From 09157e8be1dfa8d2be6836a3bef102610ba529a2 Mon Sep 17 00:00:00 2001
From: taylanbakircioglu <taylanb@outlook.com>
Date: Fri, 7 Nov 2025 11:51:15 +0300
Subject: [PATCH] Fix: HAProxy validation failure - Change verify to none when
 ca-file removed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRITICAL HAProxy Validation Fix:
Bulk import was creating configs that fail HAProxy validation

HAProxy Validation Error:
  server es1 ... ssl verify required
  ALERT: verify is enabled but no CA file specified

Root Cause:
  Original config: ssl verify required ca-file /path/cert.pem
  After parse: ssl verify required (ca-file removed)
  Result: HAProxy validation FAILS

HAProxy Requirement:
  verify required → MUST have ca-file
  verify none → Can work without ca-file
  ssl (no verify) → Uses default verification

Fix Applied (Line 677-704):
When parsing server with both verify AND ca-file:
  1. Detect: verify=required + ca-file exists
  2. Remove ca-file (as planned)
  3. Change verify to 'none' (NEW - prevents validation error)
  4. Warning: Explain user needs to reconfigure after import

Three Scenarios Handled:
  1. verify + ca-file → verify=none, remove ca-file, warn user
  2. verify only → keep verify as-is
  3. ca-file only → set verify=none, remove ca-file, warn user

Generated Config Now:
  Before: server es1 ... ssl verify required (FAILS validation)
  After: server es1 ... ssl verify none (PASSES validation)

User Workflow:
  1. Bulk import → Servers created with verify=none
  2. HAProxy validation → PASSES
  3. User edits server → Selects SSL cert → Sets verify=required
  4. Apply → Config generated with ca-file path
  5. HAProxy validation → PASSES (has ca-file)

Warning Message:
  'verify required' changed to 'none' to pass HAProxy validation
  After import, select SSL certificate and set verify to 'required'

Impact: Bulk import now creates HAProxy-valid configurations
---
 backend/utils/haproxy_config_parser.py | 30 +++++++++++++++++++-------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/backend/utils/haproxy_config_parser.py b/backend/utils/haproxy_config_parser.py
index c4abaa8..a131f2a 100644
--- a/backend/utils/haproxy_config_parser.py
+++ b/backend/utils/haproxy_config_parser.py
@@ -676,17 +676,31 @@ class HAProxyConfigParser:
         
         # Parse SSL verification
         verify_match = re.search(r'verify\s+(none|required)', options, re.IGNORECASE)
-        if verify_match:
-            server.ssl_verify = verify_match.group(1).lower()
-        
-        # Check for SSL ca-file path and warn user to remove it
         ca_file_match = re.search(r'ca-file\s+(\S+)', options, re.IGNORECASE)
-        if ca_file_match:
+        
+        # CRITICAL FIX: HAProxy validation requires ca-file when verify=required
+        # If ca-file exists, we remove it but must also change verify to 'none'
+        # Otherwise HAProxy validation fails: "verify required but no CA file"
+        if verify_match and ca_file_match:
+            # Both verify and ca-file exist
             ca_file_path = ca_file_match.group(1)
+            # Change verify to 'none' since we're removing ca-file
+            server.ssl_verify = 'none'
             self.warnings.append(
-                f"🔒 SSL: Server '{name}' has ca-file path '{ca_file_path}' which has been REMOVED from import. "
-                f"SSL certificates should be managed through SSL Management page. "
-                f"After import, edit this server and select SSL certificate from the dropdown."
+                f"SSL: Server '{name}' has 'verify required' with ca-file '{ca_file_path}'. "
+                f"CA file has been REMOVED and verify changed to 'none' to pass HAProxy validation. "
+                f"After import, edit this server, select SSL certificate from dropdown, then set verify to 'required'."
+            )
+        elif verify_match:
+            # Only verify exists (no ca-file)
+            server.ssl_verify = verify_match.group(1).lower()
+        elif ca_file_match:
+            # Only ca-file exists (no verify) - this is rare but handle it
+            ca_file_path = ca_file_match.group(1)
+            server.ssl_verify = 'none'  # Default to none when ca-file removed
+            self.warnings.append(
+                f"SSL: Server '{name}' has ca-file '{ca_file_path}' which has been REMOVED. "
+                f"SSL verify set to 'none'. After import, select SSL certificate and configure verify."
             )
         
         # Parse cookie value