From 7d6129547f3684b3387816763f81b8b4df4b70f7 Mon Sep 17 00:00:00 2001 From: lihan Date: Tue, 5 Jul 2022 21:23:10 +0800 Subject: [PATCH 1/2] Add configuration property for RemoteIpValve's trusted proxies See gh-31576 --- .../boot/autoconfigure/web/ServerProperties.java | 12 ++++++++++++ .../embedded/TomcatWebServerFactoryCustomizer.java | 1 + .../autoconfigure/web/ServerPropertiesTests.java | 2 ++ .../TomcatWebServerFactoryCustomizerTests.java | 2 ++ 4 files changed, 17 insertions(+) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index 2a0333d0bb..a53171734f 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -966,6 +966,11 @@ public class ServerProperties { + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + "0:0:0:0:0:0:0:1|::1"; + /** + * Regular expression defining proxies that are trusted when they appear in the remoteIpHeader header. + */ + private String trustedProxies; + /** * Header that holds the incoming protocol, usually named "X-Forwarded-Proto". */ @@ -1041,6 +1046,13 @@ public class ServerProperties { this.remoteIpHeader = remoteIpHeader; } + public String getTrustedProxies() { + return trustedProxies; + } + + public void setTrustedProxies(String trustedProxies) { + this.trustedProxies = trustedProxies; + } } } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java index 8bfb7b164a..72feef6fe5 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java @@ -229,6 +229,7 @@ public class TomcatWebServerFactoryCustomizer } // The internal proxies default to a list of "safe" internal IP addresses valve.setInternalProxies(remoteIpProperties.getInternalProxies()); + valve.setTrustedProxies(remoteIpProperties.getTrustedProxies()); try { valve.setHostHeader(remoteIpProperties.getHostHeader()); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java index 3e12fd0758..4b2dfc185f 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java @@ -129,6 +129,7 @@ class ServerPropertiesTests { map.put("server.tomcat.remoteip.protocol-header", "X-Forwarded-Protocol"); map.put("server.tomcat.remoteip.remote-ip-header", "Remote-Ip"); map.put("server.tomcat.remoteip.internal-proxies", "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"); + map.put("server.tomcat.remoteip.trusted-proxies", "proxy1|proxy2|proxy3"); map.put("server.tomcat.reject-illegal-header", "false"); map.put("server.tomcat.background-processor-delay", "10"); map.put("server.tomcat.relaxed-path-chars", "|,<"); @@ -152,6 +153,7 @@ class ServerPropertiesTests { assertThat(tomcat.getRemoteip().getRemoteIpHeader()).isEqualTo("Remote-Ip"); assertThat(tomcat.getRemoteip().getProtocolHeader()).isEqualTo("X-Forwarded-Protocol"); assertThat(tomcat.getRemoteip().getInternalProxies()).isEqualTo("10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"); + assertThat(tomcat.getRemoteip().getTrustedProxies()).isEqualTo("proxy1|proxy2|proxy3"); assertThat(tomcat.isRejectIllegalHeader()).isFalse(); assertThat(tomcat.getBackgroundProcessorDelay()).hasSeconds(10); assertThat(tomcat.getRelaxedPathChars()).containsExactly('|', '<'); diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java index aa5ffdfaf5..c0ab36c74a 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java @@ -224,6 +224,7 @@ class TomcatWebServerFactoryCustomizerTests { bind("server.tomcat.remoteip.remote-ip-header=x-my-remote-ip-header", "server.tomcat.remoteip.protocol-header=x-my-protocol-header", "server.tomcat.remoteip.internal-proxies=192.168.0.1", + "server.tomcat.remoteip.trusted-proxies=proxy1|proxy2", "server.tomcat.remoteip.host-header=x-my-forward-host", "server.tomcat.remoteip.port-header=x-my-forward-port", "server.tomcat.remoteip.protocol-header-https-value=On"); @@ -238,6 +239,7 @@ class TomcatWebServerFactoryCustomizerTests { assertThat(remoteIpValve.getHostHeader()).isEqualTo("x-my-forward-host"); assertThat(remoteIpValve.getPortHeader()).isEqualTo("x-my-forward-port"); assertThat(remoteIpValve.getInternalProxies()).isEqualTo("192.168.0.1"); + assertThat(remoteIpValve.getTrustedProxies()).isEqualTo("proxy1|proxy2"); } @Test From f5f3d7cc6744962dd964d4a7920af35fb2b3f97f Mon Sep 17 00:00:00 2001 From: Stephane Nicoll Date: Mon, 18 Jul 2022 11:58:05 +0200 Subject: [PATCH 2/2] Polish "Add configuration property for RemoteIpValve's trusted proxies" See gh-31576 --- .../boot/autoconfigure/web/ServerProperties.java | 14 ++++++++------ .../embedded/TomcatWebServerFactoryCustomizer.java | 2 +- .../TomcatWebServerFactoryCustomizerTests.java | 4 ++-- 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index a53171734f..2ad7a35f75 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -966,11 +966,6 @@ public class ServerProperties { + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + "0:0:0:0:0:0:0:1|::1"; - /** - * Regular expression defining proxies that are trusted when they appear in the remoteIpHeader header. - */ - private String trustedProxies; - /** * Header that holds the incoming protocol, usually named "X-Forwarded-Proto". */ @@ -998,6 +993,12 @@ public class ServerProperties { */ private String remoteIpHeader; + /** + * Regular expression defining proxies that are trusted when they appear in + * the "remote-ip-header" header. + */ + private String trustedProxies; + public String getInternalProxies() { return this.internalProxies; } @@ -1047,12 +1048,13 @@ public class ServerProperties { } public String getTrustedProxies() { - return trustedProxies; + return this.trustedProxies; } public void setTrustedProxies(String trustedProxies) { this.trustedProxies = trustedProxies; } + } } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java index 72feef6fe5..3551ce3cbb 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java @@ -227,9 +227,9 @@ public class TomcatWebServerFactoryCustomizer if (StringUtils.hasLength(remoteIpHeader)) { valve.setRemoteIpHeader(remoteIpHeader); } + valve.setTrustedProxies(remoteIpProperties.getTrustedProxies()); // The internal proxies default to a list of "safe" internal IP addresses valve.setInternalProxies(remoteIpProperties.getInternalProxies()); - valve.setTrustedProxies(remoteIpProperties.getTrustedProxies()); try { valve.setHostHeader(remoteIpProperties.getHostHeader()); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java index c0ab36c74a..826e96303d 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java @@ -224,10 +224,10 @@ class TomcatWebServerFactoryCustomizerTests { bind("server.tomcat.remoteip.remote-ip-header=x-my-remote-ip-header", "server.tomcat.remoteip.protocol-header=x-my-protocol-header", "server.tomcat.remoteip.internal-proxies=192.168.0.1", - "server.tomcat.remoteip.trusted-proxies=proxy1|proxy2", "server.tomcat.remoteip.host-header=x-my-forward-host", "server.tomcat.remoteip.port-header=x-my-forward-port", - "server.tomcat.remoteip.protocol-header-https-value=On"); + "server.tomcat.remoteip.protocol-header-https-value=On", + "server.tomcat.remoteip.trusted-proxies=proxy1|proxy2"); TomcatServletWebServerFactory factory = customizeAndGetFactory(); assertThat(factory.getEngineValves()).hasSize(1); Valve valve = factory.getEngineValves().iterator().next();