Le 16/10/2026 à 9:50 PM, Aleksandar Lazic a écrit :
Hi.
I'm planning a new filter to bring HAProxy's own DNA to "cloud" or HTTP(S)
object storages, such as Azure Blob Storage, Google Cloud Storage and S3
compatible storages. The problem is that most of these storages require
authentication and/or a request signature before they deliver the data.
The filter API already covers this to a certain degree. What was missing is
a callback called once the server is known, just before the request is sent
to it. A signature depends on the target server, and the server may change
on a redispatch or a L7 retry, so the request must be finalized at that
point. This patch series adds such an "http_pre_send" callback, along with
a first shot of the cloudauth filter.
The cloudauth filter is opt-in at build time (USE_CLOUDAUTH) and marked as
experimental. For now it only stamps the request with its target server, to
show that the callback follows redispatches and L7 retries. The request
signers will be plugged in at the same place.
While working on this, I also noticed that http_reset is documented as being
called on L7 retries, but it never is. The first patch fixes the
documentation.
Of course I used AI (Claude) to help with the patches, which is noted with
a Co-Authored-By trailer in each commit.
Hi Aleks,
I quickly reviewed your patches.
First of all, about the http_reset(), I guess we can extend it to the L7
retries, especially because it was documented and never implemented... But we
must decide when exactly it should be called. Before or after the stconn reset ?
Before or after the L7 buffer swapping ?
About your http_pre_send_callback, I'm not a big fan of adding such code in
stconn.c, on the sending path. If the purpose is to be notified of the selected
server, I guess it could be better to add a "stream_set_target" callback
function, usable for servers and applets. It could be placed in the
stream_set_target() function, with the same behavior than "stream_set_backend"
callback function: a negative value to report an error, otherwise it is a
success. The callback would take a obj_type. Maybe the function should be moved
from the header file and placed in stream.c.
Do you think this would fit your requirement ?
About the filter itself, it must be at least moved in the addons folder. But
depending on the implementation and the dependencies (technical or functional),
it could be moved into a dedicated repository, as for the opentelemetry filter
(https://github.com/haproxytech/haproxy-opentelemetry).
Regards,
--
Christopher Faulet
