From: Willy Tarreau <w@1wt.eu>
Date: Mon, 26 Oct 2026 17:08:40 +0000 (+0100)
Subject: MINOR: cfgparse: dump the "http-hardening" keywords with -dKcfg
X-Git-Tag: v3.5-dev11~33
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=08e28d55b2ee98faaa66937b87868a063308f12f;p=haproxy.git

MINOR: cfgparse: dump the "http-hardening" keywords with -dKcfg

The keywords of the "http-hardening" section are not registered via the
cfg_kw_list mechanism but through their own table in http.c, so they were
missing from the output of "-dKcfg". Let's have cfg_dump_registered_keywords()
report them by calling dump_http_hardening_kws() once the other sections
were dumped. The function also reports the option numbers for pure options
(those which are not composite).
---

diff --git a/include/haproxy/http.h b/include/haproxy/http.h
index 50c47c9b2..d862db6ae 100644
--- a/include/haproxy/http.h
+++ b/include/haproxy/http.h
@@ -42,6 +42,7 @@ extern struct http_hdng_prf http_hardening_trusted;
 enum http_meth_t find_http_meth(const char *str, const int len);
 int http_get_status_idx(unsigned int status);
 const char *http_get_reason(unsigned int status);
+void dump_http_hardening_kws();
 struct http_hdng_prf *http_hardening_lookup(const char *name);
 struct http_hdng_prf *http_hardening_resolve(const char *name, char **err);
 void http_status_add_range(long *array, uint low, uint high);
diff --git a/src/cfgparse.c b/src/cfgparse.c
index e6667cbd7..48b3d8bb9 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -63,6 +63,7 @@
 #include <haproxy/global.h>
 #include <haproxy/http_ana.h>
 #include <haproxy/http_rules.h>
+#include <haproxy/http.h>
 #include <haproxy/http_htx.h>
 #include <haproxy/lb_chash.h>
 #include <haproxy/lb_fas.h>
@@ -3204,6 +3205,10 @@ void cfg_dump_registered_keywords()
 
 		}
 	}
+
+	/* this section's keywords are not registered via cfg_kw_list */
+	printf("http-hardening\n");
+	dump_http_hardening_kws();
 }
 
 /* these are the config sections handled by default */
diff --git a/src/http.c b/src/http.c
index 6a1c6103f..143b5eec1 100644
--- a/src/http.c
+++ b/src/http.c
@@ -1772,6 +1772,18 @@ const struct http_hardening_kw http_hardening_kws[] = {
 	{ NULL, 0 }
 };
 
+/* Dumps the list of known HTTP hardening keywords on stdout, one per line. */
+void dump_http_hardening_kws()
+{
+	const struct http_hardening_kw *kw;
+
+	for (kw = http_hardening_kws; kw->name; kw++)
+		if (kw->mask & (kw->mask - 1)) // more than one bit set
+			printf("\t%s\n", kw->name);
+		else // single bit, report its position starting at 1
+			printf("\t%s (%d)\n", kw->name, my_flsl(kw->mask));
+}
+
 /* Declared profiles are indexed by name in <http_hardening_by_name>. They must
  * be declared before being referenced, like for "defaults" sections. The
  * implicit "untrusted" and "trusted" profiles are static, so that they may