From: Willy Tarreau <w@1wt.eu>
Date: Tue, 3 Nov 2026 15:32:38 +0000 (+0100)
Subject: MINOR: http/hardening: add "delete-all-trailer-fields"
X-Git-Tag: v3.5-dev11~14
X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=cb652df4bda3eb7cd099867a00540a0e6c3be3f3;p=haproxy.git

MINOR: http/hardening: add "delete-all-trailer-fields"

Deletes from requests and responses any trailer field, regardless of
its content or syntax. This is done after syntactic checks though. The
vast majority of public facing applications do not use trailers because
they are not reliable (intermediaries are allowed to drop or fold them)
and their presence on public networks is generally associated with
attack attempts. It is generally safe to drop them by default on public
facing listeners, and even on servers meant to deliver public contents,
in order to avoid any information leakage. Note that gRPC services use
them.
---

diff --git a/doc/configuration.txt b/doc/configuration.txt
index acb31bd6d..73ab52582 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -34525,6 +34525,17 @@ http-hardening <name> [from <name2>]
         This keyword covers all known keywords together. It is essentially used
         to enable or disable all checks at once.
 
+  - delete-all-trailer-fields (inbound, request and response)
+        Deletes from requests and responses any trailer field, regardless of
+        its content or syntax. This is done after syntactic checks though. The
+        vast majority of public facing applications do not use trailers because
+        they are not reliable (intermediaries are allowed to drop or fold them)
+        and their presence on public networks is generally associated with
+        attack attempts. It is generally safe to drop them by default on public
+        facing listeners, and even on servers meant to deliver public contents,
+        in order to avoid any information leakage. Note that gRPC services use
+        them, in responses only.
+
   - delete-underscore-in-header-name (inbound, request and response)
         Deletes from requests and responses any header field whose name
         contains an underscore character ('_' or \x5C). While this character is
diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h
index e5019bb3d..2637bec24 100644
--- a/include/haproxy/http-t.h
+++ b/include/haproxy/http-t.h
@@ -248,6 +248,7 @@ struct http_violation {
 #define HTTP_HRD_DEL_USCORE_TLR_NAM         0x00000020
 #define HTTP_HRD_DEL_UNREG_HDR              0x00000040
 #define HTTP_HRD_DEL_UNREG_TLR              0x00000080
+#define HTTP_HRD_DEL_ALL_TLR                0x00000100
 /* insert new masks above this line */
 #define HTTP_HRD_ALL                        0xFFFFFFFF
 
diff --git a/src/http.c b/src/http.c
index a4df4e177..4055b0528 100644
--- a/src/http.c
+++ b/src/http.c
@@ -1783,6 +1783,7 @@ const struct http_hardening_kw http_hardening_kws[] = {
 	{ "delete-underscore-in-trailer-name", HTTP_HRD_DEL_USCORE_TLR_NAM, HTTP_DIR_BOTH },
 	{ "delete-unregistered-header-fields",HTTP_HRD_DEL_UNREG_HDR, HTTP_DIR_BOTH },
 	{ "delete-unregistered-trailer-fields",HTTP_HRD_DEL_UNREG_TLR, HTTP_DIR_BOTH },
+	{ "delete-all-trailer-fields",         HTTP_HRD_DEL_ALL_TLR, HTTP_DIR_BOTH },
 	/* insert new hardening options above this line */
 	{ "all",                            HTTP_HRD_ALL,              HTTP_DIR_BOTH },
 	{ NULL, 0 }
diff --git a/src/http_htx.c b/src/http_htx.c
index 39f4cb352..99f211578 100644
--- a/src/http_htx.c
+++ b/src/http_htx.c
@@ -2074,6 +2074,12 @@ enum http_parser_status http_trailers_to_htx(struct http_hdr *list, struct htx *
 			goto fail;
 		}
 
+		/* we may have to delete any trailer (we do that after syntax check) */
+		if (unlikely(http_harden(HTTP_HRD_DEL_ALL_TLR))) {
+			/* skip it, so it won't be added */
+			continue;
+		}
+
 		/* we may have to delete trailers with underscores
 		 * in their names. These ones are already marked
 		 * as found when not rejected so we can avoid a