mirrors/haproxy
1
0
Fork 0
mirror of https://git.haproxy.org/git/haproxy.git/ synced 2025-08-05 22:56:57 +02:00
Code Issues Projects Releases Wiki Activity

MAJOR: config: prevent QUIC with clients privileged port by default

Browse Source 
Previous commit introduce new protection mechanism to forbid
communications with clients which use a privileged source port. By
default, this mechanism is disabled for every protocols.

This patch changes the default value and activate the protection
mechanism for QUIC protocol. This is justified as it is a probable sign
of DNS/NTP amplification attack.

This is labelled as major as it can be a breaking change with some
network environments.
This commit is contained in:
Amaury Denoyelle 2024-05-23 16:07:16 +02:00
parent 45f40bac4c
commit f55748a422
2 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
doc/configuration.txt
View File

@ -1950,7 +1950,9 @@ harden.reject-privileged-ports.tcp { on | off }
harden.reject-privileged-ports.quic { on | off } harden.reject-privileged-ports.quic { on | off }
Toggle per protocol protection which forbid communication with clients which Toggle per protocol protection which forbid communication with clients which
use privileged ports as their source port. This range of ports is defined use privileged ports as their source port. This range of ports is defined
according to RFC 6335. Protection is inactive by default on both protocols. according to RFC 6335. By default, protection is active for QUIC protocol as
this behavior is suspicious and may be used as a spoofing or DNS/NTP
amplification attack.
http-err-codes [+-]<range>[,...] [...] http-err-codes [+-]<range>[,...] [...]
Replace, reduce or extend the list of status codes that define an error as Replace, reduce or extend the list of status codes that define an error as

4
src/haproxy.c
View File

@ -210,8 +210,8 @@ struct global global = {
.maxsslconn = DEFAULT_MAXSSLCONN, .maxsslconn = DEFAULT_MAXSSLCONN,
#endif #endif
#endif #endif
/* by default do not protect against clients using privileged port */ /* by default allow clients which use a privileged port for TCP only */
.clt_privileged_ports = HA_PROTO_ANY, .clt_privileged_ports = HA_PROTO_TCP,
/* others NULL OK */ /* others NULL OK */
}; };