You can enable App and API Protection for your HAProxy instances. The Datadog HAProxy integration leverages HAProxy’s Stream Processing Offload Engine (SPOE) to inspect and protect traffic for threat detection at the edge of your infrastructure.

Prerequisites

• The Datadog Agent is installed and configured for your environment (host, container, or orchestrator).
• Configure the Agent with Remote Configuration in the Datadog UI to block attackers.

Enabling threat detection

Get started

The App and API Protection HAProxy integration uses HAProxy’s Stream Processing Offload Engine (SPOE) to call a Datadog Stream Processing Offload Agent (SPOA). The SPOA analyzes requests and responses.

To enable App and API Protection for HAProxy, do the following:

1. Deploy the Datadog HAProxy SPOA container.
2. Update your HAProxy configuration files to integrate with the SPOA

SPOA container

Deploy the Datadog HAProxy SPOA image available in the Datadog GitHub Container Registry. The SPOA listens for SPOE connections from HAProxy and sends security events to your Datadog Agent.

See Configuration for available configuration options about the SPOA container.

HAProxy configuration files

All required HAProxy configuration files are available in the repository folder. For information about updates and changes about the configuration, refer to the configuration changelog.

The following files are needed for your setup:

• spoe.cfg: Core SPOE engine configuration file.
• global-config.cfg: Configuration lines to include in your global section.
• frontend-config.cfg: Configuration lines to add at the top of each frontend you want to protect.
• backend.cfg: Defines the SPOA backend used by the SPOE engine.
• datadog_aap_blocking_response.lua: Lua script for blocking responses.

Guidance for setting up each file is provided below.

spoe.cfg

The spoe.cfg file is responsible for declaring the SPOE agent and its configuration. This file should be saved to disk, for example at /usr/local/etc/haproxy/spoe.cfg. The location of this file is referenced via the DD_SPOA_SPOA_CONF_FILE environment variable, which is configured within the global section.

It is important that no custom modifications are made to this file.

global-config.cfg

The global-config.cfg file loads the required Lua script and configures the necessary variables for the integration. Its contents should be incorporated into the global section of your haproxy.cfg configuration file.

You can adjust the values as needed for your environment. Review the comments within the file for further guidance on each setting.

frontend-config.cfg

The frontend-config.cfg file attaches the SPOE filter to your frontend. This section should be placed at the very top of each frontend section you want to protect, before other filters and the router.

This section ensures that:

• Request and response events are sent to the SPOA
• Datadog tracing headers are injected when applicable
• The Lua helper is conditionally invoked for blocking

It is important that no custom modifications are made to this part of the configuration.

backend.cfg

The backend.cfg file defines the spoa-backend used by the SPOE engine and for health checks. This configuration should be appended near the end of your haproxy.cfg file.

Be sure to modify the server spoa1 <host>:<port> line so that it references your deployed SPOA container instance.

datadog_aap_blocking_response.lua

The datadog_aap_blocking_response.lua script is responsible for sending a custom blocking response when the SPOA instructs HAProxy to block a request. This script could be stored in a location such as /etc/haproxy/lua/datadog_aap_blocking_response.lua, and the lua-load directive in the global section should reference this path.

It is important that no custom modifications are made to this file.

Validation

After this configuration is complete, the library collects security data from your application and sends it to the Agent. The Agent sends the data to Datadog, where out-of-the-box detection rules flag attacker techniques and potential misconfigurations so you can take steps to remediate.

1. To see App and API Protection threat detection in action, send known attack patterns to your application. For example, trigger the Security Scanner Detected rule by running a file that contains the following curl script:

   for ((i=1;i<=250;i++)); 
   do
   # Target existing service's routes
   curl https://your-application-url/existing-route -A dd-test-scanner-log;
   # Target non existing service's routes
   curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
   done

   Note: The dd-test-scanner-log value is supported in the most recent releases.

   A few minutes after you enable your application and send known attack patterns to it, threat information appears in the Application Signals Explorer and vulnerability information appears in the Vulnerabilities explorer.

Configuration

The Datadog HAProxy SPOA container supports the following configuration settings:

Configure the SPOA to send traces to your Datadog Agent using the following environment variables:

Datadog Go Tracer and HAProxy integration

The HAProxy integration is built on top of the Datadog Go Tracer and inherits all of its environment variables. See Configuring the Go Tracing Library and App and API Protection Library Configuration.

Keeping your configuration up to date

Because HAProxy’s SPOE integration involves both a runtime component (the SPOA container image) and HAProxy configuration, upgrades can require changes in both places.

The reference HAProxy configuration and an associated changelog are available to help you monitor and track updates:

• Reference HAProxy configuration directory (SPOE engine, global, frontend/backend snippets, Lua)
• Configuration changelog

Recommended upgrade practices

• Pin your SPOA image to a specific version and upgrade intentionally after reviewing the configuration changelog.
• Centralize the Datadog configuration so it is easily updatable.
• Track the reference configuration and changelog and compare your configuration to it when upgrading.

Limitations

The HAProxy integration has the following limitations:

• Asynchronous (observability) mode is not currently supported.

For additional details on the HAProxy integration compatibilities, refer to the HAProxy integration compatibility page.

Further Reading

Más enlaces, artículos y documentación útiles:

HAProxy integration's source codeSOURCE CODE HAProxy SPOA Docker imageCONTAINER IMAGE OOTB App and API Protection RulesDOCUMENTATION Troubleshooting App and API ProtectionDOCUMENTATION