Search in sources :

Example 66 with Request

use of org.apache.catalina.connector.Request in project tomcat by apache.

the class TestRemoteIpValve method testInvokeUntrustedProxyInTheChain.

@Test
public void testInvokeUntrustedProxyInTheChain() throws Exception {
    // PREPARE
    RemoteIpValve remoteIpValve = new RemoteIpValve();
    remoteIpValve.setInternalProxies("192\\.168\\.0\\.10|192\\.168\\.0\\.11");
    remoteIpValve.setTrustedProxies("proxy1|proxy2|proxy3");
    remoteIpValve.setRemoteIpHeader("x-forwarded-for");
    remoteIpValve.setProxiesHeader("x-forwarded-by");
    RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
    remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
    Request request = new MockRequest();
    request.setCoyoteRequest(new org.apache.coyote.Request());
    request.setRemoteAddr("192.168.0.10");
    request.setRemoteHost("remote-host-original-value");
    request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, untrusted-proxy, proxy2");
    // TEST
    remoteIpValve.invoke(request, null);
    // VERIFY
    String actualXForwardedFor = remoteAddrAndHostTrackerValve.getForwardedFor();
    Assert.assertEquals("ip/host before untrusted-proxy must appear in x-forwarded-for", "140.211.11.130,proxy1", actualXForwardedFor);
    String actualXForwardedBy = remoteAddrAndHostTrackerValve.getForwardedBy();
    Assert.assertEquals("ip/host after untrusted-proxy must appear in  x-forwarded-by", "proxy2", actualXForwardedBy);
    String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
    Assert.assertEquals("remoteAddr", "untrusted-proxy", actualRemoteAddr);
    String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
    Assert.assertEquals("remoteHost", "untrusted-proxy", actualRemoteHost);
    String actualPostInvokeRemoteAddr = request.getRemoteAddr();
    Assert.assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
    String actualPostInvokeRemoteHost = request.getRemoteHost();
    Assert.assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
}
Also used : Request(org.apache.catalina.connector.Request) Test(org.junit.Test)

Example 67 with Request

use of org.apache.catalina.connector.Request in project tomcat by apache.

the class TestRemoteIpValve method testInvokeAllProxiesAreTrustedUnusedInternal.

@Test
public void testInvokeAllProxiesAreTrustedUnusedInternal() throws Exception {
    // PREPARE
    RemoteIpValve remoteIpValve = new RemoteIpValve();
    remoteIpValve.setTrustedProxies("proxy1|proxy2|proxy3");
    remoteIpValve.setRemoteIpHeader("x-forwarded-for");
    remoteIpValve.setProxiesHeader("x-forwarded-by");
    RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
    remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
    Request request = new MockRequest();
    request.setCoyoteRequest(new org.apache.coyote.Request());
    request.setRemoteAddr("proxy3");
    request.setRemoteHost("remote-host-original-value");
    request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, proxy2");
    // TEST
    remoteIpValve.invoke(request, null);
    // VERIFY
    String actualXForwardedFor = remoteAddrAndHostTrackerValve.getForwardedFor();
    Assert.assertNull("all proxies are trusted, x-forwarded-for must be null", actualXForwardedFor);
    String actualXForwardedBy = remoteAddrAndHostTrackerValve.getForwardedBy();
    Assert.assertEquals("all proxies are trusted, they must appear in x-forwarded-by", "proxy1,proxy2,proxy3", actualXForwardedBy);
    String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
    Assert.assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
    String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
    Assert.assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
    String actualPostInvokeRemoteAddr = request.getRemoteAddr();
    Assert.assertEquals("postInvoke remoteAddr", "proxy3", actualPostInvokeRemoteAddr);
    String actualPostInvokeRemoteHost = request.getRemoteHost();
    Assert.assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
}
Also used : Request(org.apache.catalina.connector.Request) Test(org.junit.Test)

Example 68 with Request

use of org.apache.catalina.connector.Request in project tomcat by apache.

the class TestRemoteIpValve method testInvokeXforwardedProtoIsNullForIncomingHttpRequest.

@Test
public void testInvokeXforwardedProtoIsNullForIncomingHttpRequest() throws Exception {
    // PREPARE
    RemoteIpValve remoteIpValve = new RemoteIpValve();
    remoteIpValve.setRemoteIpHeader("x-forwarded-for");
    remoteIpValve.setProtocolHeader("x-forwarded-proto");
    RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
    remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
    Request request = new MockRequest();
    request.setCoyoteRequest(new org.apache.coyote.Request());
    // client ip
    request.setRemoteAddr("192.168.0.10");
    request.setRemoteHost("192.168.0.10");
    request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130");
    // protocol
    // null "x-forwarded-proto"
    request.setSecure(false);
    request.setServerPort(8080);
    request.getCoyoteRequest().scheme().setString("http");
    // TEST
    remoteIpValve.invoke(request, null);
    // VERIFY
    // client ip
    String actualXForwardedFor = remoteAddrAndHostTrackerValve.getForwardedFor();
    Assert.assertNull("no intermediate non-trusted proxy, x-forwarded-for must be null", actualXForwardedFor);
    String actualXForwardedBy = request.getHeader("x-forwarded-by");
    Assert.assertNull("no intermediate trusted proxy", actualXForwardedBy);
    String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
    Assert.assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
    String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
    Assert.assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
    String actualPostInvokeRemoteAddr = request.getRemoteAddr();
    Assert.assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
    String actualPostInvokeRemoteHost = request.getRemoteHost();
    Assert.assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteHost);
    // protocol
    String actualScheme = remoteAddrAndHostTrackerValve.getScheme();
    Assert.assertEquals("x-forwarded-proto is null", "http", actualScheme);
    int actualServerPort = remoteAddrAndHostTrackerValve.getServerPort();
    Assert.assertEquals("x-forwarded-proto is null", 8080, actualServerPort);
    boolean actualSecure = remoteAddrAndHostTrackerValve.isSecure();
    Assert.assertFalse("x-forwarded-proto is null", actualSecure);
    boolean actualPostInvokeSecure = request.isSecure();
    Assert.assertFalse("postInvoke secure", actualPostInvokeSecure);
    int actualPostInvokeServerPort = request.getServerPort();
    Assert.assertEquals("postInvoke serverPort", 8080, actualPostInvokeServerPort);
    String actualPostInvokeScheme = request.getScheme();
    Assert.assertEquals("postInvoke scheme", "http", actualPostInvokeScheme);
}
Also used : Request(org.apache.catalina.connector.Request) Test(org.junit.Test)

Example 69 with Request

use of org.apache.catalina.connector.Request in project tomcat by apache.

the class TestRemoteIpValve method testInvokeAllProxiesAreTrusted.

@Test
public void testInvokeAllProxiesAreTrusted() throws Exception {
    // PREPARE
    RemoteIpValve remoteIpValve = new RemoteIpValve();
    remoteIpValve.setInternalProxies("192\\.168\\.0\\.10|192\\.168\\.0\\.11");
    remoteIpValve.setTrustedProxies("proxy1|proxy2|proxy3");
    remoteIpValve.setRemoteIpHeader("x-forwarded-for");
    remoteIpValve.setProxiesHeader("x-forwarded-by");
    RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
    remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
    Request request = new MockRequest();
    request.setCoyoteRequest(new org.apache.coyote.Request());
    request.setRemoteAddr("192.168.0.10");
    request.setRemoteHost("remote-host-original-value");
    request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, proxy2");
    // TEST
    remoteIpValve.invoke(request, null);
    // VERIFY
    String actualXForwardedFor = remoteAddrAndHostTrackerValve.getForwardedFor();
    Assert.assertNull("all proxies are trusted, x-forwarded-for must be null", actualXForwardedFor);
    String actualXForwardedBy = remoteAddrAndHostTrackerValve.getForwardedBy();
    Assert.assertEquals("all proxies are trusted, they must appear in x-forwarded-by", "proxy1,proxy2", actualXForwardedBy);
    String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
    Assert.assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
    String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
    Assert.assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
    String actualPostInvokeRemoteAddr = request.getRemoteAddr();
    Assert.assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
    String actualPostInvokeRemoteHost = request.getRemoteHost();
    Assert.assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
}
Also used : Request(org.apache.catalina.connector.Request) Test(org.junit.Test)

Example 70 with Request

use of org.apache.catalina.connector.Request in project tomcat by apache.

the class TestCrawlerSessionManagerValve method testCrawlerIpsNegative.

@Test
public void testCrawlerIpsNegative() throws Exception {
    CrawlerSessionManagerValve valve = new CrawlerSessionManagerValve();
    valve.setCrawlerIps("216\\.58\\.206\\.174");
    valve.setCrawlerUserAgents(valve.getCrawlerUserAgents());
    valve.setNext(EasyMock.createMock(Valve.class));
    HttpSession session = createSessionExpectations(valve, false);
    Request request = createRequestExpectations("127.0.0.1", session, false);
    EasyMock.replay(request, session);
    valve.invoke(request, EasyMock.createMock(Response.class));
    EasyMock.verify(request, session);
}
Also used : Response(org.apache.catalina.connector.Response) HttpSession(jakarta.servlet.http.HttpSession) Request(org.apache.catalina.connector.Request) Valve(org.apache.catalina.Valve) Test(org.junit.Test)

Aggregations

Request (org.apache.catalina.connector.Request)80 Test (org.junit.Test)44 Response (org.apache.catalina.connector.Response)16 HttpServletRequest (javax.servlet.http.HttpServletRequest)14 IOException (java.io.IOException)9 HttpSession (javax.servlet.http.HttpSession)9 Context (org.apache.catalina.Context)9 ServletRequest (javax.servlet.ServletRequest)8 Valve (org.apache.catalina.Valve)7 RequestFacade (org.apache.catalina.connector.RequestFacade)7 TesterContext (org.apache.tomcat.unittest.TesterContext)7 HttpServletRequest (jakarta.servlet.http.HttpServletRequest)5 HttpSession (jakarta.servlet.http.HttpSession)5 ServletException (javax.servlet.ServletException)5 Connector (org.apache.catalina.connector.Connector)5 ServletRequest (jakarta.servlet.ServletRequest)4 TomcatBaseTest (org.apache.catalina.startup.TomcatBaseTest)4 ServletRequestWrapper (javax.servlet.ServletRequestWrapper)3 LifecycleException (org.apache.catalina.LifecycleException)3 ServletException (jakarta.servlet.ServletException)2