cloud-hosting-platform/haproxy-manager-base
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix HAProxy 3.0 tarpit timeout syntax error
All checks were successful
HAProxy Manager Build and Push / Build-and-Push (push) Successful in 56s
Details

Browse Source 
- Replace inline 'timeout' parameter with 'set-timeout tarpit' directive
- HAProxy 3.0 requires setting timeout before tarpit action
- Maintains same escalation logic: 2-5s → 8-15s → 20-45s → 60s

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
jknapp
2025-08-25 06:17:08 -07:00
parent b88da4c58f
commit 2cd1db7461
1 changed files with 25 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
templates/hap_listener.tpl
View File

@@ -59,29 +59,34 @@ frontend web
http-request deny deny_status 429 if scanner_critical http-request deny deny_status 429 if scanner_critical
# ESCALATING TARPIT RULES - Progressive delays based on offense level # ESCALATING TARPIT RULES - Progressive delays based on offense level
# Level 0 (first offense): Short delays # HAProxy 3.0 requires setting timeout before tarpit action
http-request tarpit deny_status 429 timeout 2s if scanner_low escalation_level_0
http-request tarpit deny_status 429 timeout 3s if scanner_medium escalation_level_0
http-request tarpit deny_status 429 timeout 5s if scanner_high escalation_level_0
http-request tarpit deny_status 429 timeout 5s if burst_scanner escalation_level_0
# Level 1 (second offense): Medium delays # Level 0 (first offense): Short delays (2-5 seconds)
http-request tarpit deny_status 429 timeout 8s if scanner_low escalation_level_1 http-request set-timeout tarpit 2s if scanner_low escalation_level_0
http-request tarpit deny_status 429 timeout 12s if scanner_medium escalation_level_1 http-request set-timeout tarpit 3s if scanner_medium escalation_level_0
http-request tarpit deny_status 429 timeout 15s if scanner_high escalation_level_1 http-request set-timeout tarpit 5s if scanner_high escalation_level_0
http-request tarpit deny_status 429 timeout 10s if burst_scanner escalation_level_1 http-request set-timeout tarpit 5s if burst_scanner escalation_level_0
# Level 2 (third offense): Long delays # Level 1 (second offense): Medium delays (8-15 seconds)
http-request tarpit deny_status 429 timeout 20s if scanner_low escalation_level_2 http-request set-timeout tarpit 8s if scanner_low escalation_level_1
http-request tarpit deny_status 429 timeout 30s if scanner_medium escalation_level_2 http-request set-timeout tarpit 12s if scanner_medium escalation_level_1
http-request tarpit deny_status 429 timeout 45s if scanner_high escalation_level_2 http-request set-timeout tarpit 15s if scanner_high escalation_level_1
http-request tarpit deny_status 429 timeout 25s if burst_scanner escalation_level_2 http-request set-timeout tarpit 10s if burst_scanner escalation_level_1
# Level 3+ (repeat offender): Maximum delays # Level 2 (third offense): Long delays (20-45 seconds)
http-request tarpit deny_status 429 timeout 60s if scanner_low escalation_level_3 http-request set-timeout tarpit 20s if scanner_low escalation_level_2
http-request tarpit deny_status 429 timeout 60s if scanner_medium escalation_level_3 http-request set-timeout tarpit 30s if scanner_medium escalation_level_2
http-request tarpit deny_status 429 timeout 60s if scanner_high escalation_level_3 http-request set-timeout tarpit 45s if scanner_high escalation_level_2
http-request tarpit deny_status 429 timeout 60s if burst_scanner escalation_level_3 http-request set-timeout tarpit 25s if burst_scanner escalation_level_2
# Level 3+ (repeat offender): Maximum delays (60 seconds)
http-request set-timeout tarpit 60s if scanner_low escalation_level_3
http-request set-timeout tarpit 60s if scanner_medium escalation_level_3
http-request set-timeout tarpit 60s if scanner_high escalation_level_3
http-request set-timeout tarpit 60s if burst_scanner escalation_level_3
# Apply the tarpit action after setting the appropriate timeout
http-request tarpit deny_status 429 if scanner_low or scanner_medium or scanner_high or burst_scanner
# Increment escalation level when we apply tarpit # Increment escalation level when we apply tarpit
# This tracks how many times this IP has been tarpitted # This tracks how many times this IP has been tarpitted