Is it possible to compare two variables in an HAProxy ACL statement? - haproxy

Question

Is it possible to compare compare two variables in an HAProxy ACL statement? For example, assuming that both the host header and X-CORRECT-HOST header are equal to "example.com".
acl correct_host hdr(host) -i example.com # THIS RETURNS TRUE
acl correct_host hdr(X-CORRECT-HOST) -i example.com # THIS RETURNS TRUE
I've tried a few things and read through the documentation, but can't seem to get anything to work. Here's a couple examples I tried that all return false:
acl correct_host hdr(host) -i hdr(X-CORRECT-HOST)
acl correct_host hdr(host) -m str hdr(X-CORRECT-HOST)
acl correct_host hdr(host) -i %[hdr(X-CORRECT-HOST)]
acl correct_host hdr(host) -m str %[hdr(X-CORRECT-HOST)]

Answer 1

You can use lua(need to build haproxy with lua support)
you can check with:
haproxy -vv|grep -i lua
somethig like this:
OPTIONS = USE_ZLIB=1 USE_OPENSSL=1 USE_LUA=1
Built with Lua version : Lua 5.3.1
or build with lua, something like:
make TARGET=linux2628 USE_LUA=1 LUA_LIB=/opt/lua-5.3.1/lib LUA_INC=/opt/lua-5.3.1/include
then
$ ./haproxy -v
Nuster version 2.0.0.18
Copyright (C) 2017-2018, Jiang Wenyuan, <koubunen AT gmail DOT com >
HA-Proxy version 1.8.12 2018/06/27
Copyright 2000-2018 Willy Tarreau <willy#haproxy.org>
conf:
global
debug
lua-load compare_header_value.lua
frontend web1
bind *:8080
mode http
default_backend app1
backend app1
mode http
http-request set-var(req.two_header_value_equal) lua.compare_header_value(hdr1,hdr2)
http-request deny unless { var(req.two_header_value_equal) -m bool }
server s1 127.0.0.1:8000
compare_header_value.lua
function compare_header_value(txn, h1, h2)
local hdr = txn.http:req_get_headers()
if hdr[h1] == nil or hdr[h2] == nil then
return false
end
if hdr[h1][0] == hdr[h2][0] then
return true
end
return false
end
core.register_fetches("compare_header_value", compare_header_value)
then you can use ACL like this:
http-request deny unless { var(req.two_header_value_equal) -m bool }
Test:
1 same header
curl -v http://127.0.0.1:8080/ -H "hdr1: 1" -H "hdr2: 1"
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.60.0
> Accept: */*
> hdr1: 1
> hdr2: 1
>
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
2 different header
curl -v http://127.0.0.1:8080/ -H "hdr1: 1" -H "hdr2: 2"
* Trying 127.0.0.1...
* TCP_NODELAY set
* Connected to 127.0.0.1 (127.0.0.1) port 8080 (#0)
> GET / HTTP/1.1
> Host: 127.0.0.1:8080
> User-Agent: curl/7.60.0
> Accept: */*
> hdr1: 1
> hdr2: 2
>
* HTTP 1.0, assume close after body
< HTTP/1.0 403 Forbidden

Answer 2

It can be done with strcmp
https://cbonte.github.io/haproxy-dconv/2.6/configuration.html#7.3.1-strcmp
e.g.
http-request set-var(txn.host) hdr(host)
# Check whether the client is attempting domain fronting.
acl ssl_sni_http_host_match ssl_fc_sni,strcmp(txn.host) eq 0