From: Willy Tarreau <w@1wt.eu>
Date: Wed, 4 Nov 2026 15:21:34 +0000 (+0100)
Subject: MINOR: http/hardening: add aliases "all-reject" and "all-delete"
X-Git-Tag: v3.5-dev11~6
X-Git-Url: https://git.kaiwu.me/?a=commitdiff_plain;h=fe74f3fcb782d59b03dc6ae8d01a8a0f33a1060b;p=haproxy.git

MINOR: http/hardening: add aliases "all-reject" and "all-delete"

These aliases group all reject-* and all delete-* respectively into one
alias, allowing to simplify general cleanups on certain boundaries, or
to fix issues in emergency.
---

diff --git a/doc/configuration.txt b/doc/configuration.txt
index adf73fd7f..be54a1ad4 100644
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -34525,6 +34525,16 @@ http-hardening <name> [from <name2>]
         This keyword covers all known keywords together. It is essentially used
         to enable or disable all checks at once.
 
+  - all-reject
+        This keyword covers all keywords below whose name starts with "reject".
+        It may be used on the CLI or in the config to quickly disable any rule
+        that rejects traffic in case of issues.
+
+  - all-delete
+        This keyword covers all keywords below whose name starts with "delete".
+        It may be used on the CLI or in the config to quickly disable any rule
+        that deletes elements in case of issues.
+
   - delete-all-trailer-fields (inbound, request and response)
         Deletes from requests and responses any trailer field, regardless of
         its content or syntax. This is done after syntactic checks though. The
diff --git a/include/haproxy/http-t.h b/include/haproxy/http-t.h
index d3b3c0b62..a6f4e2db4 100644
--- a/include/haproxy/http-t.h
+++ b/include/haproxy/http-t.h
@@ -254,6 +254,22 @@ struct http_violation {
 #define HTTP_HRD_REJ_CL_TE                  0x00000800
 #define HTTP_HRD_REJ_CL_LEAD_ZERO           0x00001000
 /* insert new masks above this line */
+/* update this one with new rejects */
+#define HTTP_HRD_ALL_REJECT                 (HTTP_HRD_REJ_DUP_HOST_HDR   | \
+                                             HTTP_HRD_REJ_LCASE_METHOD   | \
+                                             HTTP_HRD_REJ_USCORE_HDR_NAM | \
+                                             HTTP_HRD_REJ_USCORE_TLR_NAM | \
+                                             HTTP_HRD_REJ_HDR_FOLD       | \
+                                             HTTP_HRD_REJ_CTL_IN_HDR     | \
+                                             HTTP_HRD_REJ_CL_TE          | \
+                                             HTTP_HRD_REJ_CL_LEAD_ZERO)
+
+#define HTTP_HRD_ALL_DELETE                 (HTTP_HRD_DEL_USCORE_HDR_NAM         | \
+                                             HTTP_HRD_DEL_USCORE_TLR_NAM         | \
+                                             HTTP_HRD_DEL_UNREG_HDR              | \
+                                             HTTP_HRD_DEL_UNREG_TLR              | \
+                                             HTTP_HRD_DEL_ALL_TLR)
+
 #define HTTP_HRD_ALL                        0xFFFFFFFF
 
 /* default policy for a new profile: permissive */
diff --git a/src/http.c b/src/http.c
index e4b7c4306..6327b1713 100644
--- a/src/http.c
+++ b/src/http.c
@@ -1792,6 +1792,8 @@ const struct http_hardening_kw http_hardening_kws[] = {
 	{ "reject-content-length-with-te",     HTTP_HRD_REJ_CL_TE, HTTP_DIR_BOTH },
 	{ "reject-content-length-leading-zero",HTTP_HRD_REJ_CL_LEAD_ZERO, HTTP_DIR_BOTH },
 	/* insert new hardening options above this line */
+	{ "all-reject",                     HTTP_HRD_ALL_REJECT,       HTTP_DIR_BOTH },
+	{ "all-delete",                     HTTP_HRD_ALL_DELETE,       HTTP_DIR_BOTH },
 	{ "all",                            HTTP_HRD_ALL,              HTTP_DIR_BOTH },
 	{ NULL, 0 }
 };