Plugins: Haproxy ssl files hard link failed, Haproxy doesn't start

[zaggash]

Hello since the new update OPNsense 18.7.9-amd64 Haproxy doesn't start anymore.

I wanna add that I'm using the option Verify SSL Certificate in my Real Server creation.

The only logs in the UI is the following :

root: /usr/local/etc/rc.d/haproxy: WARNING: failed precmd routine for haproxy

The logs in the Haproxy service UI when clicking on Test Syntax is :

[ALERT] 350/162526 (2389) : Proxy 'syno_pool', server 'syno_srv' [/usr/local/etc/haproxy.conf:89] unable to load CA file '/tmp/haproxy/ssl/5b2aa23155700.pem'.
[ALERT] 350/162526 (2389) : Fatal errors found in configuration.

Here is the line with an issue :

server syno_srv <obfuscated> check inter 30s fall 2 rise 1 port <obfuscated>  ssl verify required ca-file /tmp/haproxy/ssl/5b2aa23155700.pem 

Looking in the shell, it looks like the files in /tmp/haproxy/ssl/ and /var/etc/haproxy/ssl/ are hard links.
But the content is not the same :

# ll -i /var/etc/haproxy/ssl/
total 28
3611822 -rw-------  1 www  www  7389 Dec 17 15:57 5b26e6779cb03.pem
3611823 -rwxr-x---  1 www  www    78 Nov 16 22:00 5b26e7152b85b4.97606176.crtlist*
3611677 -rwxr-x---  1 www  www  5351 Jun 20 17:40 5b2a673bd30c8.pem*
3611890 -rwxr-x---  1 www  www  5415 Nov 16 22:00 5b2aa23155700.pem* 

# ll -i /tmp/haproxy/ssl/
total 12
2969518 -rw-------  1 www  www  7389 Dec 17 16:25 5b26e6779cb03.pem
2969519 -rw-------  1 www  www    70 Dec 17 16:25 5b26e7152b85b4.97606176.certlist

I tried to manually creates the missing hard link in tmp/haproxy/ssl/ but this doesn't stay after a reboot.

Any clue on what is happening ?
Thanks.

[fabianfrz]

@zaggash maybe you have tmp on a ramdisk, then everything on it will be lost after a reboot.

[zaggash]

Maybe this can help :

I did a basic installation, no custom FS.

# df -hP
Filesystem      512-blocks    Used    Avail Capacity  Mounted on
/dev/gpt/rootfs   58503648 3196384 50626976     6%    /
devfs                    2       2        0   100%    /dev
devfs                    2       2        0   100%    /var/unbound/dev
devfs                    2       2        0   100%    /var/dhcpd/dev

# mount
/dev/gpt/rootfs on / (ufs, local, noatime, soft-updates)
devfs on /dev (devfs, local, multilabel)
devfs on /var/unbound/dev (devfs, local, multilabel)
devfs on /var/dhcpd/dev (devfs, local, multilabel)

cat /etc/fstab
# Device        Mountpoint  FStype  Options     Dump    Pass#
/dev/gpt/rootfs /       ufs rw,noatime  1   1

[fabianfrz]

Ok this means no tmpfs (ramdisk), which should mean that the file should not be deleted except a setup script cleans up the directory.

[zaggash]

I wanna let you know that I didn't add any scripts or some sort of cron in the system.
Its a default opnsense installation followed by the standard updates through the WebUI.

How are made the hard link in the system from /var to /tmp ?

[zaggash]

https://github.com/opnsense/plugins/issues/1073

[zaggash]

There is definitely an issue around the logic here :
https://github.com/opnsense/plugins/blob/18.7.9/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php

Hard to understand the up and down of the function :P

[Alex9779]

Ok, I changed
https://github.com/opnsense/plugins/blob/e85343dc2a43f056e63351589956b2b7f92fcec6/net/haproxy/src/opnsense/scripts/OPNsense/HAProxy/exportCerts.php#L88
to:

if ($type == cert or $type == ca) {

and it works again...

[Alex9779]

Further reading the script I am not sure if that is really the solution as I don't understand the whole logic.
In the if statement above you check for "clr" and do special stuff for that type and have all others, "cert" and "ca", covered by the else clause.
Then the next if block is for writing out the files, here you just do it for "certs" but oviously the "ca" type has to be written too.
Maybe the logic should be changed to like it is in the statement above?

[fraenki]

Thanks for the report(s)! A fix will be available in the next release.

A hotfix may be applied like this:

opnsense-patch -c plugins 863e77ab