From 479cd8856b90193adb7b666746ebb0b9bad1c1f9 Mon Sep 17 00:00:00 2001 From: Victor Mandujano Date: Wed, 2 Oct 2019 21:27:31 -0500 Subject: [PATCH] Add dedicated namespace for RemoteIpValve properties See gh-18489 --- .../autoconfigure/web/ServerProperties.java | 130 ++++++++++++++++-- .../TomcatWebServerFactoryCustomizer.java | 13 +- ...TomcatWebServerFactoryCustomizerTests.java | 20 +++ 3 files changed, 145 insertions(+), 18 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index 1eaae3ac63..4c4ded84f2 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -63,6 +63,7 @@ import org.springframework.util.unit.DataSize; * @author Rafiullah Hamedy * @author Dirk Deyne * @author HaiTao Zhang + * @author Victor Mandujano * @since 1.0.0 */ @ConfigurationProperties(prefix = "server", ignoreUnknownFields = true) @@ -440,6 +441,11 @@ public class ServerProperties { */ private final Mbeanregistry mbeanregistry = new Mbeanregistry(); + /** + * Remote Ip Valve configuration. + */ + private final RemoteIpValve remoteIpValve = new RemoteIpValve(); + public int getMaxThreads() { return this.maxThreads; } @@ -495,36 +501,40 @@ public class ServerProperties { this.basedir = basedir; } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.internal-proxies") public String getInternalProxies() { - return this.internalProxies; + return this.remoteIpValve.getInternalProxies(); } public void setInternalProxies(String internalProxies) { - this.internalProxies = internalProxies; + this.remoteIpValve.setInternalProxies(internalProxies); } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.protocol-header") public String getProtocolHeader() { - return this.protocolHeader; + return this.remoteIpValve.getProtocolHeader(); } public void setProtocolHeader(String protocolHeader) { - this.protocolHeader = protocolHeader; + this.remoteIpValve.setProtocolHeader(protocolHeader); } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.protocol-header-https-value") public String getProtocolHeaderHttpsValue() { - return this.protocolHeaderHttpsValue; + return this.remoteIpValve.getProtocolHeaderHttpsValue(); } public void setProtocolHeaderHttpsValue(String protocolHeaderHttpsValue) { - this.protocolHeaderHttpsValue = protocolHeaderHttpsValue; + this.remoteIpValve.setProtocolHeaderHttpsValue(protocolHeaderHttpsValue); } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.port-header") public String getPortHeader() { - return this.portHeader; + return this.remoteIpValve.getPortHeader(); } public void setPortHeader(String portHeader) { - this.portHeader = portHeader; + this.remoteIpValve.setPortHeader(portHeader); } public Boolean getRedirectContextRoot() { @@ -543,20 +553,22 @@ public class ServerProperties { this.useRelativeRedirects = useRelativeRedirects; } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.remote-ip-header") public String getRemoteIpHeader() { - return this.remoteIpHeader; + return this.remoteIpValve.getRemoteIpHeader(); } public void setRemoteIpHeader(String remoteIpHeader) { - this.remoteIpHeader = remoteIpHeader; + this.remoteIpValve.setRemoteIpHeader(remoteIpHeader); } + @DeprecatedConfigurationProperty(replacement = "server.tomcat.remote-ip-valve.host-header") public String getHostHeader() { - return this.hostHeader; + return this.remoteIpValve.getHostHeader(); } public void setHostHeader(String hostHeader) { - this.hostHeader = hostHeader; + this.remoteIpValve.setHostHeader(hostHeader); } public Charset getUriEncoding() { @@ -639,6 +651,10 @@ public class ServerProperties { return this.mbeanregistry; } + public RemoteIpValve getRemoteIpValve() { + return this.remoteIpValve; + } + /** * Tomcat access log properties. */ @@ -925,6 +941,96 @@ public class ServerProperties { } + public static class RemoteIpValve { + + /** + * Name of the HTTP header from which the remote host is extracted. + */ + private String hostHeader = "X-Forwarded-Host"; + + /** + * Regular expression that matches proxies that are to be trusted. + */ + private String internalProxies = "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|" // 10/8 + + "192\\.168\\.\\d{1,3}\\.\\d{1,3}|" // 192.168/16 + + "169\\.254\\.\\d{1,3}\\.\\d{1,3}|" // 169.254/16 + + "127\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|" // 127/8 + + "172\\.1[6-9]{1}\\.\\d{1,3}\\.\\d{1,3}|" // 172.16/12 + + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + + "0:0:0:0:0:0:0:1|::1"; + + /** + * Header that holds the incoming protocol, usually named "X-Forwarded-Proto". + */ + private String protocolHeader; + + /** + * Value of the protocol header indicating whether the incoming request uses + * SSL. + */ + private String protocolHeaderHttpsValue = "https"; + + /** + * Name of the HTTP header used to override the original port value. + */ + private String portHeader = "X-Forwarded-Port"; + + /** + * Name of the HTTP header from which the remote IP is extracted. For + * instance, `X-FORWARDED-FOR`. + */ + private String remoteIpHeader; + + public String getHostHeader() { + return this.hostHeader; + } + + public void setHostHeader(String hostHeader) { + this.hostHeader = hostHeader; + } + + public String getInternalProxies() { + return this.internalProxies; + } + + public void setInternalProxies(String internalProxies) { + this.internalProxies = internalProxies; + } + + public String getProtocolHeader() { + return this.protocolHeader; + } + + public void setProtocolHeader(String protocolHeader) { + this.protocolHeader = protocolHeader; + } + + public String getProtocolHeaderHttpsValue() { + return this.protocolHeaderHttpsValue; + } + + public void setProtocolHeaderHttpsValue(String protocolHeaderHttpsValue) { + this.protocolHeaderHttpsValue = protocolHeaderHttpsValue; + } + + public String getPortHeader() { + return this.portHeader; + } + + public void setPortHeader(String portHeader) { + this.portHeader = portHeader; + } + + public String getRemoteIpHeader() { + return this.remoteIpHeader; + } + + public void setRemoteIpHeader(String remoteIpHeader) { + this.remoteIpHeader = remoteIpHeader; + } + + } + } /** diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java index 052a13ba12..266e3624cf 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java @@ -55,6 +55,7 @@ import org.springframework.util.unit.DataSize; * @author Andrew McGhie * @author Dirk Deyne * @author Rafiullah Hamedy + * @author Victor Mandujano * @since 2.0.0 */ public class TomcatWebServerFactoryCustomizer @@ -173,8 +174,8 @@ public class TomcatWebServerFactoryCustomizer private void customizeRemoteIpValve(ConfigurableTomcatWebServerFactory factory) { Tomcat tomcatProperties = this.serverProperties.getTomcat(); - String protocolHeader = tomcatProperties.getProtocolHeader(); - String remoteIpHeader = tomcatProperties.getRemoteIpHeader(); + String protocolHeader = tomcatProperties.getRemoteIpValve().getProtocolHeader(); + String remoteIpHeader = tomcatProperties.getRemoteIpValve().getRemoteIpHeader(); // For back compatibility the valve is also enabled if protocol-header is set if (StringUtils.hasText(protocolHeader) || StringUtils.hasText(remoteIpHeader) || getOrDeduceUseForwardHeaders()) { @@ -185,10 +186,10 @@ public class TomcatWebServerFactoryCustomizer } // The internal proxies default to a white list of "safe" internal IP // addresses - valve.setInternalProxies(tomcatProperties.getInternalProxies()); - valve.setHostHeader(tomcatProperties.getHostHeader()); - valve.setPortHeader(tomcatProperties.getPortHeader()); - valve.setProtocolHeaderHttpsValue(tomcatProperties.getProtocolHeaderHttpsValue()); + valve.setInternalProxies(tomcatProperties.getRemoteIpValve().getInternalProxies()); + valve.setHostHeader(tomcatProperties.getRemoteIpValve().getHostHeader()); + valve.setPortHeader(tomcatProperties.getRemoteIpValve().getPortHeader()); + valve.setProtocolHeaderHttpsValue(tomcatProperties.getRemoteIpValve().getProtocolHeaderHttpsValue()); // ... so it's safe to add this valve by default. factory.addEngineValves(valve); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java index bde0378c9c..2c997e4b19 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java @@ -53,6 +53,7 @@ import static org.assertj.core.api.Assertions.assertThat; * @author Stephane Nicoll * @author Andrew McGhie * @author Rafiullah Hamedy + * @author Victor Mandujano */ class TomcatWebServerFactoryCustomizerTests { @@ -192,6 +193,25 @@ class TomcatWebServerFactoryCustomizerTests { assertThat(remoteIpValve.getInternalProxies()).isEqualTo("192.168.0.1"); } + @Test + void customNewPropertiesForRemoteIpValve() { + bind("server.tomcat.remote-ip-valve.remote-ip-header=x-my-remote-ip-header", + "server.tomcat.remote-ip-valve.protocol-header=x-my-protocol-header", + "server.tomcat.remote-ip-valve.internal-proxies=192.168.0.1", + "server.tomcat.remote-ip-valve.port-header=x-my-forward-port", + "server.tomcat.remote-ip-valve.protocol-header-https-value=On"); + TomcatServletWebServerFactory factory = customizeAndGetFactory(); + assertThat(factory.getEngineValves()).hasSize(1); + Valve valve = factory.getEngineValves().iterator().next(); + assertThat(valve).isInstanceOf(RemoteIpValve.class); + RemoteIpValve remoteIpValve = (RemoteIpValve) valve; + assertThat(remoteIpValve.getProtocolHeader()).isEqualTo("x-my-protocol-header"); + assertThat(remoteIpValve.getProtocolHeaderHttpsValue()).isEqualTo("On"); + assertThat(remoteIpValve.getRemoteIpHeader()).isEqualTo("x-my-remote-ip-header"); + assertThat(remoteIpValve.getPortHeader()).isEqualTo("x-my-forward-port"); + assertThat(remoteIpValve.getInternalProxies()).isEqualTo("192.168.0.1"); + } + @Test void customStaticResourceAllowCaching() { bind("server.tomcat.resource.allow-caching=false");