HAProxy uses 100% CPU

Quoted from the HAProxy doc at haproxy.1wt.eu.

- if the application needs to log the original client's IP, use the
  "forwardfor" option which will add an "X-Forwarded-For" header with the
  original client's IP address. You must also use "httpclose" to ensure
  that you will rewrite every requests and not only the first one of each
  session:
        option httpclose
        option forwardfor

It is stated that the application must treat the X-Forwarded-For HTTP Header to know the client IP adress. Seems like the only way to go in your case.

Updated for HAProxy 1.4

Haproxy 1.4 introduced a new mode with "option http-server-close". It still closed the connection to the server but maintains keep-alive towards the client if possible and used. On most setups, you probably want to use that as it helps with latency on the single high-latency part of your connection (between Haproxy and the client).

   option http-server-close
   option forwardfor

I don't agree that there isn't anything you can do. There are lots of things you can do and depending on the size of the attack and the size of the hardware you've got you stand a pretty good chance on defending yourself.

For SYN floods google a bit. You probably want a spanking new Linux kernel as there have been quite a few improvements lately. Go for 3.6 and enable syn cookies. There are a couple of other tunables you can tweak. Make sure to read up on it first as randomly tuning stuff is never a good idea and will cause problems.

If is is a HTTP flood, which is common these days you might want to consider Varnish. You might be able to identify the attacking requests by some pattern and kill them off in vcl_recv. You can deploy the shield module in order to kill of these connection as serving up an error page is a wasted effort. Be warned: This is not a quick fix and will require substantial effort on your end.

Good luck.