Introduction to HAProxy ACLs

blog20180913-01.cfg

acl is_static path -i -m beg /static/

blog20180913-02.cfg

acl is_static path -i -m beg /static/
use_backend be_static if is_static

blog20180913-03.cfg

use_backend be_static if { path -i -m beg /static/ }

blog20180913-04.cfg

http-request deny if { path -i -m beg /api/ } { src 10.0.0.0/16 }

blog20180913-05.cfg

http-request deny if { path -i -m beg /api/ } !{ src 10.0.0.0/16 }

blog20180913-06.cfg

http-request deny if { path -i -m beg /api/ } { src -f /etc/hapee-1.8/blacklist.acl }

blog20180913-07.acl

192.168.122.3
192.168.122.0/24

blog20180913-08.cfg

http-request deny if { path -i -m beg /evil/ } || { path -i -m end /evil }

blog20180913-09.cfg

acl starts_evil path -i -m beg /evil/
acl ends_evil path -i -m end /evil
http-request deny if starts_evil || ends_evil

blog20180913-10.cfg

acl evil path_beg /evil/
acl evil path_end /evil
http-request deny if evil

blog20180913-11.cfg

http-request deny if evil !{ src 10.0.0.0/16 }

blog20180913-12.cfg

path,regsub(^/static,/)

blog20180913-13.cfg

path -i -m beg -f /etc/hapee/paths_secret.acl

blog20180913-14.cfg

http-request redirect location http://www.%[hdr(host)]%[capture.req.uri] unless { hdr_beg(host) -i www }

blog20180913-15.cfg

redirect scheme https if !{ ssl_fc }

blog20180913-16.cfg

http-request redirect prefix /foo if !{ path_beg /foo/ }

blog20180913-17.cfg

redirect scheme code 301 https if !{ ssl_fc }

blog20180913-18.cfg

use_backend be_stats if { path_beg /stats }

blog20180913-19.cfg

use_backend be_%[path,map_beg(/etc/hapee-1.8/paths.map)]

blog20180913-20.cfg

use_backend be_%[path,map_beg(/etc/hapee-1.8/paths.map, mydefault)]

blog20180913-21.cfg

tcp-request inspect-delay 10s
use_backend be_ssl if { req.ssl_hello_type gt 0 }

blog20180913-22.cfg

http-request set-path /foo%[path] if !{ path_beg /foo }

blog20180913-23.cfg

http-request set-var(txn.session_id) cook(sessionid)
use_backend be_%[var(txn.session_id),map(/etc/hapee-1.8/sessionid.map)] if { var(txn.session_id),map(/etc/hapee-1.8/sessionid.map) -m found }
http-response set-map(/etc/hapee-1.8/sessionid.map) %[var(txn.session_id)] %[res.hdr(x-new-backend)] if { res.hdr(x-new-backend) -m found }
default_backend be_login

blog20180913-24.cfg

http-request set-var(txn.path) path
acl is_icons_path var(txn.path) -m beg /icons/
http-request cache-use icons if is_icons_path
http-response cache-store icons if is_icons_path

blog20180913-25.cfg

http-request deny if HTTP_1.0

blog20180913-26.cfg

http-request deny if { req.hdr(user-agent) -m sub evil }

blog20180913-27.cfg

http-request deny if { req.hdr(user-agent) -m len 32 }

blog20180913-28.cfg

http-request deny if { req.hdr(user-agent) -m len le 32 }

blog20180913-29.cfg

http-request deny if { path /api/wastetime }

blog20180913-30.cfg

http-request deny if { path -m sub /. }

blog20180913-31.cfg

dynamic-update
  update id /etc/hapee-1.8/whitelist.acl url http://192.168.122.1/whitelist.acl delay 60s

blog20180913-32.sh

echo "add acl /etc/hapee-1.8/whitelist.acl 1.2.3.4" | socat stdio /var/run/hapee-lb.sock