From 2272dc14bb9e1486b5ee01f8556814c5293c17de Mon Sep 17 00:00:00 2001 From: Willy Tarreau Date: Sun, 3 Sep 2006 10:19:38 +0200 Subject: [PATCH] [DOC] add docs and examples of tarpit configuration --- doc/haproxy-en.txt | 30 +++++++++++++++---- doc/haproxy-fr.txt | 30 +++++++++++++++---- examples/tarpit.cfg | 72 +++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 120 insertions(+), 12 deletions(-) create mode 100644 examples/tarpit.cfg diff --git a/doc/haproxy-en.txt b/doc/haproxy-en.txt index c3e288f59..2f69473e7 100644 --- a/doc/haproxy-en.txt +++ b/doc/haproxy-en.txt @@ -2,9 +2,9 @@ HAProxy Reference Manual ------------------- - version 1.3.1 + version 1.3.2 willy tarreau - 2006/07/09 + 2006/09/03 ============ | Abstract | @@ -1741,6 +1741,9 @@ HTTP, each of which has a special meaning : L : the proxy was still transmitting LAST data to the client while the server had already finished. + T : the request was tarpitted. It has been held open on with the client + during the whole contimeout duration. + - : normal session completion after end of data transfer. - the third character tells whether the persistence cookie was provided by @@ -1842,6 +1845,10 @@ The most common termination flags combinations are indicated here. incomplete, dangerous (cache control), or matched a security filter. In any case, an HTTP 502 error is sent to the client. + PT The proxy blocked the client's request and has tarpitted its + connection before returning it a 500 server error. Nothing was sent + to the server. + cD The client did not read any data for as long as the clitimeout delay. This is often caused by network failures on the client side. @@ -2014,6 +2021,8 @@ The syntax is : reqideny same, but ignoring the case reqpass ignore a header matching reqipass same, but ignoring the case + reqtarpit tarpit a request matching + reqitarpit same, but ignoring the case rspadd to add a header to the response rsprep to modify the response @@ -2039,11 +2048,12 @@ Other characters may be prefixed with a backslash to change their meaning : \xXX to write the ASCII hex code XX as in the C language - containst the string to be used to replace the largest portion of text + contains the string to be used to replace the largest portion of text matching the regex. It can make use of the special characters above, and can reference a substring delimited by parenthesis in the regex, by the group -numerical order from 1 to 9. In this case, you would write a backslah ('\') -immediately followed by one digit indicating the group position. +numerical order from 0 to 9 (0 being the entire line). In this case, you would +write a backslash ('\') immediately followed by one digit indicating the group +position. represents the string which will systematically be added after the last header line. It can also use special characters above. @@ -2062,7 +2072,12 @@ Notes : useless headers before adding new ones. - a denied request will generate an "HTTP 403 forbidden" response, while a denied response will generate an "HTTP 502 Bad gateway" response. - + - a tarpitted request will be held open on the client side for a duration + defined in the contimeout parameter. Nothing will be sent to any server. + When the timeout is reached, the proxy will reply with a 500 server error + response so that the attacker does not suspect it has been tarpitted. The + logs will report the 500, but the termination flags will indicate 'PT'. + Examples : ---------- @@ -2092,6 +2107,9 @@ Examples : reqideny ^[^:\ ]*\ .*