haproxy/reg-tests
Christopher Faulet 18c13d3bd8 MEDIUM: http-ana: Add a proxy option to restrict chars in request header names
The "http-restrict-req-hdr-names" option can now be set to restrict allowed
characters in the request header names to the "[a-zA-Z0-9-]" charset.

Idea of this option is to not send header names with non-alphanumeric or
hyphen character. It is especially important for FastCGI application because
all those characters are converted to underscore. For instance,
"X-Forwarded-For" and "X_Forwarded_For" are both converted to
"HTTP_X_FORWARDED_FOR". So, header names can be mixed up by FastCGI
applications. And some HAProxy rules may be bypassed by mangling header
names. In addition, some non-HTTP compliant servers may incorrectly handle
requests when header names contain characters ouside the "[a-zA-Z0-9-]"
charset.

When this option is set, the policy must be specify:

  * preserve: It disables the filtering. It is the default mode for HTTP
              proxies with no FastCGI application configured.

  * delete: It removes request headers with a name containing a character
            outside the "[a-zA-Z0-9-]" charset. It is the default mode for
            HTTP backends with a configured FastCGI application.

  * reject: It rejects the request with a 403-Forbidden response if it
            contains a header name with a character outside the
            "[a-zA-Z0-9-]" charset.

The option is evaluated per-proxy and after http-request rules evaluation.

This patch may be backported to avoid any secuirty issue with FastCGI
application (so as far as 2.2).
2022-05-16 16:00:26 +02:00
..
balance REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
cache REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
checks REGTESTS: fix the race conditions in 40be_2srv_odd_health_checks 2022-02-21 20:44:26 +01:00
compression REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
connection REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
contrib REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
converter REGTESTS: fix the race conditions in be2dec.vtc ad field.vtc 2022-04-26 11:21:35 +02:00
filters REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
http-capture REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
http-cookies REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
http-errorfiles REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
http-messaging REGTESTS: h1: Add a script to validate H1 splicing support 2021-12-01 11:47:08 +01:00
http-rules MEDIUM: http-ana: Add a proxy option to restrict chars in request header names 2022-05-16 16:00:26 +02:00
http-set-timeout REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
jwt REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
log REGTESTS: Do not use REQUIRE_VERSION for HAProxy 2.5+ 2022-03-21 09:47:47 +01:00
lua MINOR: httpclient/lua: add 'dst' optionnal field 2022-02-17 20:07:00 +01:00
mailers REGTESTS: Remove REQUIRE_VERSION=1.6 from all tests 2021-06-11 19:21:28 +02:00
mcli REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
peers REGTESTS: peers: leave a bit more time to peers to synchronize 2022-02-16 14:42:13 +01:00
sample_fetches REGTESTS: vars: Remove useless ssl tunes from conditional set-var test 2021-12-20 11:41:13 +01:00
seamless-reload REGTESTS: Remove REQUIRE_VERSION=1.8 from all tests 2022-01-29 15:24:45 +01:00
server MEDIUM: server: remove experimental-mode for dynamic servers 2022-03-11 14:28:28 +01:00
spoe REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
ssl REGTESTS: ssl: Update error messages that changed with OpenSSLv3.1.0-dev 2022-04-21 14:54:47 +02:00
startup REGTESTS: Use feature cmd for 2.5+ tests (2) 2021-11-05 08:27:32 +01:00
stick-table REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
stickiness REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
stream REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
tcp-rules REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00
webstats REGTESTS: webstats: remove unused stats socket in /tmp 2022-04-26 16:15:23 +02:00
README REGTESTS: extend the default I/O timeouts and make them overridable 2021-11-18 17:57:11 +01:00

                 * Regression testing for HAProxy with VTest *


This little README file is about how to compile and run vtest test case files (VTC files)
to test HAProxy for any regression.

To do so, you will have to compile vtest program sources which depends on
Varnish cache application sources. vtest, formerly varnishtest, is a very useful
program which has been developed to test Varnish cache application. vtest has been
modified in collaboration with Varnish cache conceptor Poul-Henning Kamp to support
HAProxy in addition to Varnish cache.

See also: doc/regression-testing.txt

* vtest compilation *

    $ git clone https://github.com/vtest/VTest

    $ cd VTest

    $ make vtest

  Then vtest program may be found at the root directory of vtest sources directory.
  The Varnish cache manuals are located in 'man' directory of Varnish cache sources
  directory. You will have to have a look at varnishtest(7) and vtc(7) manuals to
  use vtest.

  Some information may also be found in doc/regression-testing.txt in HAProxy
  sources.

  Note that VTC files for Varnish cache may be found in bin/varnishtest/tests directory
  of Varnish cache sources directory which may be found here:
  https://github.com/varnishcache/varnish-cache


* vtest execution *

  You must set HAPROXY_PROGRAM environment variable to give the location
  of the HAProxy program to test to vtest:

    $ HAPROXY_PROGRAM=<my haproxy program> vtest ...

  The HAProxy VTC files found in HAProxy sources may be run with the reg-tests
  Makefile target. You must set the VTEST_PROGRAM environment variable to
  give the location of the vtest program which has been previously compiled.

    $ VTEST_PROGRAM=<my vtest program> make reg-tests

  "reg-tests" Makefile target run scripts/run-regtest.sh script.
  To get more information about this script run it with --help option.

  Note that vtest is run with -t10 and -l option. -l option is to keep
  keep vtest temporary directory in case of failed test cases. core files
  may be found in this directory (if enabled by ulimit).


* vtest patches for HAProxy VTC files *

  When producing a patch to add a VTC regression testing file to reg-tests directory,
  please follow these simple rules:

    - If your VTC file needs others files, if possible, use the same basename as that
      of the VTC file,
    - Put these files in a directory with the same name as the code area concerned
      by the bug ('peers', 'lua', 'acl' etc).

Please note that most tests use a common set of timeouts defined by the
environment variable HAPROXY_TEST_TIMEOUT. As much as possible, for regular I/O
(i.e. not errors), please try to reuse that setting so that the value may
easily be adjusted when running in some particularly slow environments, or be
shortened to fail faster on developers' machines.