
|
|
|
# Webshells protection
|
|
if is_webshells:
|
|
haproxy_cfg.write(" acl blocked_webshell path_reg -i /(cmd|shell|backdoor|webshell|phpspy|c99|kacak|b374k|log4j|log4shell|wsos|madspot|malicious|evil).*\\.php.*\n")
|
|
haproxy_cfg.write(f" http-request deny if blocked_webshell\n")
|
|
|
|
# ===== CUSTOM ACL RULES =====
|
|
if add_custom_acl and custom_acl_name and custom_acl_value:
|
|
# Write ACL rule based on type
|
|
if custom_acl_type == 'path_beg':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} path_beg {custom_acl_value}\n")
|
|
elif custom_acl_type == 'path_end':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} path_end {custom_acl_value}\n")
|
|
elif custom_acl_type == 'path_sub':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} path_sub {custom_acl_value}\n")
|
|
elif custom_acl_type == 'hdr':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} hdr_sub(host) -i {custom_acl_value}\n")
|
|
elif custom_acl_type == 'src':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} src {custom_acl_value}\n")
|
|
elif custom_acl_type == 'method':
|
|
haproxy_cfg.write(f" acl {custom_acl_name} method {custom_acl_value}\n")
|
|
|
|
# Apply action based on type
|
|
if custom_acl_action == 'deny':
|
|
haproxy_cfg.write(f" http-request deny if {custom_acl_name}\n")
|
|
elif custom_acl_action == 'redirect' and custom_acl_redirect_url:
|
|
haproxy_cfg.write(f" http-request redirect location {custom_acl_redirect_url} if {custom_acl_name}\n")
|
|
elif custom_acl_action == 'route' and custom_acl_backend:
|
|
haproxy_cfg.write(f" use_backend {custom_acl_backend} if {custom_acl_name}\n")
|
|
|
|
# ===== BACKEND ROUTING =====
|
|
if acl_name_sanitized:
|
|
# Jeśli jest hostname, routuj z ACL
|
|
haproxy_cfg.write(f" use_backend {backend_name} if {acl_name_sanitized}\n")
|
|
else:
|
|
# Default backend
|
|
haproxy_cfg.write(f" default_backend {backend_name}\n")
|
|
|
|
# ===== PRIMARY BACKEND =====
|
|
haproxy_cfg.write(f"\nbackend {backend_name}\n")
|
|
|
|
if not is_no_lb:
|
|
haproxy_cfg.write(f" balance {lb_method}\n")
|
|
|
|
# Sticky sessions
|
|
if sticky_session and not is_no_lb:
|
|
if sticky_session_type == "cookie":
|
|
haproxy_cfg.write(f" cookie SERVERID insert indirect nocache\n")
|
|
elif sticky_session_type == "source":
|
|
haproxy_cfg.write(f" stick-table type ip size 200k expire 30m\n")
|
|
haproxy_cfg.write(f" stick on src\n")
|
|
|
|
# Health checks
|
|
if health_check and protocol == 'http':
|
|
haproxy_cfg.write(f" option httpchk GET {health_check_link}\n")
|
|
elif health_check_tcp and protocol == 'tcp':
|
|
haproxy_cfg.write(f" option tcp-check\n")
|
|
|
|
# Custom headers
|
|
if add_header:
|
|
haproxy_cfg.write(f" http-response add-header {header_name} {header_value}\n")
|
|
|
|
# Add backend servers
|
|
for server_name, server_ip, server_port, maxconn in backend_servers:
|
|
maxconn_str = f" maxconn {maxconn}" if maxconn else ""
|
|
|
|
if health_check and protocol == 'http':
|
|
haproxy_cfg.write(f" server {server_name} {server_ip}:{server_port}{maxconn_str} check\n")
|
|
else:
|
|
haproxy_cfg.write(f" server {server_name} {server_ip}:{server_port}{maxconn_str}\n")
|
|
|
|
# ===== REDIRECT FRONTEND (HTTP -> HTTPS) =====
|
|
if backend_ssl_redirect and ssl_redirect_backend_name:
|
|
if is_backend_exist(ssl_redirect_backend_name):
|
|
return f"Redirect backend {ssl_redirect_backend_name} already exists. Cannot add duplicate."
|
|
|
|
# Generate unique name for redirect frontend
|
|
redirect_frontend_name = f"redirect_https_{sanitize_name(frontend_hostname)}" if frontend_hostname else f"redirect_https_{frontend_name}"
|
|
|
|
haproxy_cfg.write(f"\nfrontend {redirect_frontend_name}\n")
|
|
haproxy_cfg.write(f" bind {frontend_ip}:{ssl_redirect_port}\n")
|
|
haproxy_cfg.write(f" mode http\n")
|
|
|
|
# ===== HOSTNAME ACL FOR REDIRECT FRONTEND =====
|
|
if frontend_hostname:
|
|
acl_name_redirect = f"is_{sanitize_name(frontend_hostname)}_redirect"
|
|
haproxy_cfg.write(f" acl {acl_name_redirect} hdr(host) -i {frontend_hostname}\n")
|
|
haproxy_cfg.write(f" use_backend {ssl_redirect_backend_name} if {acl_name_redirect}\n")
|
|
else:
|
|
haproxy_cfg.write(f" default_backend {ssl_redirect_backend_name}\n")
|
|
|
|
# Redirect backend
|
|
haproxy_cfg.write(f"\nbackend {ssl_redirect_backend_name}\n")
|
|
haproxy_cfg.write(f" mode http\n")
|
|
haproxy_cfg.write(f" redirect scheme https code 301 if !{{ ssl_fc }}\n")
|
|
|
|
return "Configuration updated successfully!"
|
|
|
|
except Exception as e:
|
|
print(f"[HAPROXY_CONFIG] Error updating config: {e}", flush=True)
|
|
return f"Error: {e}"
|