net/haproxy: Rules: allow more complex evaluation of conditions
@fraenki is already working on this.
Since Apr 19, 2022.
- Dominant language
- PHP
- Stars
- 1.2k
- Forks
- 863
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 10
Description
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
[X] I have read the contributing guide lines at https://github.com/opnsense/plugins/blob/master/CONTRIBUTING.md
[X] I have searched the existing issues and I'm convinced that mine is new.
[X] When the request is meant for an existing plugin, I've added its name to the title.
Is your feature request related to a problem? Please describe.
At the moment:
- Rules can only use a very simple condition syntax where one can list one or more conditions (ACLs) and then specify either logical AND or OR to use as the only operator when evaluating them. If one needs to combine the use of AND and OR, it can't be done straight away easily.
- Conditions can be negated only in their own configuration. If the same condition needs to be used in a non-negated as well as a negated form, it has to be defined twice to cover both use cases.
Describe the solution you'd like
It would be useful to be able to specify the whole string for evaluating conditions more freely so that one could easily combine AND and OR operators as well as negate any condition if needed.
Describe alternatives you've considered
Currently possible alternative approach is to split the conditions and rules into more simpler ones to cover the required use case.
For example if we want to achieve something like this:
acl Host1 ...
acl Path1 ...
acl Path1_special ...
acl Client1_special ...
use_backend Backend1 if Host1 Path1 !Path1_special || Host1 Client1_special Path1_special
We need to set it basically like this:
acl Host1 ...
acl Path1 ...
acl Path1_special ...
acl Path1_special_NEGATED ... (same condition as Path1_special, just with the "Negate condition" checkbox checked)
acl Client1_special ...
use_backend Backend1 if Host1 Path1 !Path1_special_NEGATED
use_backend Backend1 if Host1 Client1_special Path1_special
That means instead of 4+1=5 configuration entries we now need to define 5+2=7 of them which just adds an unnecessary complexity and clutter to the whole config.
Additional context
I'd propose something like the following:
- Condition: Remove the Negate condition option.
- Rule: Merge the Select conditions and Logical operator fields in the Optional condition section into just a single text field where one can freely enter the string to evaluate. If that's possible the current functionality of offering available conditions via the drop down field could be preserved. One would then simply enter something like
Host1 Path1 !Path1_special || Host1 Client1_special Path1_specialin there.
This would also make it possible to use so called "anonymous ACLs" (I tend to call them inline instead) which are ACLs directly specified in curly braces in place of condition names. These are useful in very simple use cases where one can avoid having to define the condition altogether.
Optionally, even the Test type field could be merged in there as well.
If that would be too time consuming/difficult to implement, then at least add something like "Conditions pass-through" into the advanced mode where it would be possible to achieve that while maintaining the current implementation intact.
Also one small side note: If there are any pending (unsaved) HAProxy configuration changes, this fact isn't highlighted in any way. It would be nice to have some warning banner shown in such cases, because it's easy to perform some changes somewhere and then forget to save (apply) them.
I think this is where the whole OPNsense Web UI lacks a little, but at least in the case of Firewall configuration section it briefly shows a notice to save (apply) pending configuration changes.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.