From 8f6c765898f444fe0c452a41e6eff4549e445274 Mon Sep 17 00:00:00 2001 From: markt Date: Wed, 14 Apr 2010 23:17:26 +0000 Subject: [PATCH] Fix https://issues.apache.org/bugzilla/show_bug.cgi?id=49024 Enhance the RemoteIpFilter docs Patch provided by Cyrille Le Clerc git-svn-id: https://svn.apache.org/repos/asf/tomcat/trunk@934239 13f79535-47bb-0310-9956-ffa450edef68 --- webapps/docs/config/filter.xml | 290 +++++++++++++++++++++++++++++++++++++++++ 1 file changed, 290 insertions(+) diff --git a/webapps/docs/config/filter.xml b/webapps/docs/config/filter.xml index 99b85b9de..3555167f7 100644 --- a/webapps/docs/config/filter.xml +++ b/webapps/docs/config/filter.xml @@ -226,6 +226,296 @@ + +

+ The filter will process the x-forwarded-for http header. +

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + </filter> + + <filter-mapping> + <filter-name>RemoteIpFilter</filter-name> + <url-pattern>/*</url-pattern> + <dispatcher>REQUEST</dispatcher> + </filter-mapping> + + + + + +

+ The filter will process x-forwarded-for and + x-forwarded-proto http headers. Expected value for the + x-forwarded-proto header in case of SSL connections is + https (case insensitive).

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + <init-param> + <param-name>protocolHeader</param-name> + <param-value>x-forwarded-proto</param-value> + </init-param> + </filter> + + <filter-mapping> + <filter-name>RemoteIpFilter</filter-name> + <url-pattern>/*</url-pattern> + <dispatcher>REQUEST</dispatcher> + </filter-mapping> + + + + +

RemoteIpFilter configuration:

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + <init-param> + <param-name>allowedInternalProxies</param-name> + <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value> + </init-param> + <init-param> + <param-name>remoteIPHeader</param-name> + <param-value>x-forwarded-for</param-value> + </init-param> + <init-param> + <param-name>remoteIPProxiesHeader</param-name> + <param-value>x-forwarded-by</param-value> + </init-param> + <init-param> + <param-name>protocolHeader</param-name> + <param-value>x-forwarded-proto</param-value> + </init-param> + </filter> + +

Request values: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
PropertyValue Before RemoteIpFilterValue After RemoteIpFilter
request.remoteAddr 192.168.0.10 140.211.11.130
request.header['x-forwarded-for'] 140.211.11.130, 192.168.0.10 null
request.header['x-forwarded-by'] null null
request.header['x-forwarded-proto'] https https
request.scheme http https
request.secure false true
request.serverPort 80 443
+

+

+ Note : x-forwarded-by header is null because only + internal proxies has been traversed by the request. + x-forwarded-for is null because all the proxies are + trusted or internal. +

+ + + + +

RemoteIpFilter configuration:

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + <init-param> + <param-name>allowedInternalProxies</param-name> + <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value> + </init-param> + <init-param> + <param-name>remoteIPHeader</param-name> + <param-value>x-forwarded-for</param-value> + </init-param> + <init-param> + <param-name>remoteIPProxiesHeader</param-name> + <param-value>x-forwarded-by</param-value> + </init-param> + <init-param> + <param-name>trustedProxies</param-name> + <param-value>proxy1, proxy2</param-value> + </init-param> + </filter> + +

Request values: + + + + + + + + + + + + + + + + + + + + +
PropertyValue Before RemoteIpFilterValue After RemoteIpFilter
request.remoteAddr 192.168.0.10 140.211.11.130
request.header['x-forwarded-for'] 140.211.11.130, proxy1, proxy2 null
request.header['x-forwarded-by'] null proxy1, proxy2
+

+

+ Note : proxy1 and proxy2 are both trusted proxies that + come in x-forwarded-for header, they both are migrated in + x-forwarded-by header. x-forwarded-for is null + because all the proxies are trusted or internal. +

+ + + +

RemoteIpFilter configuration:

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + <init-param> + <param-name>allowedInternalProxies</param-name> + <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value> + </init-param> + <init-param> + <param-name>remoteIPHeader</param-name> + <param-value>x-forwarded-for</param-value> + </init-param> + <init-param> + <param-name>remoteIPProxiesHeader</param-name> + <param-value>x-forwarded-by</param-value> + </init-param> + <init-param> + <param-name>trustedProxies</param-name> + <param-value>proxy1, proxy2</param-value> + </init-param> + </filter> + +

Request values: + + + + + + + + + + + + + + + + + + + + +
PropertyValue Before RemoteIpFilterValue After RemoteIpFilter
request.remoteAddr 192.168.0.10 140.211.11.130
request.header['x-forwarded-for'] 140.211.11.130, proxy1, proxy2, 192.168.0.10 null
request.header['x-forwarded-by'] null proxy1, proxy2
+

+

+ Note : proxy1 and proxy2 are both trusted proxies that + come in x-forwarded-for header, they both are migrated in + x-forwarded-by header. As 192.168.0.10 is an internal + proxy, it does not appear in x-forwarded-by. + x-forwarded-for is null because all the proxies are + trusted or internal. +

+ + + + +

RemoteIpFilter configuration:

+ + <filter> + <filter-name>RemoteIpFilter</filter-name> + <filter-class>org.apache.catalina.filters.RemoteIpFilter</filter-class> + <init-param> + <param-name>allowedInternalProxies</param-name> + <param-value>192\.168\.0\.10, 192\.168\.0\.11</param-value> + </init-param> + <init-param> + <param-name>remoteIPHeader</param-name> + <param-value>x-forwarded-for</param-value> + </init-param> + <init-param> + <param-name>remoteIPProxiesHeader</param-name> + <param-value>x-forwarded-by</param-value> + </init-param> + <init-param> + <param-name>trustedProxies</param-name> + <param-value>proxy1, proxy2</param-value> + </init-param> + </filter> + +

Request values: + + + + + + + + + + + + + + + + + + + + +
PropertyValue Before RemoteIpFilterValue After RemoteIpFilter
request.remoteAddr 192.168.0.10 untrusted-proxy
request.header['x-forwarded-for'] 140.211.11.130, untrusted-proxy, proxy1 140.211.11.130
request.header['x-forwarded-by'] null proxy1
+

+

+ Note : x-forwarded-by holds the trusted proxy proxy1. + x-forwarded-by holds 140.211.11.130 because + untrusted-proxy is not trusted and thus, we can not trust that + untrusted-proxy is the actual remote ip. + request.remoteAddr is untrusted-proxy that is an IP + verified by proxy1. +

+ +

The Remote IP Filter supports the -- 2.11.0