Re: HAProxy - How to filter (all) Headers by Regex

[Firman Gautama]

Hi Baptiste,

In our production setup. The flow will be like this:

incoming clients request -- *HAProxy* (as a load balancer) -- Nginx (as a
router) -- App servers (java and ruby)

In our java app servers, sometime there is an exception log complained by
'Netty' (our java web server) with a message something like this:

java.lang.IllegalArgumentException: Header value contains a prohibited
character '\f': ga^L???`?
at
org.jboss.netty.handler.codec.http.HttpHeaders.validateHeaderValue(HttpHeaders.java:1079)
~[io.netty.netty-3.9.3.Final.jar:na]
at
org.jboss.netty.handler.codec.http.DefaultHttpHeaders.validateHeaderValue0(DefaultHttpHeaders.java:128)
~[io.netty.netty-3.9.3.Final.jar:na]
...

It's complaining about the 'invalid characters' on the header. But I can't
seem to reproduce it manually, because I'm myself not sure what kind of
'invalid' characters it had.

So now I'm wondering, what kind of filter that already done automatically
by HAProxy as default? And how if I want to add extra 'regex' filter in the
HAProxy for incoming headers, for let say I only want to allow [a-Z0-9] for
example. (So I can make sure if the error msg still occurring that's mean
the traffic didn't come from HAProxy)

It's hard to parse all the logs because quite big of a traffic, so I want
to do a trial-error approach.

Regards,
Firman




On Fri, Aug 28, 2015 at 1:55 PM, Baptiste bed...@gmail.com wrote:


 Le 28 août 2015 06:31, Firman Gautama firman.gaut...@gmail.com a
 écrit :
 
  Hello All,
 
  I was just wondering what is the best way if we want to filter all
 headers by certain regex to block invalid/malicious characters?
  I read on the documentation, CMIIW, but the example there only shown if
 we know the specific header name.
  Does anybody know how to filter all the http headers with specific
 regex, so we could discard all the traffic with the invalid headers and
 only forward the good one.
 
  Regards,
  Firman Gautama

 Hi Firman,

 This is already haproxy's default behavior.
 Do you have an example of a 'weird' character which passed through?

 Baptiste

HAProxy - How to filter (all) Headers by Regex

[Firman Gautama]

Hello All,

I was just wondering what is the best way if we want to filter all headers
by certain regex to block invalid/malicious characters?
I read on the documentation, CMIIW, but the example there only shown if we
know the specific header name.
Does anybody know how to filter all the http headers with specific regex,
so we could discard all the traffic with the invalid headers and only
forward the good one.

Regards,
Firman Gautama