From: Willy Tarreau <w@1wt.eu>
Date: Mon, 26 Oct 2026 17:39:23 +0000 (+0100)
Subject: MINOR: listener: add the "http-hardening" bind keyword
X-Git-Tag: v3.5-dev11~31
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=452cac20d11297cf4a5b092a0cb2e405399e9e07;p=haproxy.git

MINOR: listener: add the "http-hardening" bind keyword

The new "http-hardening" bind keyword sets the HTTP hardening profile that
applies to the connections accepted by the bind line. The bind_conf now
keeps a pointer to the profile set by the keyword, or NULL if not set or
if explicitly set to "auto".
---

diff --git a/include/haproxy/listener-t.h b/include/haproxy/listener-t.h
index a6990cbd9..2e5874884 100644
--- a/include/haproxy/listener-t.h
+++ b/include/haproxy/listener-t.h
@@ -42,6 +42,7 @@ struct task;
 struct protocol;
 struct xprt_ops;
 struct proxy;
+struct http_hdng_prf;
 struct fe_counters;
 struct connection;
 
@@ -192,6 +193,7 @@ struct bind_conf {
 #endif
 	struct proxy *frontend;    /* the frontend all these listeners belong to, or NULL */
 	const struct mux_proto_list *mux_proto; /* the mux to use for all incoming connections (specified by the "proto" keyword) */
+	const struct http_hdng_prf *hdng_prf; /* HTTP hardening profile ("http-hardening") if defined, or NULL */
 	struct xprt_ops *xprt;     /* transport-layer operations for all listeners */
 	uint options;              /* set of BC_O_* flags */
 	unsigned int analysers;    /* bitmap of required protocol analysers */
diff --git a/src/listener.c b/src/listener.c
index e5a0eaa75..f7d087f9a 100644
--- a/src/listener.c
+++ b/src/listener.c
@@ -32,6 +32,7 @@
 #include <haproxy/frontend.h>
 #include <haproxy/global.h>
 #include <haproxy/guid.h>
+#include <haproxy/http.h>
 #include <haproxy/list.h>
 #include <haproxy/listener.h>
 #include <haproxy/log.h>
@@ -2571,6 +2572,31 @@ static int bind_parse_guid_prefix(char **args, int cur_arg, struct proxy *px, st
 	return 0;
 }
 
+/* parse the "http-hardening" bind keyword */
+static int bind_parse_http_hardening(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
+{
+	struct http_hdng_prf *prf = NULL;
+	char *msg = NULL;
+
+	if (!*args[cur_arg + 1]) {
+		memprintf(err, "'%s' : expects a profile name as argument", args[cur_arg]);
+		return ERR_ALERT | ERR_FATAL;
+	}
+
+	/* "auto" sets/keeps the NULL, others must resolve */
+	if (strcmp(args[cur_arg + 1], "auto") != 0) {
+		prf = http_hardening_resolve(args[cur_arg + 1], &msg);
+		if (!prf) {
+			memprintf(err, "'%s' : %s", args[cur_arg], msg);
+			free(msg);
+			return ERR_ALERT | ERR_FATAL;
+		}
+	}
+
+	conf->hdng_prf = prf;
+	return 0;
+}
+
 /* parse the "id" bind keyword */
 static int bind_parse_id(char **args, int cur_arg, struct proxy *px, struct bind_conf *conf, char **err)
 {
@@ -3048,6 +3074,7 @@ static struct bind_kw_list bind_kws = { "ALL", { }, {
 	{ "accept-proxy", bind_parse_accept_proxy, 0, 0 }, /* enable PROXY protocol */
 	{ "backlog",      bind_parse_backlog,      1, 0 }, /* set backlog of listening socket */
 	{ "guid-prefix",  bind_parse_guid_prefix,  1, 1 }, /* set guid of listening socket */
+	{ "http-hardening", bind_parse_http_hardening, 1, 1 }, /* set the HTTP hardening profile */
 	{ "id",           bind_parse_id,           1, 1 }, /* set id of listening socket */
 	{ "idle-ping",    bind_parse_idle_ping,    1, 1 }, /* activate idle ping if mux support it */
 	{ "label",        bind_parse_label,        1, 1 }, /* set label of listening socket */