From: Willy Tarreau Date: Wed, 4 Nov 2026 17:17:48 +0000 (+0100) Subject: MEDIUM: http: enable a few important hardening rules on untrusted connections X-Git-Tag: v3.5-dev11~5 X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=4662225cfcc16562a1c484be19c88633015618f9;p=haproxy.git MEDIUM: http: enable a few important hardening rules on untrusted connections For connections coming from non-local IP addresses, we now enable these hardening rules by default, which should not cause any trouble to existing applications and which are essentially used to build attacks when seen in public: - reject-content-length-leading-zero - reject-content-length-with-te - reject-ctl-in-header-trailer - reject-header-trailer-folding - reject-lowercase-method This will cause error 400 or 502 depending on the side they are triggered. In HTTP/1 an error will be captured. We still don't have a capture of what matched but that's a start. --- diff --git a/doc/configuration.txt b/doc/configuration.txt index be54a1ad4..d44656b1c 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -34597,7 +34597,7 @@ http-hardening [from ] communication, and for example for cache poisionning attacks. These may seldom be seen on legacy applications but not on standard components found on the internet, so it is generally safe to reject them on public - facing listeners. + facing listeners. It is enabled by default on untrusted connections. - reject-content-length-with-te (inbound request and response) Rejects requests and responses having both a Content-Length header @@ -34608,7 +34608,8 @@ http-hardening [from ] the rest of the communication. These are still seldom seen in legacy client or server applications, sometimes in relation with compression and/or caching. While HAProxy properly normalizes them, it is generally - safe to reject them on public facing listeners. + safe to reject them on public facing listeners. It is enabled by + default on untrusted connections. - reject-ctl-in-header-trailer (inbound request and response) Rejects requests and responses which contain control characters in @@ -34621,6 +34622,7 @@ http-hardening [from ] which can make certain backend applications trigger connection errors. As such, it is both safe and recommended to block them on public facing listeners. See also the has_ctl() converter used for detecting them. + It is enabled by default on untrusted connections. - reject-duplicate-host-header (inbound request) Rejects requests containing more than one "Host" header field, even if @@ -34638,14 +34640,15 @@ http-hardening [from ] to inject headers into non-compliant components, and should be rejected as a sign of break-in attempt. Note that HAProxy does not have problems with them and systematically unfolds these messages before forwarding - them. + them. It is enabled by default on untrusted connections. - reject-lowercase-method (inbound request) Rejects requests whose method contains a lower-case character. No standard HTTP method uses lower-case characters and these ones are essentially used in desynchronization attack scenarios, by trying to exploit different case matching schemes along the chain. This is - recommended on untrusted listeners. + recommended on untrusted listeners. It is enabled by default on + untrusted connections. - reject-underscore-in-header-name (inbound, request and response) Rejects requests and responses in which one header field name contains diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h index a6f4e2db4..f221ad129 100644 --- a/include/haproxy/http-t.h +++ b/include/haproxy/http-t.h @@ -276,7 +276,12 @@ struct http_violation { #define HTTP_HRD_DEFAULT HTTP_HRD_NONE /* default contents of the implicit "untrusted" and "trusted" profiles */ -#define HTTP_HRD_UNTRUSTED_DEFAULT HTTP_HRD_DEFAULT +#define HTTP_HRD_UNTRUSTED_DEFAULT (HTTP_HRD_REJ_LCASE_METHOD | \ + HTTP_HRD_REJ_HDR_FOLD | \ + HTTP_HRD_REJ_CTL_IN_HDR | \ + HTTP_HRD_REJ_CL_TE | \ + HTTP_HRD_REJ_CL_LEAD_ZERO) + #define HTTP_HRD_TRUSTED_DEFAULT HTTP_HRD_DEFAULT /* a hardening keyword */