From c6fc53aa9999c7336f18df5d32acb49ee2f6171a Mon Sep 17 00:00:00 2001
From: Amaury Denoyelle <adenoyelle@haproxy.com>
Date: Wed, 18 Mar 2026 16:22:11 +0100
Subject: [PATCH] MEDIUM: proxy: remove http-errors limitation for dynamic
 backends

Use proxy_check_http_errors() on defaults proxy instances. This will
emit alert messages for errorfiles directives referencing a non-existing
http-errors section, or a warning if an explicitely listed status code
is not present in the target section.

This is a small behavior changes, as previouly this was only performed
for regular proxies. Thus, errorfile/errorfiles directives in an unused
defaults were never checked.

This may prevent startup of haproxy with a configuration file previously
considered as valid. However, this change is considered as necessary to
be able to use http-errors with dynamic backends. Any invalid defaults
will be detected on startup, rather than having to discover it at
runtime via "add backend" invokation.

Thus, any restriction on http-errors usage is now lifted for the
creation of dynamic backends.
---
 doc/management.txt | 5 +----
 src/cfgparse.c     | 3 +++
 src/proxy.c        | 4 ----
 3 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/doc/management.txt b/doc/management.txt
index 218994356..bdd52b4cc 100644
--- a/doc/management.txt
+++ b/doc/management.txt
@@ -1740,10 +1740,7 @@ add backend <name> from <defproxy> [mode <mode>] [guid <guid>] [ EXPERIMENTAL ]
 
   All named default proxies can be used, given that they validate the same
   inheritance rules applied during configuration parsing. There is some
-  exceptions though, for example when the mode is neither TCP nor HTTP. Another
-  exception is that it is not yet possible to use a default proxies which
-  reference custom HTTP errors, for example via the errorfiles or http-rules
-  keywords.
+  exceptions though, for example when the mode is neither TCP nor HTTP.
 
   This command is restricted and can only be issued on sockets configured for
   level "admin". Moreover, this feature is still considered in development so it
diff --git a/src/cfgparse.c b/src/cfgparse.c
index 03578b144..d89acfeb6 100644
--- a/src/cfgparse.c
+++ b/src/cfgparse.c
@@ -63,6 +63,7 @@
 #include <haproxy/global.h>
 #include <haproxy/http_ana.h>
 #include <haproxy/http_rules.h>
+#include <haproxy/http_htx.h>
 #include <haproxy/lb_chash.h>
 #include <haproxy/lb_fas.h>
 #include <haproxy/lb_fwlc.h>
@@ -2392,6 +2393,8 @@ int check_config_validity()
 		else {
 			cfgerr += acl_find_targets(defpx);
 		}
+
+		err_code |= proxy_check_http_errors(defpx);
 	}
 
 	/* starting to initialize the main proxies list */
diff --git a/src/proxy.c b/src/proxy.c
index a72370aa4..2efef1090 100644
--- a/src/proxy.c
+++ b/src/proxy.c
@@ -4918,10 +4918,6 @@ static int cli_parse_add_backend(char **args, char *payload, struct appctx *appc
 		           def_name, proxy_mode_str(defpx->mode)));
 		return 1;
 	}
-	if (!LIST_ISEMPTY(&defpx->conf.errors)) {
-		cli_dynerr(appctx, memprintf(&msg, "Dynamic backends cannot inherit from default proxy '%s' because it references HTTP errors.\n", def_name));
-		return 1;
-	}
 
 	thread_isolate();