haproxytechblog · June 14, 2022 14:21
diff --git a/blog20180913-01.cfg b/blog20180913-01.cfg
 acl is_static path -i -m beg /static/
diff --git a/blog20180913-02.cfg b/blog20180913-02.cfg
 acl is_static path -i -m beg /static/
 use_backend be_static if is_static
diff --git a/blog20180913-03.cfg b/blog20180913-03.cfg
 use_backend be_static if { path -i -m beg /static/ }
diff --git a/blog20180913-04.cfg b/blog20180913-04.cfg
 http-request deny if { path -i -m beg /api/ } { src 10.0.0.0/16 }
diff --git a/blog20180913-05.cfg b/blog20180913-05.cfg
 http-request deny if { path -i -m beg /api/ } !{ src 10.0.0.0/16 }
diff --git a/blog20180913-06.cfg b/blog20180913-06.cfg
 http-request deny if { path -i -m beg /api/ } { src -f /etc/hapee-1.8/blacklist.acl }
diff --git a/blog20180913-07.acl b/blog20180913-07.acl
 192.168.122.3
 192.168.122.0/24
diff --git a/blog20180913-08.cfg b/blog20180913-08.cfg
 http-request deny if { path -i -m beg /evil/ } || { path -i -m end /evil }
diff --git a/blog20180913-09.cfg b/blog20180913-09.cfg
 acl starts_evil path -i -m beg /evil/
 acl ends_evil path -i -m end /evil
 http-request deny if starts_evil || ends_evil
diff --git a/blog20180913-10.cfg b/blog20180913-10.cfg
 acl evil path_beg /evil/
 acl evil path_end /evil
 http-request deny if evil
diff --git a/blog20180913-11.cfg b/blog20180913-11.cfg
 http-request deny if evil !{ src 10.0.0.0/16 }
diff --git a/blog20180913-12.cfg b/blog20180913-12.cfg
 path,regsub(^/static,/)
diff --git a/blog20180913-13.cfg b/blog20180913-13.cfg
 path -i -m beg -f /etc/hapee/paths_secret.acl
diff --git a/blog20180913-14.cfg b/blog20180913-14.cfg
 http-request redirect location http://www.%[hdr(host)]%[capture.req.uri] unless { hdr_beg(host) -i www }
diff --git a/blog20180913-15.cfg b/blog20180913-15.cfg
 redirect scheme https if !{ ssl_fc }
diff --git a/blog20180913-16.cfg b/blog20180913-16.cfg
 http-request redirect prefix /foo if !{ path_beg /foo/ }
diff --git a/blog20180913-17.cfg b/blog20180913-17.cfg
 redirect scheme code 301 https if !{ ssl_fc }
diff --git a/blog20180913-18.cfg b/blog20180913-18.cfg
 use_backend be_stats if { path_beg /stats }
diff --git a/blog20180913-19.cfg b/blog20180913-19.cfg
 use_backend be_%[path,map_beg(/etc/hapee-1.8/paths.map)]
diff --git a/blog20180913-20.cfg b/blog20180913-20.cfg
 use_backend be_%[path,map_beg(/etc/hapee-1.8/paths.map, mydefault)]
diff --git a/blog20180913-21.cfg b/blog20180913-21.cfg
 tcp-request inspect-delay 10s
 use_backend be_ssl if { req.ssl_hello_type gt 0 }
diff --git a/blog20180913-22.cfg b/blog20180913-22.cfg
 http-request set-path /foo%[path] if !{ path_beg /foo }
diff --git a/blog20180913-23.cfg b/blog20180913-23.cfg
 http-request set-var(txn.session_id) cook(sessionid)
 use_backend be_%[var(txn.session_id),map(/etc/hapee-1.8/sessionid.map)] if { var(txn.session_id),map(/etc/hapee-1.8/sessionid.map) -m found }
 http-response set-map(/etc/hapee-1.8/sessionid.map) %[var(txn.session_id)] %[res.hdr(x-new-backend)] if { res.hdr(x-new-backend) -m found }
 default_backend be_login
diff --git a/blog20180913-24.cfg b/blog20180913-24.cfg
 http-request set-var(txn.path) path
 acl is_icons_path var(txn.path) -m beg /icons/
 http-request cache-use icons if is_icons_path
 http-response cache-store icons if is_icons_path
diff --git a/blog20180913-25.cfg b/blog20180913-25.cfg
 http-request deny if HTTP_1.0
diff --git a/blog20180913-26.cfg b/blog20180913-26.cfg
 http-request deny if { req.hdr(user-agent) -m sub evil }
diff --git a/blog20180913-27.cfg b/blog20180913-27.cfg
 http-request deny if { req.hdr(user-agent) -m len 32 }
diff --git a/blog20180913-28.cfg b/blog20180913-28.cfg
 http-request deny if { req.hdr(user-agent) -m len le 32 }
diff --git a/blog20180913-29.cfg b/blog20180913-29.cfg
 http-request deny if { path /api/wastetime }
diff --git a/blog20180913-30.cfg b/blog20180913-30.cfg
 http-request deny if { path -m sub /. }
diff --git a/blog20180913-31.cfg b/blog20180913-31.cfg
 dynamic-update
  update id /etc/hapee-1.8/whitelist.acl url http://192.168.122.1/whitelist.acl delay 60s
diff --git a/blog20180913-32.sh b/blog20180913-32.sh
 echo "add acl /etc/hapee-1.8/whitelist.acl 1.2.3.4" | socat stdio /var/run/hapee-lb.sock
	acl is_static path -i -m beg /static/
	use_backend be_static if is_static
	acl starts_evil path -i -m beg /evil/
	acl ends_evil path -i -m end /evil
	http-request deny if starts_evil \|\| ends_evil
	acl evil path_beg /evil/
	acl evil path_end /evil
	http-request deny if evil
	tcp-request inspect-delay 10s
	use_backend be_ssl if { req.ssl_hello_type gt 0 }
	http-request set-var(txn.session_id) cook(sessionid)
	use_backend be_%[var(txn.session_id),map(/etc/hapee-1.8/sessionid.map)] if { var(txn.session_id),map(/etc/hapee-1.8/sessionid.map) -m found }
	http-response set-map(/etc/hapee-1.8/sessionid.map) %[var(txn.session_id)] %[res.hdr(x-new-backend)] if { res.hdr(x-new-backend) -m found }
	default_backend be_login
	http-request set-var(txn.path) path
	acl is_icons_path var(txn.path) -m beg /icons/
	http-request cache-use icons if is_icons_path
	http-response cache-store icons if is_icons_path
	dynamic-update
	update id /etc/hapee-1.8/whitelist.acl url http://192.168.122.1/whitelist.acl delay 60s