MINOR: http/hardening: add aliases "all-reject" and "all-delete"

These aliases group all reject-* and all delete-* respectively into one
alias, allowing to simplify general cleanups on certain boundaries, or
to fix issues in emergency.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index adf73fd7f335fefef2fd85b1fdd532fb6714ef96..be54a1ad4f30cd5a026a58732d63caa7bdb47f1a 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -34525,6 +34525,16 @@ http-hardening <name> [from <name2>]
         This keyword covers all known keywords together. It is essentially used
         to enable or disable all checks at once.
 
+  - all-reject
+        This keyword covers all keywords below whose name starts with "reject".
+        It may be used on the CLI or in the config to quickly disable any rule
+        that rejects traffic in case of issues.
+
+  - all-delete
+        This keyword covers all keywords below whose name starts with "delete".
+        It may be used on the CLI or in the config to quickly disable any rule
+        that deletes elements in case of issues.
+
   - delete-all-trailer-fields (inbound, request and response)
         Deletes from requests and responses any trailer field, regardless of
         its content or syntax. This is done after syntactic checks though. The

diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h
index d3b3c0b62af3cf60c49078001f165b8e2c0cac2b..a6f4e2db47e0b9fa263d0ff3ef4b4b0e7b847946 100644 (file)
--- a/include/haproxy/http-t.h
+++ b/include/haproxy/http-t.h
@@ -254,6 +254,22 @@ struct http_violation {
 #define HTTP_HRD_REJ_CL_TE                  0x00000800
 #define HTTP_HRD_REJ_CL_LEAD_ZERO           0x00001000
 /* insert new masks above this line */
+/* update this one with new rejects */
+#define HTTP_HRD_ALL_REJECT                 (HTTP_HRD_REJ_DUP_HOST_HDR   | \
+                                             HTTP_HRD_REJ_LCASE_METHOD   | \
+                                             HTTP_HRD_REJ_USCORE_HDR_NAM | \
+                                             HTTP_HRD_REJ_USCORE_TLR_NAM | \
+                                             HTTP_HRD_REJ_HDR_FOLD       | \
+                                             HTTP_HRD_REJ_CTL_IN_HDR     | \
+                                             HTTP_HRD_REJ_CL_TE          | \
+                                             HTTP_HRD_REJ_CL_LEAD_ZERO)
+
+#define HTTP_HRD_ALL_DELETE                 (HTTP_HRD_DEL_USCORE_HDR_NAM         | \
+                                             HTTP_HRD_DEL_USCORE_TLR_NAM         | \
+                                             HTTP_HRD_DEL_UNREG_HDR              | \
+                                             HTTP_HRD_DEL_UNREG_TLR              | \
+                                             HTTP_HRD_DEL_ALL_TLR)
+
 #define HTTP_HRD_ALL                        0xFFFFFFFF
 
 /* default policy for a new profile: permissive */

diff --git a/src/http.c b/src/http.c
index e4b7c4306fe55005f41d875c6bafd090034acf22..6327b1713994cd06847769d56f458c5a18c9f091 100644 (file)
--- a/src/http.c
+++ b/src/http.c
@@ -1792,6 +1792,8 @@ const struct http_hardening_kw http_hardening_kws[] = {
        { "reject-content-length-with-te",     HTTP_HRD_REJ_CL_TE, HTTP_DIR_BOTH },
        { "reject-content-length-leading-zero",HTTP_HRD_REJ_CL_LEAD_ZERO, HTTP_DIR_BOTH },
        /* insert new hardening options above this line */
+       { "all-reject",                     HTTP_HRD_ALL_REJECT,       HTTP_DIR_BOTH },
+       { "all-delete",                     HTTP_HRD_ALL_DELETE,       HTTP_DIR_BOTH },
        { "all",                            HTTP_HRD_ALL,              HTTP_DIR_BOTH },
        { NULL, 0 }
 };