From: Willy Tarreau <w@1wt.eu>
Date: Thu, 12 Nov 2026 16:12:03 +0000 (+0100)
Subject: DOC: threat-model: add a few more entries for stuff that should be public
X-Git-Tag: v3.5-dev12~16
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=26c4f8604d52022c045631d3263bf23bfa99e5e6;p=haproxy.git

DOC: threat-model: add a few more entries for stuff that should be public

Some reports still contain well-known claims that need to be re-explained
and would be better described publicly, particularly because they come
with zero real risk. Let's clarify a few such points.
---

diff --git a/doc/internals/threat-model.txt b/doc/internals/threat-model.txt
index 50cfb99ab..14cf0a44d 100644
--- a/doc/internals/threat-model.txt
+++ b/doc/internals/threat-model.txt
@@ -114,11 +114,27 @@ blast radius (sections 5 and 6).
    - anything requiring "expose-experimental-directives".
 
    Misconfiguration:
+   - anything that works as explicitly documented
    - anything requiring a configuration that emits warnings at boot.
    - anything requiring a nonsensical configuration, e.g. a server looping back
      to the frontend, non-standard header processing or URL rewriting, or an
      excessively large number of headers or excessively large header/body
      sizes.
+   - any abort or crash caused by configuration issues or a bug in the
+     configuration parser (e.g. a crash on a missing argument is just a regular
+     bug since configs are not writable by untrusted users).
+   - bugs only triggered by tweaking operating system limits (e.g. too high or
+     too low file descriptor count, memory size, source ports, etc).
+
+   Deployment issue:
+   - situations that are reproduced for the case of the report but that do not
+     correspond to a real-world deployment. This includes observing traffic
+     patterns on totally idle links, limiting client traffic to very few or
+     private IP addresses, targetting wrong security profiles, using abnormally
+     small or abnormally large keys in certificates.
+   - situations that are caused by the test environment, such as time
+     granularity in test VMs, failure to self-protect in restricted user
+     namespaces, test system collapsing under logs or traffic.
 
    Volumetric or otherwise detectable activity:
    - anything requiring such a high and sustained level of activity that it