MEDIUM: http: enable a few important hardening rules on untrusted connections

For connections coming from non-local IP addresses, we now enable these
hardening rules by default, which should not cause any trouble to
existing applications and which are essentially used to build attacks
when seen in public:

  - reject-content-length-leading-zero
  - reject-content-length-with-te
  - reject-ctl-in-header-trailer
  - reject-header-trailer-folding
  - reject-lowercase-method

This will cause error 400 or 502 depending on the side they are triggered.
In HTTP/1 an error will be captured. We still don't have a capture of what
matched but that's a start.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index be54a1ad4f30cd5a026a58732d63caa7bdb47f1a..d44656b1ce791a2d473b551c96b04c34e4624304 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -34597,7 +34597,7 @@ http-hardening <name> [from <name2>]
         communication, and for example for cache poisionning attacks. These may
         seldom be seen on legacy applications but not on standard components
         found on the internet, so it is generally safe to reject them on public
-        facing listeners.
+        facing listeners. It is enabled by default on untrusted connections.
 
   - reject-content-length-with-te (inbound request and response)
         Rejects requests and responses having both a Content-Length header
@@ -34608,7 +34608,8 @@ http-hardening <name> [from <name2>]
         the rest of the communication. These are still seldom seen in legacy
         client or server applications, sometimes in relation with compression
         and/or caching. While HAProxy properly normalizes them, it is generally
-        safe to reject them on public facing listeners.
+        safe to reject them on public facing listeners. It is enabled by
+        default on untrusted connections.
 
   - reject-ctl-in-header-trailer (inbound request and response)
         Rejects requests and responses which contain control characters in
@@ -34621,6 +34622,7 @@ http-hardening <name> [from <name2>]
         which can make certain backend applications trigger connection errors.
         As such, it is both safe and recommended to block them on public facing
         listeners. See also the has_ctl() converter used for detecting them.
+        It is enabled by default on untrusted connections.
 
   - reject-duplicate-host-header (inbound request)
         Rejects requests containing more than one "Host" header field, even if
@@ -34638,14 +34640,15 @@ http-hardening <name> [from <name2>]
         to inject headers into non-compliant components, and should be rejected
         as a sign of break-in attempt. Note that HAProxy does not have problems
         with them and systematically unfolds these messages before forwarding
-        them.
+        them. It is enabled by default on untrusted connections.
 
   - reject-lowercase-method (inbound request)
         Rejects requests whose method contains a lower-case character. No
         standard HTTP method uses lower-case characters and these ones are
         essentially used in desynchronization attack scenarios, by trying to
         exploit different case matching schemes along the chain. This is
-        recommended on untrusted listeners.
+        recommended on untrusted listeners. It is enabled by default on
+        untrusted connections.
 
   - reject-underscore-in-header-name (inbound, request and response)
         Rejects requests and responses in which one header field name contains

diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h
index a6f4e2db47e0b9fa263d0ff3ef4b4b0e7b847946..f221ad12941d017f7fff62946909bedba66d8360 100644 (file)
--- a/include/haproxy/http-t.h
+++ b/include/haproxy/http-t.h
@@ -276,7 +276,12 @@ struct http_violation {
 #define HTTP_HRD_DEFAULT  HTTP_HRD_NONE
 
 /* default contents of the implicit "untrusted" and "trusted" profiles */
-#define HTTP_HRD_UNTRUSTED_DEFAULT             HTTP_HRD_DEFAULT
+#define HTTP_HRD_UNTRUSTED_DEFAULT             (HTTP_HRD_REJ_LCASE_METHOD | \
+                                                HTTP_HRD_REJ_HDR_FOLD     | \
+                                                HTTP_HRD_REJ_CTL_IN_HDR   | \
+                                                HTTP_HRD_REJ_CL_TE        | \
+                                                HTTP_HRD_REJ_CL_LEAD_ZERO)
+
 #define HTTP_HRD_TRUSTED_DEFAULT               HTTP_HRD_DEFAULT
 
 /* a hardening keyword */