mirror of
https://github.com/taylanbakircioglu/haproxy-openmanager.git
synced 2026-09-17 16:15:20 +00:00
Taylan Bakırcıoğlu
589f865f59
PART 1: Rollback Support for SSL Advanced Options =================================================== Problem: SSL advanced options lost on reject/rollback operations Root Cause: - Snapshot creation uses SELECT * (includes all fields) ✅ - old_values contains SSL advanced options ✅ - Rollback UPDATE did NOT restore SSL fields ❌ Impact - Frontend: - User changes ssl_alpn, then clicks Reject - Rollback skipped: ssl_alpn, ssl_npn, ssl_ciphers, ssl_ciphersuites, ssl_min_ver, ssl_max_ver, ssl_strict_sni - Result: All SSL advanced options lost (set to NULL) Impact - Backend Server: - User changes ssl_min_ver='TLSv1.2', then clicks Reject - Rollback skipped: ssl_sni, ssl_min_ver, ssl_max_ver, ssl_ciphers - Result: Security issue - TLS version constraints removed! Fix: - backend/utils/entity_snapshot.py line 285-286: Added 7 frontend SSL fields to rollback UPDATE - backend/utils/entity_snapshot.py line 458: Added 4 server SSL fields to rollback UPDATE PART 2: Improved ALPN Validation Error Message =============================================== Problem: User enters 'http/2' in ALPN field, gets generic error User feedback: Tried 'h2,http/1.1,http/2' → validation error not clear Root Cause: - ALPN standard uses 'h2' for HTTP/2 (not 'http/2') - Validator rejected 'http/2' but didn't explain the correct format Fix: - backend/models/frontend.py line 255-260: Detect common mistakes (http/2, http2, http-2) - Provide helpful error: 'For HTTP/2, use "h2" (not "http/2")' Before: "Invalid ALPN protocol: http/2. Valid protocols: h2, http/1.1, ..." After: "Invalid ALPN protocol: http/2. For HTTP/2, use 'h2' (not 'http/2'). Valid protocols: ..." Testing: 1. Rollback test: Edit frontend SSL, reject, verify SSL fields restored 2. Validation test: Enter 'http/2', verify friendly error message Files Changed: - backend/utils/entity_snapshot.py: _rollback_update() for frontend and server - backend/models/frontend.py: validate_alpn() with better error messages