meineerde

defaults
  mode http

frontent fe
  bind :8080

  use_backend be

backend be
  # do whatever...

meineerde

frontend foo
  bind :443 ssl crt /path/to/certs

  # Ensure we have a clean state to start with
  http-request del-header X-SERVER-SNI

  # Set the concatenated value of the SNI value to a temporary header
  http-request set-header X-SERVER-SNI haproxy.%[ssl_fc_sni] if { ssl_fc_sni -m found }

  # Set the value of the header to a transaction-level variable

meineerde

# Build a new (internal) header containing the required full-base data
# Unfortunately, we can't use variables here since they can't be used to concat data
http-request set-header X-Full-Base %[base]
http-request set-header X-Full-Base %[base]?%[query] if { query -m found }

http-request deny if { req.hdr(X-Full-Base),map(/path/to/url_list.txt) -m found }

# cleanup
http-request del-header X-Full-Base

meineerde

# First extract the rate into a variable called req.src_http_req_rate
http-request content set-var req.src_http_req_rate %[src_http_req_rate]

# Then use this variable in the acl by subtracting the current rate from the
# value returned from the map. If the result is less than 0, the request rate
# is larger than the allowed value
acl abuse src,map_ip_int(/etc/haproxy/ips.map),sub(req.src_http_req_rate) -m int lt 0

meineerde

The MIT License (MIT)

Copyright (c) 2015 Holger Just, Planio GmbH

Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:

meineerde

acl httponly_cookie res.hdr(Set-Cookie),lower -m sub httponly
rspirep ^(set-cookie:.*) \1;\ HttpOnly if !httponly_cookie

meineerde

listen tls
  bind *:443
  mode tcp

  tcp-request inspect-delay 5s
  tcp-request content accept if { req_ssl_hello_type 1 }

  # deny clients not sending an SNI header in 5 seconds
  tcp-request content reject

meineerde

regex_which_matches_4_byte_utf8_characters = /[\u{ffff}-\u{10FFFF}]/

meineerde

# In HAProxy 1.5, we have to jump through some hops to accomplish a rewrite of a request's path...
# We use a temporary header to build our new path from the existing one in the request
# and then directly perform a redirect

# Clean the request and remove any existing header named X-Rewrite
http-request del-header X-REWRITE

# Copy the full request URL into the X-REWRITE request header unchanged
http-request add-header X-REWRITE %[url] if { path_beg /foo }

meineerde

frontend http
  bind 10.0.0.1:80
  mode http

  # Add a new header with the environment variable and the path concatenated
  http-request set-header X-ROUTING %[env(SERVER_AUTH)]::%[path]
  # Then compare the value using a regular expression with back-references
  # We need to use a named capture because of "reasons". Backreferences to normal captures seem to be rejected by HAProxy
  use_backend app if { req.hdr(X-ROUTING) -m reg ^(?<auth>.+)==\1 }
  # Cleanup in case we hadn't matched yet