From: Willy Tarreau <w@1wt.eu>
Date: Tue, 27 Oct 2026 16:43:44 +0000 (+0100)
Subject: MINOR: http: add the "set http-hardening" CLI command
X-Git-Tag: v3.5-dev11~23
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=5ce1709d2cdbb026946b96d24fafb022e2f47b63;p=haproxy.git

MINOR: http: add the "set http-hardening" CLI command

"set http-hardening <name> <option> {on|off}" enables or disables an option
of a profile at runtime, including the "all" keyword to change everything
at once, e.g. in an emergency. Options may also be specified by the bit
number that appears in -dKcfg or in "show http-hardening". The option is
looked up like in the section parser so that a suggestion is made on typos.
The profile is only read by the other threads, so it is updated while the
threads are isolated, which avoids any locking on the fast path. The
command is restricted to the admin level.
---

diff --git a/doc/management.txt b/doc/management.txt
index b6ae2e1e8..4520745a1 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -2647,6 +2647,19 @@ set anon global-key <key>
   integer between 0 and 4294967295 (0 disables the global key). This command
   requires admin privilege.
 
+set http-hardening <name> { <option> | <number> } { on | off }
+  Enables or disables the hardening option <option> in the http-hardening
+  profile <name>, which may be "untrusted" and "trusted" even if not declared.
+  Alternately, the option may be designated by its <number> which corresponds
+  to the one reported by "show http-hardening". The special option "all"
+  changes all options at once, which may be used to quickly relax or restore
+  everything in an emergency. The change applies to all connections and servers
+  using this profile and is not persistent: it is lost on reload, so the
+  configuration must be updated as well. The profile being only updated while
+  all threads are isolated, this command may momentarily delay processing. This
+  command requires the admin level. See also "show http-hardening" and section
+  12.10 of the configuration manual.
+
 set map <map> [<key>|#<ref>] <value>
   Modify the value corresponding to each key <key> in a map <map>. <map> is the
   #<id> or <name> returned by "show map". If the <ref> is used in place of
diff --git a/src/http.c b/src/http.c
index c3d2502ba..8cf380a35 100644
--- a/src/http.c
+++ b/src/http.c
@@ -2123,9 +2123,72 @@ static int cli_io_handler_show_http_hardening(struct appctx *appctx)
 	return 1;
 }
 
+/* parses "set http-hardening <name> <option> {on|off}": changes an option of
+ * a profile. The profile is only read by the other threads, which are isolated
+ * during the update so that no lock is needed to read it.
+ */
+static int cli_parse_set_http_hardening(char **args, char *payload, struct appctx *appctx, void *trusted)
+{
+	struct http_hdng_prf *prf;
+	char *msg = NULL;
+	size_t idx = 0;
+	int match;
+	int v, on;
+
+	if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
+		return 1;
+
+	if (!*args[2] || !*args[3] || !*args[4] || *args[5])
+		return cli_err(appctx, "Usage: set http-hardening <name> <option> {on|off}\n");
+
+	prf = http_hardening_lookup(args[2]);
+	if (!prf)
+		return cli_err(appctx, "Unknown http-hardening profile.\n");
+
+	v = atoi(args[3]);
+	match = 0;
+	if (v > 0 && v <= 8 * sizeof(http_hardening_kws[0].mask)) {
+		/* numeric entry found, corresponds to bit position starting at 1 */
+		for (idx = 0; idx < sizeof(http_hardening_kws) / sizeof(http_hardening_kws[0]); idx++) {
+			if (1U << (v - 1) == http_hardening_kws[idx].mask) {
+				/* found at [idx] */
+				match = 2;
+				break;
+			}
+		}
+
+	}
+
+	if (match != 2)
+		match = find_word_index_in_array(http_hardening_kws, sizeof(http_hardening_kws[0]), -1,
+	                                         offsetof(struct http_hardening_kw, name), args[3], &idx);
+	if (match != 2) {
+		if (match == 1) {
+			memprintf(&msg, "Unknown http-hardening option. Maybe you meant '%s' ?\n",
+			          http_hardening_kws[idx].name);
+			return cli_dynerr(appctx, msg);
+		}
+		return cli_err(appctx, "Unknown http-hardening option.\n");
+	}
+
+	on = strcmp(args[4], "on") == 0;
+	if (!on && strcmp(args[4], "off") != 0)
+		return cli_err(appctx, "Expects 'on' or 'off'.\n");
+
+	thread_isolate();
+	if (on)
+		prf->mask |= http_hardening_kws[idx].mask;
+	else
+		prf->mask &= ~http_hardening_kws[idx].mask;
+	thread_release();
+	return 1;
+}
+
 static struct cli_kw_list http_hardening_cli_kws = {{ }, {
 	{ { "show", "http-hardening", NULL }, "show http-hardening [name]              : lists the profiles, or dumps one of them's rules",
 	  cli_parse_show_http_hardening, cli_io_handler_show_http_hardening },
+	{ { "set", "http-hardening", NULL }, "set http-hardening <name> <opt> on|off : enable or disable an option of a profile",
+	  cli_parse_set_http_hardening },
 	{{},}
 }};