>From 286c8d1942a04d378fb5e185f5d6ba058c4f8afc Mon Sep 17 00:00:00 2001 From: David Fifield Date: Sat, 17 Sep 2016 14:09:06 -0700 Subject: [PATCH] Expand HAProxy service match lines. These are not observed in the wild, but derived from source code, namely http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/proto_http.c;h=50e3d486ee4798ae8d329b7a78a23b8ba82cff68 There were already matches for status codes 403 and 503 (not counting the 200 for the statistics page); this change adds codes 400, 401, 403, 405, 407, 408, 429, 500, 502, 503, and 504. Additionally, I dug through the history back to about 2006 and found a few places where the responses changed. The new possible version ranges are (available ranges depend on the status code): < 1.3.1 >= 1.3.1 1.4.0 - 1.5.10 < 1.5.0 >= 1.5.0 >= 1.5.10 >= 1.6.0 --- nmap-service-probes | 40 ++++++++++++++++++++++++++++++++++++++-- 1 file changed, 38 insertions(+), 2 deletions(-) diff --git a/nmap-service-probes b/nmap-service-probes index ebb34df..585eadf 100644 --- a/nmap-service-probes +++ b/nmap-service-probes @@ -10054,9 +10054,45 @@ match http-proxy m|^HTTP/1\.0 400 Bad Request\r\nConnection: Close\r\n\r\n match http-proxy m|^HTTP/1\.0 \d\d\d .*\r\n.*Via: HTTP/1\.1 ([\w._-]+) $Websense_Content_Gateway/([\w._-]+) \[c s f \]$\r\n|s p/Websense Content Gateway http proxy/ v/$2/ h/$1/ cpe:/a:websense:websense_content_content_gateway:$2/ match http-proxy m|^HTTP/1\.0 504 Gateway Timeout\r\nContent-Length: 237\r\n.*

The proxy server did not receive a timely response\nfrom the upstream server\.

|s p/Fortinet FortiGate-110c http proxy/ d/firewall/ match http-proxy m|^HTTP/1\.0 302 Moved Temporarily\r\nContent-length: 22\r\nConnection: close\r\nSet-Cookie: sslvpn-authck-orig-url=/; path=/\r\nSet-Cookie: sslvpn-authck-realm-name=Our Users; path=/\r\nLocation: /_formauth/login\.html\r\nContent-Type: text/plain\r\n\r\n302 Moved Temporarily\n$| p/Phion HTTPS VPN gateway/ d/proxy server/ + match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\nStatistics Report for HAProxy| p/HAProxy http proxy/ d/load balancer/ cpe:/a:haproxy:haproxy/ -match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

403 Forbidden

\nRequest forbidden by administrative rules\.\n\n$| p/HAProxy http proxy/ d/load balancer/ cpe:/a:haproxy:haproxy/ -match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

503 Service Unavailable

\nNo server is available to handle this request\.\n\n$| p/HAProxy http proxy/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# HAProxy responses are mostly from http_err_msgs, HTTP_401_fmt, and HTTP_407_fmt in +# http://git.haproxy.org/?p=haproxy.git;a=blob;f=src/proto_http.c +# Only statuses 200, 403, and 503 are likely to result from from GetRequest; +# other probes can match via fallbacks. +match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

200 OK

\nHAProxy: service ready\.\n\n$| p/HAProxy http proxy/ v/before 1.5.0/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 400 Bad request\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

400 Bad request

\nYour browser sent an invalid request\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

403 Forbidden

\nRequest forbidden by administrative rules\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

408 Request Time-out

\nYour browser didn't send a complete request in time\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 500 Server Error\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

500 Server Error

\nAn internal server error occured\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

502 Bad Gateway

\nThe server returned an invalid or incomplete response\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

503 Service Unavailable

\nNo server is available to handle this request\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\n\r\n

504 Gateway Time-out

\nThe server didn't respond in time\.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1.0 401 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n

401 Unauthorized

\nYou need a valid user and password to access this content.\n\n$| p/HAProxy http proxy/ v/before 1.3.1/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# Statuses 400, 401, 403, 408, 500, 502, 503, and 504 gained "Content-Type: text/html" in v1.3.1. +# http://git.haproxy.org/?p=haproxy.git;a=commitdiff;h=791d66d3634dde12339d4294aff55a1aed7518e3;hp=b9e98b683612b29ef939c10d3d00be27de26534a +match http-proxy m|^HTTP/1\.0 400 Bad request\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

400 Bad request

\nYour browser sent an invalid request\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 403 Forbidden\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

403 Forbidden

\nRequest forbidden by administrative rules\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 408 Request Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

408 Request Time-out

\nYour browser didn't send a complete request in time\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 500 Server Error\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

500 Server Error

\nAn internal server error occured\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 502 Bad Gateway\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

502 Bad Gateway

\nThe server returned an invalid or incomplete response\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 503 Service Unavailable\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

503 Service Unavailable

\nNo server is available to handle this request\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 504 Gateway Time-out\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

504 Gateway Time-out

\nThe server didn't respond in time\.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1.0 401 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nWWW-Authenticate: Basic realm=".*"\r\n\r\n

401 Unauthorized

\nYou need a valid user and password to access this content.\n\n$| p/HAProxy http proxy/ v/1.3.1 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# HTTP_407_fmt was added in v1.4-rc1. +# http://git.haproxy.org/?p=haproxy-1.4.git;a=commitdiff;h=844a7e76d2557364e6d34d00027f2fa514b9d855;hp=8c8bd4593c95f54cbe42bf204b943a159810a74e +match http-proxy m|^HTTP/1.0 407 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n

401 Unauthorized

\nYou need a valid user and password to access this content.\n\n$| p/HAProxy http proxy/ v/1.4.0 - 1.5.10/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# 200 changed in v1.5-dev7. +# http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=027a85bb03c5524e62c50e228412d9be403d7f98;hp=7c51a732f701f7d147e7b79d828f80612a0bfcbc +match http-proxy m|^HTTP/1\.0 200 OK\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

200 OK

\nService ready\.\n\n$| p/HAProxy http proxy/ v/1.5.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# 405 and 429 were added in v1.6-dev2. +# http://git.haproxy.org/?p=haproxy-1.6.git;a=commitdiff;h=108b1dd69d4e26312af465237487bdb855b0de60 +match http-proxy m|^HTTP/1\.0 405 Method Not Allowed\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

405 Method Not Allowed

\nA request was made of a resource using a request method not supported by that resource\n\n$| p/HAProxy http proxy/ v/1.6.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +match http-proxy m|^HTTP/1\.0 429 Too Many Requests\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\n\r\n

429 Too Many Requests

\nYou have sent too many requests in a given amount of time\.\n\n$| p/HAProxy http proxy/ v/1.6.0 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ +# HTTP_407_fmt changed in v1.5.10. +# http://git.haproxy.org/?p=haproxy-1.5.git;a=commitdiff;h=b301654e237c358e892db32c4ac449b42550d79b;hp=211c2e901d0b83b6792d5ebdf207f8e70a299361 +match http-proxy m|^HTTP/1\.0 407 Unauthorized\r\nCache-Control: no-cache\r\nConnection: close\r\nContent-Type: text/html\r\nProxy-Authenticate: Basic realm=".*"\r\n\r\n

407 Unauthorized

\nYou need a valid user and password to access this content\.\n\n$| p/HAProxy http proxy/ v/1.5.10 or later/ d/load balancer/ cpe:/a:haproxy:haproxy/ + match http-proxy m|^HTTP/1\.0 400\r\nContent-Type: text/html\r\n\r\nError\r\n

ERROR: 400

\r\n
\r\n\r\n$| p/Citrix Application Firewall/ d/firewall/ match http-proxy m|^HTTP/1\.0 200 OK\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 3366\r\nPragma: no-cache\r\n\r\n.*