MINOR: listener: add the "http-hardening" bind keyword

The new "http-hardening" bind keyword sets the HTTP hardening profile that
applies to the connections accepted by the bind line. The bind_conf now
keeps a pointer to the profile set by the keyword, or NULL if not set or
if explicitly set to "auto".

diff --git a/include/haproxy/listener-t.h b/include/haproxy/listener-t.h
index a6990cbd9b66daf24c4795e3cd1ba47c1c6ce052..2e58748846634ecc42455cedaf7e98b9a7657aff 100644 (file)
--- a/include/haproxy/listener-t.h
+++ b/include/haproxy/listener-t.h
@@ -42,6 +42,7 @@ struct task;
 struct protocol;
 struct xprt_ops;
 struct proxy;
+struct http_hdng_prf;
 struct fe_counters;
 struct connection;
 
@@ -192,6 +193,7 @@ struct bind_conf {
 #endif
        struct proxy *frontend;    /* the frontend all these listeners belong to, or NULL */
        const struct mux_proto_list *mux_proto; /* the mux to use for all incoming connections (specified by the "proto" keyword) */
+       const struct http_hdng_prf *hdng_prf; /* HTTP hardening profile ("http-hardening") if defined, or NULL */
        struct xprt_ops *xprt;     /* transport-layer operations for all listeners */
        uint options;              /* set of BC_O_* flags */
        unsigned int analysers;    /* bitmap of required protocol analysers */

diff --git a/src/listener.c b/src/listener.c
index e5a0eaa757d40cb53ac4a563f66b815b1183953e..f7d087f9abfa879f09bdc90dc2e14d8dc3eb00c0 100644 (file)
--- a/src/listener.c
+++ b/src/listener.c
@@ -32,6 +32,7 @@
 #include <haproxy/frontend.h>
 #include <haproxy/global.h>
 #include <haproxy/guid.h>
+#include <haproxy/http.h>
 #include <haproxy/list.h>
 #include <haproxy/listener.h>
 #include <haproxy/log.h>
@@ -2571,6 +2572,31 @@ static int bind_parse_guid_prefix(char **args, int cur_arg, struct proxy *px, st
        return 0;
 }
 
+/* parse the "http-hardening" bind keyword */
+static int bind_parse_http_hardening(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
+{
+       struct http_hdng_prf *prf = NULL;
+       char *msg = NULL;
+
+       if (!*args[cur_arg + 1]) {
+               memprintf(err, "'%s' : expects a profile name as argument", args[cur_arg]);
+               return ERR_ALERT | ERR_FATAL;
+       }
+
+       /* "auto" sets/keeps the NULL, others must resolve */
+       if (strcmp(args[cur_arg + 1], "auto") != 0) {
+               prf = http_hardening_resolve(args[cur_arg + 1], &msg);
+               if (!prf) {
+                       memprintf(err, "'%s' : %s", args[cur_arg], msg);
+                       free(msg);
+                       return ERR_ALERT | ERR_FATAL;
+               }
+       }
+
+       conf->hdng_prf = prf;
+       return 0;
+}
+
 /* parse the "id" bind keyword */
 static int bind_parse_id(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
 {
@@ -3048,6 +3074,7 @@ static struct bind_kw_list bind_kws = { "ALL", { }, {
        { "accept-proxy", bind_parse_accept_proxy, 0, 0 }, /* enable PROXY protocol */
        { "backlog",      bind_parse_backlog,      1, 0 }, /* set backlog of listening socket */
        { "guid-prefix",  bind_parse_guid_prefix,  1, 1 }, /* set guid of listening socket */
+       { "http-hardening", bind_parse_http_hardening, 1, 1 }, /* set the HTTP hardening profile */
        { "id",           bind_parse_id,           1, 1 }, /* set id of listening socket */
        { "idle-ping",    bind_parse_idle_ping,    1, 1 }, /* activate idle ping if mux support it */
        { "label",        bind_parse_label,        1, 1 }, /* set label of listening socket */