From: Willy Tarreau <w@1wt.eu>
Date: Mon, 26 Oct 2026 17:47:28 +0000 (+0100)
Subject: MINOR: server: add the "http-hardening" server keyword
X-Git-Tag: v3.5-dev11~30
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=cb30bf0bcd5ca4cb5508e05019e8e31a0b55d534;p=haproxy.git

MINOR: server: add the "http-hardening" server keyword

The new "http-hardening" server keyword sets the HTTP hardening profile
that applies to the responses coming from the server and to the requests
sent to it. The server now holds a pointer to the profile, which may be
NULL if unset or explicitly set to "auto". It is inherited from
default-server, server templates and "from" like any other setting, and
may be set at runtime with "add server". The profile must have been
declared before.
---

diff --git a/include/haproxy/server-t.h b/include/haproxy/server-t.h
index 40bfa910e..73e2ba390 100644
--- a/include/haproxy/server-t.h
+++ b/include/haproxy/server-t.h
@@ -343,6 +343,7 @@ struct path_parameters {
 };
 
 struct proxy;
+struct http_hdng_prf;
 
 struct server {
 	/* mostly config or admin stuff, doesn't change often */
@@ -353,6 +354,7 @@ struct server {
 	signed char use_ssl;		        /* ssl enabled (1: on, 0: disabled, -1 forced off)  */
 	unsigned int flags;                     /* server flags (SRV_F_*) */
 	unsigned int pp_opts;                   /* proxy protocol options (SRV_PP_*) */
+	const struct http_hdng_prf *hdng_prf;   /* HTTP hardening profile ("http-hardening") if set, or NULL */
 	struct list el_px;                      /* attach point in parent proxy */
 	struct list el_alt;                     /* extra attach point for several usages
 	                                         * - for <servers_to_init> global list during parsing
diff --git a/src/server.c b/src/server.c
index 50c7771ce..10659b8ad 100644
--- a/src/server.c
+++ b/src/server.c
@@ -33,6 +33,7 @@
 #include <haproxy/event_hdl.h>
 #include <haproxy/global.h>
 #include <haproxy/guid.h>
+#include <haproxy/http.h>
 #include <haproxy/log.h>
 #include <haproxy/mailers.h>
 #include <haproxy/namespace.h>
@@ -2062,6 +2063,31 @@ static int srv_parse_tfo(char **args, int *cur_arg, struct proxy *px, struct ser
 	return 0;
 }
 
+/* parse the "http-hardening" server keyword */
+static int srv_parse_http_hardening(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
+{
+	struct http_hdng_prf *prf = NULL;
+	char *msg = NULL;
+
+	if (!*args[*cur_arg + 1]) {
+		memprintf(err, "'%s' : expects a profile name as argument", args[*cur_arg]);
+		return ERR_ALERT | ERR_FATAL;
+	}
+
+	/* "auto" sets/keeps the NULL, others must resolve */
+	if (strcmp(args[*cur_arg + 1], "auto") != 0) {
+		prf = http_hardening_resolve(args[*cur_arg + 1], &msg);
+		if (!prf) {
+			memprintf(err, "'%s' : %s", args[*cur_arg], msg);
+			free(msg);
+			return ERR_ALERT | ERR_FATAL;
+		}
+	}
+
+	newsrv->hdng_prf = prf;
+	return 0;
+}
+
 /* parse the "usesrc" server keyword */
 static int srv_parse_usesrc(char **args, int *cur_arg, struct proxy *px, struct server *newsrv, char **err)
 {
@@ -2467,6 +2493,7 @@ static struct srv_kw_list srv_kws = { "ALL", { }, {
 	{ "minconn",              srv_parse_minconn,              1,  1,  1 }, /* Enable a dynamic maxconn limit */
 	{ "namespace",            srv_parse_namespace,            1,  1,  0 }, /* Namespace the server socket belongs to (if supported) */
 	{ "no-backup",            srv_parse_no_backup,            0,  1,  1 }, /* Flag as non-backup server */
+	{ "http-hardening",       srv_parse_http_hardening,       1,  1,  1 }, /* Set the HTTP hardening profile */
 	{ "no-send-proxy",        srv_parse_no_send_proxy,        0,  1,  1 }, /* Disable use of PROXY V1 protocol */
 	{ "no-send-proxy-v2",     srv_parse_no_send_proxy_v2,     0,  1,  1 }, /* Disable use of PROXY V2 protocol */
 	{ "no-tfo",               srv_parse_no_tfo,               0,  1,  1 }, /* Disable use of TCP Fast Open */
@@ -2977,6 +3004,7 @@ void srv_settings_cpy(struct server *srv, const struct server *src, int srv_tmpl
 	}
 
 	srv->pp_opts = src->pp_opts;
+	srv->hdng_prf = src->hdng_prf;
 	if (src->rdr_pfx != NULL) {
 		srv->rdr_pfx = strdup(src->rdr_pfx);
 		srv->rdr_len = src->rdr_len;