From: Willy Tarreau <w@1wt.eu>
Date: Thu, 5 Nov 2026 07:54:06 +0000 (+0100)
Subject: MINOR: http/hardening: turn it to a macro and count matches with COUNT_IF()
X-Git-Url: https://git.kaiwu.me/$%7BISSUES%7D/static/gitweb.js?a=commitdiff_plain;h=c460100e6e7c57056cc4e524e4ae878c22e3632f;p=haproxy.git

MINOR: http/hardening: turn it to a macro and count matches with COUNT_IF()

Thanks to COUNT_IF() it is quite easy to count the number of times the
condition for a given hardening flag was met, and the number of times it
was enforced. Let's replace the function by a macro for this. In order
to avoid counting multiple times the same match (e.g. many CTL chars in
a header value), the macro takes care of checking both the found and the
rules flags. This way we have at least one found per enforcement, and at
least one per distinct match but not necessarily more if no enforcement
is configured.
---

diff --git a/include/haproxy/http.h b/include/haproxy/http.h
index 9b8627800..34befa5bd 100644
--- a/include/haproxy/http.h
+++ b/include/haproxy/http.h
@@ -124,15 +124,25 @@ static inline void http_reset_hardening_check(struct http_hdng_chk *chk)
  *             goto fail;
  *
  * Make sure to pass it single-bit options to keep found/fixed easy to grasp.
+ * Note: this is now written as a macro so that we can count the number of
+ * matches per call place. We try hard not to report multiple matches (e.g.
+ * CTL chars in header values), so we report only once per found type if no
+ * remediation is enabled.
  */
-static inline int http_harden(uint32_t flag)
-{
-	http_hdng_chk.found |= flag;
-	if (!(http_hdng_chk.rules & flag))
-		return 0;
-	http_hdng_chk.fixed |= flag;
-	return 1;
-}
+#define http_harden(flag) ({                                                  \
+	uint32_t _flag = (flag);                                              \
+	int _ret = 0;                                                         \
+	if (unlikely((http_hdng_chk.rules | ~http_hdng_chk.found) & _flag)) { \
+		http_hdng_chk.found |= _flag;                                 \
+		COUNT_IF(1, "hardening " #flag " condition met");             \
+		if (http_hdng_chk.rules & _flag) {                            \
+			COUNT_IF(1, "hardening " #flag " enforced");          \
+			http_hdng_chk.fixed |= _flag;                         \
+			_ret = 1;                                             \
+	        }                                                             \
+	}                                                                     \
+	_ret;                                                                 \
+})
 
 /* Match language range with language tag. RFC2616 14.4:
  *