From: Willy Tarreau <w@1wt.eu>
Date: Wed, 11 Nov 2026 10:49:20 +0000 (+0200)
Subject: MINOR: http-act: mark http-request access control actions with KWF_ACCESS_CTRL
X-Git-Tag: v3.5-dev12~11
X-Git-Url: https://git.kaiwu.me/%7B@url%7D?a=commitdiff_plain;h=5920579d51245c0524edc8450fe03c21934047e4;p=haproxy.git

MINOR: http-act: mark http-request access control actions with KWF_ACCESS_CTRL

This new keyword flag indicates that an action is used to block traffic,
and as such that the reliability of its condition matters. It is set on
the "deny", "tarpit", "reject", "auth" and "silent-drop" http-request
actions. It will be used to detect such rules relying on a deny-list of
aliasable contents. "return" is deliberately not marked, as it's used
for many other purposes (e.g. serving local contents).
---

diff --git a/include/haproxy/cfgparse.h b/include/haproxy/cfgparse.h
index 3a1640b11..58b4261c4 100644
--- a/include/haproxy/cfgparse.h
+++ b/include/haproxy/cfgparse.h
@@ -52,6 +52,7 @@ enum cfg_keyword_flags {
 	KWF_EXPERIMENTAL = 0x1,
 	KWF_MATCH_PREFIX = 0x2,
 	KWF_DISCOVERY = 0x4,
+	KWF_ACCESS_CTRL = 0x8,  /* action used to block traffic (deny, reject...) */
 };
 
 struct cfg_keyword {
diff --git a/src/http_act.c b/src/http_act.c
index 6e10f4942..48dae6dcd 100644
--- a/src/http_act.c
+++ b/src/http_act.c
@@ -2875,20 +2875,20 @@ static struct action_kw_list http_req_actions = {
 		{ "add-header",       parse_http_set_header,           0 },
 		{ "add-headers-bin",  parse_http_set_headers_bin,      0 },
 		{ "allow",            parse_http_allow,                0 },
-		{ "auth",             parse_http_auth,                 0 },
+		{ "auth",             parse_http_auth,                 KWF_ACCESS_CTRL },
 		{ "capture",          parse_http_req_capture,          0 },
 		{ "del-acl",          parse_http_set_map,              KWF_MATCH_PREFIX },
 		{ "del-header",       parse_http_del_header,           0 },
 		{ "del-headers-bin",  parse_http_del_headers_bin,      0 },
 		{ "del-map",          parse_http_set_map,              KWF_MATCH_PREFIX },
-		{ "deny",             parse_http_deny,                 0 },
+		{ "deny",             parse_http_deny,                 KWF_ACCESS_CTRL },
 		{ "disable-l7-retry", parse_http_req_disable_l7_retry, 0 },
 		{ "do-log",           parse_http_req_do_log,           0 },
 		{ "early-hint",       parse_http_set_header,           0 },
 		{ "normalize-uri",    parse_http_normalize_uri,        KWF_EXPERIMENTAL },
 		{ "pause",            parse_http_pause,                0 },
 		{ "redirect",         parse_http_redirect,             0 },
-		{ "reject",           parse_http_action_reject,        0 },
+		{ "reject",           parse_http_action_reject,        KWF_ACCESS_CTRL },
 		{ "replace-header",   parse_http_replace_header,       0 },
 		{ "replace-path",     parse_replace_uri,               0 },
 		{ "replace-pathq",    parse_replace_uri,               0 },
@@ -2904,7 +2904,7 @@ static struct action_kw_list http_req_actions = {
 		{ "set-query",        parse_set_req_line,              0 },
 		{ "set-uri",          parse_set_req_line,              0 },
 		{ "strict-mode",      parse_http_strict_mode,          0 },
-		{ "tarpit",           parse_http_deny,                 0 },
+		{ "tarpit",           parse_http_deny,                 KWF_ACCESS_CTRL },
 		{ "track-sc",         parse_http_track_sc,             KWF_MATCH_PREFIX },
 		{ "set-timeout",      parse_http_set_timeout,          0 },
 		{ "wait-for-body",    parse_http_wait_for_body,        0 },
diff --git a/src/tcp_act.c b/src/tcp_act.c
index ca25c011d..b249d3699 100644
--- a/src/tcp_act.c
+++ b/src/tcp_act.c
@@ -908,7 +908,7 @@ static struct action_kw_list http_req_actions = {ILH, {
 	{ "set-src",      tcp_parse_set_src_dst },
 	{ "set-src-port", tcp_parse_set_src_dst },
 	{ "set-tos",      tcp_parse_set_tos     }, // DEPRECATED, see set-fc-tos
-	{ "silent-drop",  tcp_parse_silent_drop },
+	{ "silent-drop",  tcp_parse_silent_drop, KWF_ACCESS_CTRL },
 	{ /* END */ }
 }};