Chaining a variable to gt(greater than) and lt(less than)

Help!
1

Hi. Sorry if this all sounds basic but I’m new to haproxy and still going through the documentation while being thrown into the deep end.

Dockerized Haproxy version - haproxytech/haproxy-debian 2.9.5

The stick table.

backend table_track_ip
    stick-table type string len 45 size 100k expire 300s store gpc0_rate(60s),gpc1_rate(10s),gpt(2),http_req_rate(10s),http_req_cnt,bytes_out_rate(1s),bytes_in_rate(1s)

And I have the following ACL

# slow if too many requests receive http 401 response codes in 60s
http-request deny deny_status 429 if { sc0_gpc0_rate gt 10}

And I am trying to convert the numeric 10 to use a variable based on a map file.
Reason being so I can change the value on the fly using the API without restarting the haproxy service and dropping any connections.

One example of what I have tried(and failed) since the I’m unable to get the syntax right.

http-request set-var(req.auth_temp_limit) str(map(/etc/haproxy/config.map, auth_failure_threshold, 10))
http-request set-var(req.limit_num) int(%[var(req.auth_temp_limit)])
http-request deny status 429 if { sc0_gpc0_rate gt var(req.limit_num) }

Is it even possible to chain it this way? I’m aware that these variables are all strings but is there a way to convert them to INT?

The config.map

#Rates and limits config used by haproxy logic
auth_failure_threshold  10

Can someone please point me in the right direction or indicate this is not possible or otehrwise.
p.s I have a whole bunch of other values to using map files and not just for sc0_gpc0_rate.

Thank you.

2

Looking from the last few related topics this doesn’t look achievable but maybe things have changed since 2021.

3

right operands on ACLs cannot be variable (here after gt a numerical value is expected) by design

However you could leverage a sample fetch such as sub() to check if the limit is reached.
Also you can directly fetch result from the map as integer if you know the limits are integer already using map_str_int():

http-request set-var(req.limit_num) map_str_int(/etc/haproxy/config.map, auth_failure_threshold, 10))
http-request set-var(req.gpc0_rate) sc0_gpc0_rate

http-request deny status 429 if { var(req.limit_num),sub(req.gpc0_rate) gt 0 }