Haproxy-devel (0.27): tcp-request rule after reqadd rules

treuss

Hi everyone,

since our last update (to haproxy-devel 0.27), we're getting multiple warnings on applying haproxy-rules.


[WARNING] 216/165751 (67472) : parsing [/var/etc/haproxy/haproxy.cfg:57] : a 'tcp-request' rule placed after a 'reqadd' rule will still be processed before
...
[WARNING] 216/165751 (67472) : parsing [/var/etc/haproxy/haproxy.cfg:144] : a 'tcp-request' rule placed after a 'reqadd' rule will still be processed before.

Here's a snippet of our config:


...

reqadd X-Forwarded-Proto:\ https if https
reqadd X-Forwarded-Proto:\ http if !https

stick-table type ip size 1m expire 30s store gpc0,http_req_rate(10s),conn_cur,conn_rate(3s)

tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }
tcp-request connection accept if { src m.n.o.p }

tcp-request connection track-sc1 src

tcp-request connection reject if { src_get_gpc0(frontend) gt 10 }

tcp-request connection reject if { src_conn_cur gt 40 }

tcp-request connection reject if { src_conn_rate gt 40 }

...

As you can see, these two reqadd X-Forwarded-Proto rules appear before the tcp-request rules and cause the warnings.

My question is now: what settings add these reqadd X-Forwarded-Proto rules?
Is there a way to skip these settings and instead add those rules manually into the Advanced pass thru field?

Best regards
Thomas

PiBa

Its part of the "Use 'forwardfor' option" on the frontend. It creates rules like these:


	option			forwardfor
	acl https ssl_fc
	reqadd X-Forwarded-Proto:\ http if !https
	reqadd X-Forwarded-Proto:\ https if https

Should be possible to add them in the advanced section.

treuss

Thank you PiBa! It works like a charm!