subject:"equivalent of url32\+src for hdr

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

2023-05-11 Thread Nathan Rixham

On Fri, 12 May 2023, 00:00 Aleksandar Lazic,  wrote:

> How about to try to use `hdr_ip(x-forwarded-for),base32` or something
> similar?
>
> You can take a look into the reg-tests for some more inspiration :-)
>
> https://git.haproxy.org/?p=haproxy.git;a=blob;f=reg-tests/http-rules/converters_ipmask_concat_strcmp_field_word.vtc;h=55bcb5f9c7d7ade1826dc8f276dfd3d55576c3ce;hb=HEAD#l117


Perfect thank you so much for the pointers, consider resolved, for future
searchers I will update with a working config example at a later date.

Best, Nathan

>
>

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

2023-05-11 Thread Aleksandar Lazic


Hi.

On 12.05.23 00:36, Nathan Rixham wrote:

NP, let's stick to a generic example then, redacted down to the bare minimum

backend st-min
     # log request rate over 1 minute
     stick-table type ipv6 size 1g expire 2m store http_req_rate(1m)

backend st-min-url
     # log request rate per distinct url+ip(v4/6)
     stick-table type binary len 8 size 1g expire 2m store http_req_rate(1m)

backend dc
     # works perfectly as expected
     http-request track-sc0 hdr_ip(x-forwarded-for) table st-min
     # need url32+hdr_ip(x-forwarded-for) here, as src is another haproxy
     http-request track-sc1 url32+src table st-min-url


As documented at 
https://docs.haproxy.org/2.4/configuration.html#4.2-http-request%20track-sc1 
supports the  sample expression.


In the code use the "url32+src" the full_hash which is not exposed as 
sample function, afaik.


How about to try to use `hdr_ip(x-forwarded-for),base32` or something 
similar?


You can take a look into the reg-tests for some more inspiration :-)
https://git.haproxy.org/?p=haproxy.git;a=blob;f=reg-tests/http-rules/converters_ipmask_concat_strcmp_field_word.vtc;h=55bcb5f9c7d7ade1826dc8f276dfd3d55576c3ce;hb=HEAD#l117



     # augment on to request headers
     http-request set-header X-HA-Min-Rate %[sc_http_req_rate(0)]
     # send tracked sc-hour variables to core
     http-request set-header X-HA-Min-Rate-URL %[sc_http_req_rate(1)]
     # whatever backend
     server localhost localhost:81 check

Hope this clarifies, haproxy -vv output follows, however any version will do

haproxy -vv

HAProxy version 2.4.22-1ppa1~focal 2023/02/16 - https://haproxy.org/ 

Status: long-term supported branch - will stop receiving fixes around Q2 
2026.
Known bugs: http://www.haproxy.org/bugs/bugs-2.4.22.html 

Running on: Linux 5.15.0-60-generic #66~20.04.1-Ubuntu SMP Wed Jan 25 
09:41:30 UTC 2023 x86_64

Build options :
   TARGET  = linux-glibc
   CPU     = generic
   CC      = cc
   CFLAGS  = -O2 -g -O2 
-fdebug-prefix-map=/build/haproxy-ENmdsi/haproxy-2.4.22=. 
-fstack-protector-strong -Wformat -Werror=format-security -Wdate-time 
-D_FORTIFY_SOURCE=2 -Wall -Wextra -Wdeclaration-after-statement -fwrapv 
-Wno-address-of-packed-member -Wno-unused-label -Wno-sign-compare 
-Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers 
-Wno-cast-function-type -Wtype-limits -Wshift-negative-value 
-Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference
   OPTIONS = USE_PCRE2=1 USE_PCRE2_JIT=1 USE_OPENSSL=1 USE_LUA=1 
USE_SLZ=1 USE_SYSTEMD=1 USE_PROMEX=1

   DEBUG   =

Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY 
+CRYPT_H -DEVICEATLAS +DL +EPOLL -EVPORTS +FUTEX +GETADDRINFO -KQUEUE 
+LIBCRYPT +LINUX_SPLICE +LINUX_TPROXY +LUA -MEMORY_PROFILING +NETFILTER 
+NS -OBSOLETE_LINKER +OPENSSL -OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT 
+POLL +PRCTL -PRIVATE_CACHE -PROCCTL +PROMEX -PTHREAD_PSHARED -QUIC +RT 
+SLZ -STATIC_PCRE -STATIC_PCRE2 +SYSTEMD +TFO +THREAD +THREAD_DUMP 
+TPROXY -WURFL -ZLIB


Default settings :
   bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_THREADS=64, default=12).
Built with OpenSSL version : OpenSSL 1.1.1f  31 Mar 2020
Running on OpenSSL version : OpenSSL 1.1.1f  31 Mar 2020
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.3
Built with the Prometheus exporter as a service
Built with network namespace support.
Built with libslz for stateless compression.
Compression algorithms supported : identity("identity"), 
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with transparent proxy support using: IP_TRANSPARENT 
IPV6_TRANSPARENT IP_FREEBIND

Built with PCRE2 version : 10.34 2019-11-21
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with gcc compiler version 9.4.0

Available polling systems :
       epoll : pref=300,  test result OK
        poll : pref=200,  test result OK
      select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :
(protocols marked as  cannot be specified using 'proto' keyword)
               h2 : mode=HTTP       side=FE|BE     mux=H2   
flags=HTX|CLEAN_ABRT|HOL_RISK|NO_UPG
             fcgi : mode=HTTP       side=BE        mux=FCGI 
flags=HTX|HOL_RISK|NO_UPG

         : mode=HTTP       side=FE|BE     mux=H1       flags=HTX
               h1 : mode=HTTP       side=FE|BE     mux=H1   
flags=HTX|NO_UPG

         : mode=TCP        side=FE|BE     mux=PASS     flags=
             none : mode=TCP        side=FE|BE     mux=PASS     flags=NO_UPG

Available services : prometheus-exporter
Available filters :
         [SPOE] spoe
         [CACHE] cache
         [FCGI] fcgi-app
         [COMP] compression
         [TRACE] trace


Hope that helps

Regards
Alex

On Thu, May

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

2023-05-11 Thread Nathan Rixham

NP, let's stick to a generic example then, redacted down to the bare minimum

backend st-min
# log request rate over 1 minute
stick-table type ipv6 size 1g expire 2m store http_req_rate(1m)

backend st-min-url
# log request rate per distinct url+ip(v4/6)
stick-table type binary len 8 size 1g expire 2m store http_req_rate(1m)

backend dc
# works perfectly as expected
http-request track-sc0 hdr_ip(x-forwarded-for) table st-min
# need url32+hdr_ip(x-forwarded-for) here, as src is another haproxy
http-request track-sc1 url32+src table st-min-url

# augment on to request headers
http-request set-header X-HA-Min-Rate %[sc_http_req_rate(0)]
# send tracked sc-hour variables to core
http-request set-header X-HA-Min-Rate-URL %[sc_http_req_rate(1)]
# whatever backend
server localhost localhost:81 check

Hope this clarifies, haproxy -vv output follows, however any version will do

haproxy -vv

HAProxy version 2.4.22-1ppa1~focal 2023/02/16 - https://haproxy.org/
Status: long-term supported branch - will stop receiving fixes around Q2
2026.
Known bugs: http://www.haproxy.org/bugs/bugs-2.4.22.html
Running on: Linux 5.15.0-60-generic #66~20.04.1-Ubuntu SMP Wed Jan 25
09:41:30 UTC 2023 x86_64
Build options :
  TARGET  = linux-glibc
  CPU = generic
  CC  = cc
  CFLAGS  = -O2 -g -O2
-fdebug-prefix-map=/build/haproxy-ENmdsi/haproxy-2.4.22=.
-fstack-protector-strong -Wformat -Werror=format-security -Wdate-time
-D_FORTIFY_SOURCE=2 -Wall -Wextra -Wdeclaration-after-statement -fwrapv
-Wno-address-of-packed-member -Wno-unused-label -Wno-sign-compare
-Wno-unused-parameter -Wno-clobbered -Wno-missing-field-initializers
-Wno-cast-function-type -Wtype-limits -Wshift-negative-value
-Wshift-overflow=2 -Wduplicated-cond -Wnull-dereference
  OPTIONS = USE_PCRE2=1 USE_PCRE2_JIT=1 USE_OPENSSL=1 USE_LUA=1 USE_SLZ=1
USE_SYSTEMD=1 USE_PROMEX=1
  DEBUG   =

Feature list : -51DEGREES +ACCEPT4 +BACKTRACE -CLOSEFROM +CPU_AFFINITY
+CRYPT_H -DEVICEATLAS +DL +EPOLL -EVPORTS +FUTEX +GETADDRINFO -KQUEUE
+LIBCRYPT +LINUX_SPLICE +LINUX_TPROXY +LUA -MEMORY_PROFILING +NETFILTER +NS
-OBSOLETE_LINKER +OPENSSL -OT -PCRE +PCRE2 +PCRE2_JIT -PCRE_JIT +POLL
+PRCTL -PRIVATE_CACHE -PROCCTL +PROMEX -PTHREAD_PSHARED -QUIC +RT +SLZ
-STATIC_PCRE -STATIC_PCRE2 +SYSTEMD +TFO +THREAD +THREAD_DUMP +TPROXY
-WURFL -ZLIB

Default settings :
  bufsize = 16384, maxrewrite = 1024, maxpollevents = 200

Built with multi-threading support (MAX_THREADS=64, default=12).
Built with OpenSSL version : OpenSSL 1.1.1f  31 Mar 2020
Running on OpenSSL version : OpenSSL 1.1.1f  31 Mar 2020
OpenSSL library supports TLS extensions : yes
OpenSSL library supports SNI : yes
OpenSSL library supports : TLSv1.0 TLSv1.1 TLSv1.2 TLSv1.3
Built with Lua version : Lua 5.3.3
Built with the Prometheus exporter as a service
Built with network namespace support.
Built with libslz for stateless compression.
Compression algorithms supported : identity("identity"),
deflate("deflate"), raw-deflate("deflate"), gzip("gzip")
Built with transparent proxy support using: IP_TRANSPARENT IPV6_TRANSPARENT
IP_FREEBIND
Built with PCRE2 version : 10.34 2019-11-21
PCRE2 library supports JIT : yes
Encrypted password support via crypt(3): yes
Built with gcc compiler version 9.4.0

Available polling systems :
  epoll : pref=300,  test result OK
   poll : pref=200,  test result OK
 select : pref=150,  test result OK
Total: 3 (3 usable), will use epoll.

Available multiplexer protocols :
(protocols marked as  cannot be specified using 'proto' keyword)
  h2 : mode=HTTP   side=FE|BE mux=H2
flags=HTX|CLEAN_ABRT|HOL_RISK|NO_UPG
fcgi : mode=HTTP   side=BEmux=FCGI
flags=HTX|HOL_RISK|NO_UPG
: mode=HTTP   side=FE|BE mux=H1   flags=HTX
  h1 : mode=HTTP   side=FE|BE mux=H1
flags=HTX|NO_UPG
: mode=TCPside=FE|BE mux=PASS flags=
none : mode=TCPside=FE|BE mux=PASS flags=NO_UPG

Available services : prometheus-exporter
Available filters :
[SPOE] spoe
[CACHE] cache
[FCGI] fcgi-app
[COMP] compression
[TRACE] trace



On Thu, May 11, 2023 at 11:21 PM Aleksandar Lazic 
wrote:

> Dear Nathan.
>
> On 11.05.23 23:59, Nathan Rixham wrote:
> > Hi All,
> >
> > I've run into an issue I can't figure out, essentially need to use
> > url32+src in stick tables, but where src is the x-forwarded-for address
> > rather than the connecting source - any advice would be appreciated.
>
> As this is a quite generic question please send us the following info's.
>
> * haproxy -vv
> * your config, reduced and without any sensible data
> * A more detail explanation what exactly you want to do and what does
> not work.
>
> > Cheers,
> >
> > Nathan
>
> Regards
> Alex
>

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

2023-05-11 Thread Aleksandar Lazic


Dear Nathan.

On 11.05.23 23:59, Nathan Rixham wrote:

Hi All,

I've run into an issue I can't figure out, essentially need to use 
url32+src in stick tables, but where src is the x-forwarded-for address 
rather than the connecting source - any advice would be appreciated.


As this is a quite generic question please send us the following info's.

* haproxy -vv
* your config, reduced and without any sensible data
* A more detail explanation what exactly you want to do and what does 
not work.



Cheers,

Nathan


Regards
Alex

equivalent of url32+src for hdr_ip(x-forwarded-for)?

2023-05-11 Thread Nathan Rixham

Hi All,

I've run into an issue I can't figure out, essentially need to use
url32+src in stick tables, but where src is the x-forwarded-for address
rather than the connecting source - any advice would be appreciated.

Cheers,

Nathan

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

Re: equivalent of url32+src for hdr_ip(x-forwarded-for)?

equivalent of url32+src for hdr_ip(x-forwarded-for)?

5 matches

Site Navigation

Mail list logo

Footer information