From: Christopher Faulet <cfaulet@haproxy.com>
Date: Wed, 30 Sep 2026 16:24:00 +0000 (+0200)
Subject: MINOR: filters: Reject filter-* directives in anonymous defaults
X-Git-Tag: v3.5-dev9~84
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=f967e3756f7eec67945a9443f0f4f80df6ccbd2b;p=haproxy.git

MINOR: filters: Reject filter-* directives in anonymous defaults

Require a named defaults section for filter-config, filter-sequence and
filter-enable/filter-disable, consistently with the restriction on TCP/HTTP
rules. Reject these directives before parsing their arguments or recording
configuration entries. Named defaults and regular proxies remain supported.

Add regression coverage for each rejected directive and for valid usage in
named defaults, frontends and backends, including inherited instances.
---

diff --git a/reg-tests/filters/defaults.vtc b/reg-tests/filters/defaults.vtc
new file mode 100644
index 000000000..47cbc7b1b
--- /dev/null
+++ b/reg-tests/filters/defaults.vtc
@@ -0,0 +1,79 @@
+varnishtest "Filter instance directives require named defaults sections"
+
+feature ignore_unknown_macro
+
+# Reject each directive in anonymous defaults before processing its arguments.
+haproxy h1 -conf-BAD {'filter-config' not allowed in anonymous 'defaults' section} {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    defaults
+        filter-config trace id test
+}
+
+haproxy h2 -conf-BAD {'filter-sequence' not allowed in anonymous 'defaults' section} {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    defaults
+        filter-sequence request trace/a:before(trace/b)
+}
+
+haproxy h3 -conf-BAD {'filter-enable' not allowed in anonymous 'defaults' section} {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    defaults
+        filter-enable trace/test
+}
+
+haproxy h4 -conf-BAD {'filter-disable' not allowed in anonymous 'defaults' section} {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    defaults
+        filter-disable trace/test
+}
+
+# Named defaults and regular proxies still accept the directives, including
+# inherited instances and locally configured enable/disable and ordering.
+haproxy h5 -conf-OK {
+    global
+    .if feature(THREAD)
+        thread-groups 1
+    .endif
+
+    defaults filters
+        mode http
+        timeout connect "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout client  "${HAPROXY_TEST_TIMEOUT-5s}"
+        timeout server  "${HAPROXY_TEST_TIMEOUT-5s}"
+        filter-config trace id a
+        filter-config trace id b enabled
+        filter-enable trace/a
+        filter-disable trace/b
+        filter-sequence request trace/b:before(trace/a)
+
+    frontend fe from filters
+        bind "fd@${fe}"
+        filter-config trace id local enabled
+        filter-enable trace/b
+        filter-disable trace/a
+        filter-sequence response trace/local:before(trace/b)
+        http-request return status 200
+
+    backend be from filters
+        filter-config trace id local enabled
+        filter-enable trace/b
+        filter-disable trace/a
+        filter-sequence response trace/local:before(trace/b)
+        http-request return status 200
+}
diff --git a/src/filters.c b/src/filters.c
index 20d12c3da..080e99643 100644
--- a/src/filters.c
+++ b/src/filters.c
@@ -1922,6 +1922,12 @@ static int parse_filter_config(char **args, int section_type, struct proxy *curp
 	int cur_arg = 1;
 	int i;
 
+	if ((curpx->cap & PR_CAP_DEF) && !*curpx->id) {
+		memprintf(err, "parsing [%s:%d] : '%s' not allowed in anonymous 'defaults' section.",
+			  file, line, args[0]);
+		return -1;
+	}
+
 	inst = NULL;
 	if (!*args[cur_arg]) {
 		memprintf(err,
@@ -2118,6 +2124,12 @@ static int parse_filter_enable(char **args, int section_type, struct proxy *curp
 	unsigned int enable = (strcmp(args[0], "filter-enable") == 0);
 	int cur_arg;
 
+	if ((curpx->cap & PR_CAP_DEF) && !*curpx->id) {
+		memprintf(err, "parsing [%s:%d] : '%s' not allowed in anonymous 'defaults' section.",
+			  file, line, args[0]);
+		return -1;
+	}
+
 	if (!*args[1]) {
 		memprintf(err,
 			  "parsing [%s:%d] : missing argument for '%s' in %s '%s'.",
@@ -2197,6 +2209,12 @@ static int parse_filter_sequence(char **args, int section_type, struct proxy *cu
 	int cur_arg;
 	int ret = 0;
 
+	if ((curpx->cap & PR_CAP_DEF) && !*curpx->id) {
+		memprintf(err, "parsing [%s:%d] : '%s' not allowed in anonymous 'defaults' section.",
+			  file, line, args[0]);
+		return -1;
+	}
+
 	if (!*args[1]) {
 		memprintf(err, "missing argument for '%s' in %s '%s'.", args[0], proxy_type_str(curpx), curpx->id);
 		goto error;