HAproxy ACL dynamically match part of path to a header - haproxy

Question

Using HAproxy 1.8 I am trying to create an ACL which should dynamically match a given part of the url/path to a given header.
The portal in front of the HAproxy adds header for auth users:
X-roles MQ-QUEUE(QUEUE=test.queue,QUEUE=foobar.queue)
The accessed URL looks like:
https://portal/mqsrv/some/custom/path/with/queue/test.queue/in/path
my configuration so far:
frontend main
...
acl src_portal src 192.168.5.0/24
acl url_mqsrv path_beg -i /mqsrv
# working static approach
acl perm_mq req.fhdr(X-roles) -m str MQ-QUEUE(QUEUE=test.queue) if { path -m /test.queue/ }
# how to achieve this dynamically?
#
...
use_backend backend_mqsrv if src_portal url_mqsrv perm_mq
I tried to get the part of the path via regex into a variable like:
http-request set-var(txn.requested_queue) path,reg(queue\/(\K.*)\/ \1)
That does not work, because 'reg' is an unknown converter. Other attempts were using the regex to get the queue from the path for a match against the role header but I can not find a working way how to extract the queue part from a request path to use it for the role-header match. Another idea would be to use a lua script but that would not be as performant as an acl-match I guess.

Answer 1

I could not find a way to do that without using a lua script, so I solved it this way:
/etc/haproxy/haproxy.cfg:
global
...
# load loa script to check MQ-QUEUE() role
lua-load /etc/haproxy/check-roles.lua
frontend main
bind hap-rip:80
capture request header X-roles len 50
http-request set-var(txn.roles) req.fhdr(X-roles)
http-request set-var(txn.request_urlpath) path
acl src_portal src 192.168.5.0/24
acl url_mqsrv path_beg -i /mqsrv
# if acl matches, use backend_mqsrv
use_backend backend_mqsrv if src_portal url_mqsrv { lua.queue_allowed(txn.roles,txn.request_urlpath) -m bool true }
# if no acl matches the request, use default backend which serves a 403 forbidden response
default_backend backend_no-match
backend backend_mqsrv
log 127.0.0.1 local2
balance leastconn
acl src_portal src 192.168.5.0/24
http-request deny unless src_portal
# remove /mqsrv/ from request url
reqrep ^([^\ :]*)\ /mqsrv/(.*) \1\ /\2
# echo -n "username:password" | base64
reqadd Authorization:\ Basic\ *********************=
server mqsrv mqsrv.domain.local:443 ssl check-ssl check verify none
backend backend_no-match
# tcp-request content reject
mode http
http-request deny deny_status 403
/etc/haproxy/check-roles.lua:
-- example url https://portal/mqsrv/some/custom/path/with/queue/test.queue/in/path
-- example role header from portal: X-roles: MQ-QUEUE(QUEUE=ABC,QUEUE=test.queue,QUEUE=XYZ)
-- notes on haproxy lua logging: https://stackoverflow.com/questions/65879666/haproxy-lua-logging
-- https://www.codegrepper.com/code-examples/lua/lua+split+string+by+delimiter
function Split(s, delimiter)
result = {};
for match in (s..delimiter):gmatch("(.-)"..delimiter) do
table.insert(result, match);
end
return result;
end
-- function to check if requested queue (from url path) is contained in roles-header (injected from portal)
-- https://www.haproxy.com/blog/5-ways-to-extend-haproxy-with-lua/
core.register_fetches("queue_allowed", function(txn, var1, var2)
-- get role and path values from request
local roles_authorized = txn:get_var(var1)
core.log(core.info, "roles header: " .. roles_authorized)
-- extract requested queue from url/path
local request_urlpath = txn:get_var(var2)
-- local requested_queue = Split(request_urlpath,"/")[10] -- get requested queue by position
local requested_queue = request_urlpath:match("queue%/(.*)%/") -- get requested queue by matching string after 'queue/'
core.log(core.info, "requested_queue: " .. requested_queue)
-- extract QUEUES from MQ-QUEUE() header
queues = Split(Split(roles_authorized,'%(')[2],'%)')[1]
core.log(core.info, "queues: " .. queues)
-- loop through comma seperated queues to check if requested queue is found
for _,item in pairs(Split(queues,',')) do
queue = Split(item,'=')[2]
core.log(core.info, "authorized queue: " .. queue)
if queue == requested_queue then
core.log(core.info, "requested queue " .. requested_queue .. " matched with authorized queue " .. queue .. " - allowing request!")
return true
end
end
end)