From cb652df4bda3eb7cd099867a00540a0e6c3be3f3 Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Tue, 3 Nov 2026 16:32:38 +0100 Subject: [PATCH] MINOR: http/hardening: add "delete-all-trailer-fields" Deletes from requests and responses any trailer field, regardless of its content or syntax. This is done after syntactic checks though. The vast majority of public facing applications do not use trailers because they are not reliable (intermediaries are allowed to drop or fold them) and their presence on public networks is generally associated with attack attempts. It is generally safe to drop them by default on public facing listeners, and even on servers meant to deliver public contents, in order to avoid any information leakage. Note that gRPC services use them. --- doc/configuration.txt | 11 +++++++++++ include/haproxy/http-t.h | 1 + src/http.c | 1 + src/http_htx.c | 6 ++++++ 4 files changed, 19 insertions(+) diff --git a/doc/configuration.txt b/doc/configuration.txt index acb31bd6d..73ab52582 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -34525,6 +34525,17 @@ http-hardening [from ] This keyword covers all known keywords together. It is essentially used to enable or disable all checks at once. + - delete-all-trailer-fields (inbound, request and response) + Deletes from requests and responses any trailer field, regardless of + its content or syntax. This is done after syntactic checks though. The + vast majority of public facing applications do not use trailers because + they are not reliable (intermediaries are allowed to drop or fold them) + and their presence on public networks is generally associated with + attack attempts. It is generally safe to drop them by default on public + facing listeners, and even on servers meant to deliver public contents, + in order to avoid any information leakage. Note that gRPC services use + them, in responses only. + - delete-underscore-in-header-name (inbound, request and response) Deletes from requests and responses any header field whose name contains an underscore character ('_' or \x5C). While this character is diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h index e5019bb3d..2637bec24 100644 --- a/include/haproxy/http-t.h +++ b/include/haproxy/http-t.h @@ -248,6 +248,7 @@ struct http_violation { #define HTTP_HRD_DEL_USCORE_TLR_NAM 0x00000020 #define HTTP_HRD_DEL_UNREG_HDR 0x00000040 #define HTTP_HRD_DEL_UNREG_TLR 0x00000080 +#define HTTP_HRD_DEL_ALL_TLR 0x00000100 /* insert new masks above this line */ #define HTTP_HRD_ALL 0xFFFFFFFF diff --git a/src/http.c b/src/http.c index a4df4e177..4055b0528 100644 --- a/src/http.c +++ b/src/http.c @@ -1783,6 +1783,7 @@ const struct http_hardening_kw http_hardening_kws[] = { { "delete-underscore-in-trailer-name", HTTP_HRD_DEL_USCORE_TLR_NAM, HTTP_DIR_BOTH }, { "delete-unregistered-header-fields",HTTP_HRD_DEL_UNREG_HDR, HTTP_DIR_BOTH }, { "delete-unregistered-trailer-fields",HTTP_HRD_DEL_UNREG_TLR, HTTP_DIR_BOTH }, + { "delete-all-trailer-fields", HTTP_HRD_DEL_ALL_TLR, HTTP_DIR_BOTH }, /* insert new hardening options above this line */ { "all", HTTP_HRD_ALL, HTTP_DIR_BOTH }, { NULL, 0 } diff --git a/src/http_htx.c b/src/http_htx.c index 39f4cb352..99f211578 100644 --- a/src/http_htx.c +++ b/src/http_htx.c @@ -2074,6 +2074,12 @@ enum http_parser_status http_trailers_to_htx(struct http_hdr *list, struct htx * goto fail; } + /* we may have to delete any trailer (we do that after syntax check) */ + if (unlikely(http_harden(HTTP_HRD_DEL_ALL_TLR))) { + /* skip it, so it won't be added */ + continue; + } + /* we may have to delete trailers with underscores * in their names. These ones are already marked * as found when not rejected so we can avoid a -- 2.47.3