Cyril, that makes perfect sense but I wouldn't have thought of it. Thank you for pointing me the right direction!
On Thu, Oct 1, 2015 at 4:39 PM, Cyril Bonté <[email protected]> wrote: > Hi, > > Le 01/10/2015 20:56, CJ Ess a écrit : > >> So I am trying to set some new rules - since I don't have anything hand >> to echo requests back to me, I'm using http-response add-header so I can >> verify my rules work with curl. >> >> Added to haproxy.cfg: >> >> acl test_origin hdr(X-TEST-IP) -m ip -f /etc/haproxy/acl/test.acl >> http-response add-header X-Test test >> http-response add-header X-Test internal if test_origin >> #http-request deny if test_origin >> Added to /etc/haproxy/acl/test.acl >> >> 127.0.0.3 >> >> I expect that when I do: curl -vvv -H "X-TEST-IP: 127.0.0.3" >> http://127.0.0.1:4089/ >> >> That I would get a response that included two X-Test headers - however I >> am only seeing the first one. "X-Test: test". >> >> If I uncomment the "deny" rule then the request will be denied, so I >> believe the the acl is working. >> >> If I change the "if test_origin" to "if !test_origin" then I'll see the >> second header, so I think the if is being parsed at least. >> > > You're trying to apply an acl on a request header during the response > processing, hence such header is not available anymore in the buffer. > > You should look at the warning during haproxy init, you'll probably have : > "acl 'test_origin' will never match because it only involves keywords that > are incompatible with 'backend http-response header rule'" > > With the 1.6 dev branch, you can use variables to store the request value > in the session : > http-request set-var(sess.X_TEST_IP) hdr(X-TEST-IP) > acl test_origin var(sess.X_TEST_IP) -m -f /etc/haproxy/acl/test.acl > > During the request processing, the header is stored at the session scope, > which will be available during the response processing. > > > -- > Cyril Bonté >
