MINOR: http-act: mark http-request access control actions with KWF_ACCESS_CTRL

This new keyword flag indicates that an action is used to block traffic,
and as such that the reliability of its condition matters. It is set on
the "deny", "tarpit", "reject", "auth" and "silent-drop" http-request
actions. It will be used to detect such rules relying on a deny-list of
aliasable contents. "return" is deliberately not marked, as it's used
for many other purposes (e.g. serving local contents).

diff --git a/include/haproxy/cfgparse.h b/include/haproxy/cfgparse.h
index 3a1640b11f63cd59207ac0c0d8644bbe4abb3111..58b4261c486613b5c93e2f6723ce5cd72c8d9a83 100644 (file)
--- a/include/haproxy/cfgparse.h
+++ b/include/haproxy/cfgparse.h
@@ -52,6 +52,7 @@ enum cfg_keyword_flags {
        KWF_EXPERIMENTAL = 0x1,
        KWF_MATCH_PREFIX = 0x2,
        KWF_DISCOVERY = 0x4,
+       KWF_ACCESS_CTRL = 0x8,  /* action used to block traffic (deny, reject...) */
 };
 
 struct cfg_keyword {

diff --git a/src/http_act.c b/src/http_act.c
index 6e10f4942f5f562c87af37162152a362d03f868d..48dae6dcd0ba7fb1b09ad36ddacd4a32e8600ea9 100644 (file)
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -2875,20 +2875,20 @@ static struct action_kw_list http_req_actions = {
                { "add-header",       parse_http_set_header,           0 },
                { "add-headers-bin",  parse_http_set_headers_bin,      0 },
                { "allow",            parse_http_allow,                0 },
-               { "auth",             parse_http_auth,                 0 },
+               { "auth",             parse_http_auth,                 KWF_ACCESS_CTRL },
                { "capture",          parse_http_req_capture,          0 },
                { "del-acl",          parse_http_set_map,              KWF_MATCH_PREFIX },
                { "del-header",       parse_http_del_header,           0 },
                { "del-headers-bin",  parse_http_del_headers_bin,      0 },
                { "del-map",          parse_http_set_map,              KWF_MATCH_PREFIX },
-               { "deny",             parse_http_deny,                 0 },
+               { "deny",             parse_http_deny,                 KWF_ACCESS_CTRL },
                { "disable-l7-retry", parse_http_req_disable_l7_retry, 0 },
                { "do-log",           parse_http_req_do_log,           0 },
                { "early-hint",       parse_http_set_header,           0 },
                { "normalize-uri",    parse_http_normalize_uri,        KWF_EXPERIMENTAL },
                { "pause",            parse_http_pause,                0 },
                { "redirect",         parse_http_redirect,             0 },
-               { "reject",           parse_http_action_reject,        0 },
+               { "reject",           parse_http_action_reject,        KWF_ACCESS_CTRL },
                { "replace-header",   parse_http_replace_header,       0 },
                { "replace-path",     parse_replace_uri,               0 },
                { "replace-pathq",    parse_replace_uri,               0 },
@@ -2904,7 +2904,7 @@ static struct action_kw_list http_req_actions = {
                { "set-query",        parse_set_req_line,              0 },
                { "set-uri",          parse_set_req_line,              0 },
                { "strict-mode",      parse_http_strict_mode,          0 },
-               { "tarpit",           parse_http_deny,                 0 },
+               { "tarpit",           parse_http_deny,                 KWF_ACCESS_CTRL },
                { "track-sc",         parse_http_track_sc,             KWF_MATCH_PREFIX },
                { "set-timeout",      parse_http_set_timeout,          0 },
                { "wait-for-body",    parse_http_wait_for_body,        0 },

diff --git a/src/tcp_act.c b/src/tcp_act.c
index ca25c011d4120e2567743962db927d149f0239f2..b249d369908697e0be15bf63d1ed8b0d6cb00d46 100644 (file)
--- a/src/tcp_act.c
+++ b/src/tcp_act.c
@@ -908,7 +908,7 @@ static struct action_kw_list http_req_actions = {ILH, {
        { "set-src",      tcp_parse_set_src_dst },
        { "set-src-port", tcp_parse_set_src_dst },
        { "set-tos",      tcp_parse_set_tos     }, // DEPRECATED, see set-fc-tos
-       { "silent-drop",  tcp_parse_silent_drop },
+       { "silent-drop",  tcp_parse_silent_drop, KWF_ACCESS_CTRL },
        { /* END */ }
 }};