From 7d6129547f3684b3387816763f81b8b4df4b70f7 Mon Sep 17 00:00:00 2001 From: lihan Date: Tue, 5 Jul 2022 21:23:10 +0800 Subject: [PATCH] Add configuration property for RemoteIpValve's trusted proxies See gh-31576 --- .../boot/autoconfigure/web/ServerProperties.java | 12 ++++++++++++ .../embedded/TomcatWebServerFactoryCustomizer.java | 1 + .../autoconfigure/web/ServerPropertiesTests.java | 2 ++ .../TomcatWebServerFactoryCustomizerTests.java | 2 ++ 4 files changed, 17 insertions(+) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java index 2a0333d0bbb3..a53171734f76 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java @@ -966,6 +966,11 @@ public static class Remoteip { + "172\\.2[0-9]{1}\\.\\d{1,3}\\.\\d{1,3}|172\\.3[0-1]{1}\\.\\d{1,3}\\.\\d{1,3}|" // + "0:0:0:0:0:0:0:1|::1"; + /** + * Regular expression defining proxies that are trusted when they appear in the remoteIpHeader header. + */ + private String trustedProxies; + /** * Header that holds the incoming protocol, usually named "X-Forwarded-Proto". */ @@ -1041,6 +1046,13 @@ public void setRemoteIpHeader(String remoteIpHeader) { this.remoteIpHeader = remoteIpHeader; } + public String getTrustedProxies() { + return trustedProxies; + } + + public void setTrustedProxies(String trustedProxies) { + this.trustedProxies = trustedProxies; + } } } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java index 8bfb7b164aef..72feef6fe5c8 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizer.java @@ -229,6 +229,7 @@ private void customizeRemoteIpValve(ConfigurableTomcatWebServerFactory factory) } // The internal proxies default to a list of "safe" internal IP addresses valve.setInternalProxies(remoteIpProperties.getInternalProxies()); + valve.setTrustedProxies(remoteIpProperties.getTrustedProxies()); try { valve.setHostHeader(remoteIpProperties.getHostHeader()); } diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java index 3e12fd075888..4b2dfc185f3a 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/ServerPropertiesTests.java @@ -129,6 +129,7 @@ void testTomcatBinding() { map.put("server.tomcat.remoteip.protocol-header", "X-Forwarded-Protocol"); map.put("server.tomcat.remoteip.remote-ip-header", "Remote-Ip"); map.put("server.tomcat.remoteip.internal-proxies", "10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"); + map.put("server.tomcat.remoteip.trusted-proxies", "proxy1|proxy2|proxy3"); map.put("server.tomcat.reject-illegal-header", "false"); map.put("server.tomcat.background-processor-delay", "10"); map.put("server.tomcat.relaxed-path-chars", "|,<"); @@ -152,6 +153,7 @@ void testTomcatBinding() { assertThat(tomcat.getRemoteip().getRemoteIpHeader()).isEqualTo("Remote-Ip"); assertThat(tomcat.getRemoteip().getProtocolHeader()).isEqualTo("X-Forwarded-Protocol"); assertThat(tomcat.getRemoteip().getInternalProxies()).isEqualTo("10\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}"); + assertThat(tomcat.getRemoteip().getTrustedProxies()).isEqualTo("proxy1|proxy2|proxy3"); assertThat(tomcat.isRejectIllegalHeader()).isFalse(); assertThat(tomcat.getBackgroundProcessorDelay()).hasSeconds(10); assertThat(tomcat.getRelaxedPathChars()).containsExactly('|', '<'); diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java index aa5ffdfaf598..c0ab36c74a59 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/embedded/TomcatWebServerFactoryCustomizerTests.java @@ -224,6 +224,7 @@ void customRemoteIpValve() { bind("server.tomcat.remoteip.remote-ip-header=x-my-remote-ip-header", "server.tomcat.remoteip.protocol-header=x-my-protocol-header", "server.tomcat.remoteip.internal-proxies=192.168.0.1", + "server.tomcat.remoteip.trusted-proxies=proxy1|proxy2", "server.tomcat.remoteip.host-header=x-my-forward-host", "server.tomcat.remoteip.port-header=x-my-forward-port", "server.tomcat.remoteip.protocol-header-https-value=On"); @@ -238,6 +239,7 @@ void customRemoteIpValve() { assertThat(remoteIpValve.getHostHeader()).isEqualTo("x-my-forward-host"); assertThat(remoteIpValve.getPortHeader()).isEqualTo("x-my-forward-port"); assertThat(remoteIpValve.getInternalProxies()).isEqualTo("192.168.0.1"); + assertThat(remoteIpValve.getTrustedProxies()).isEqualTo("proxy1|proxy2"); } @Test