← Back to branch summary

~james-page/ubuntu/natty/tomcat6/fix-662588

« back to all changes in this revision

Viewing changes to test/org/apache/catalina/valves/RemoteIpValveTest.java

  • Committer: Bazaar Package Importer
  • Author(s): Thierry Carrez
  • Date: 2010-05-21 13:51:15 UTC
  • mfrom: (2.2.12 sid)
  • Revision ID: james.westby@ubuntu.com-20100521135115-qfwnf24lzvi3644v
Tags: 6.0.26-2
http://bugs.debian.org/581018
https://launchpad.net/bugs/557300
https://launchpad.net/bugs/569118
* debian/tomcat6.{postinst,prerm}: Respect TOMCAT6_USER and TOMCAT6_GROUP
  as defined in /etc/default/tomcat6 when setting directory permissions and
  authbind configuration (Closes: #581018, LP: #557300)
* debian/tomcat6.postinst: Use group "tomcat6" instead of "adm" for
  permissions in /var/lib/tomcat6, so that group "adm" doesn't get write
  permissions over /var/lib/tomcat6/webapps (LP: #569118)

Show diffs side-by-side

added added

removed removed

Lines of Context:
test/org/apache/catalina/valves/RemoteIpValveTest.java
1
 
/*
2
 
 * Licensed to the Apache Software Foundation (ASF) under one or more
3
 
 * contributor license agreements.  See the NOTICE file distributed with
4
 
 * this work for additional information regarding copyright ownership.
5
 
 * The ASF licenses this file to You under the Apache License, Version 2.0
6
 
 * (the "License"); you may not use this file except in compliance with
7
 
 * the License.  You may obtain a copy of the License at
8
 
 * 
9
 
 *      http://www.apache.org/licenses/LICENSE-2.0
10
 
 * 
11
 
 * Unless required by applicable law or agreed to in writing, software
12
 
 * distributed under the License is distributed on an "AS IS" BASIS,
13
 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
 
 * See the License for the specific language governing permissions and
15
 
 * limitations under the License.
16
 
 */
17
 
 
18
 
package org.apache.catalina.valves;
19
 
 
20
 
import java.io.IOException;
21
 
import java.util.ArrayList;
22
 
import java.util.Arrays;
23
 
import java.util.List;
24
 
 
25
 
import javax.servlet.ServletException;
26
 
 
27
 
import junit.framework.TestCase;
28
 
 
29
 
import org.apache.catalina.connector.Request;
30
 
import org.apache.catalina.connector.Response;
31
 
import org.apache.catalina.valves.ValveBase;
32
 
 
33
 
/**
34
 
 * {@link RemoteIpValve} Tests
35
 
 */
36
 
public class RemoteIpValveTest extends TestCase {
37
 
    
38
 
    static class RemoteAddrAndHostTrackerValve extends ValveBase {
39
 
        private String remoteAddr;
40
 
        private String remoteHost;
41
 
        
42
 
        public String getRemoteAddr() {
43
 
            return remoteAddr;
44
 
        }
45
 
        
46
 
        public String getRemoteHost() {
47
 
            return remoteHost;
48
 
        }
49
 
        
50
 
        @Override
51
 
        public void invoke(Request request, Response response) throws IOException, ServletException {
52
 
            this.remoteHost = request.getRemoteHost();
53
 
            this.remoteAddr = request.getRemoteAddr();
54
 
        }
55
 
    }
56
 
    
57
 
    public void testCommaDelimitedListToStringArray() {
58
 
        List<String> elements = Arrays.asList("element1", "element2", "element3");
59
 
        String actual = RemoteIpValve.listToCommaDelimitedString(elements);
60
 
        assertEquals("element1, element2, element3", actual);
61
 
    }
62
 
    
63
 
    public void testCommaDelimitedListToStringArrayEmptyList() {
64
 
        List<String> elements = new ArrayList<String>();
65
 
        String actual = RemoteIpValve.listToCommaDelimitedString(elements);
66
 
        assertEquals("", actual);
67
 
    }
68
 
    
69
 
    public void testCommaDelimitedListToStringArrayNullList() {
70
 
        String actual = RemoteIpValve.listToCommaDelimitedString(null);
71
 
        assertEquals("", actual);
72
 
    }
73
 
    
74
 
    public void testInvokeAllowedRemoteAddrWithNullRemoteIpHeader() throws Exception {
75
 
        // PREPARE
76
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
77
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
78
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
79
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
80
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
81
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
82
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
83
 
        
84
 
        Request request = new Request();
85
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
86
 
        request.setRemoteAddr("192.168.0.10");
87
 
        request.setRemoteHost("remote-host-original-value");
88
 
        
89
 
        // TEST
90
 
        remoteIpValve.invoke(request, null);
91
 
        
92
 
        // VERIFY
93
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
94
 
        assertNull("x-forwarded-for must be null", actualXForwardedFor);
95
 
        
96
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
97
 
        assertNull("x-forwarded-by must be null", actualXForwardedBy);
98
 
        
99
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
100
 
        assertEquals("remoteAddr", "192.168.0.10", actualRemoteAddr);
101
 
        
102
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
103
 
        assertEquals("remoteHost", "remote-host-original-value", actualRemoteHost);
104
 
        
105
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
106
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
107
 
        
108
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
109
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
110
 
        
111
 
    }
112
 
    
113
 
    public void testInvokeAllProxiesAreTrusted() throws Exception {
114
 
        
115
 
        // PREPARE
116
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
117
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
118
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
119
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
120
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
121
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
122
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
123
 
        
124
 
        Request request = new Request();
125
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
126
 
        request.setRemoteAddr("192.168.0.10");
127
 
        request.setRemoteHost("remote-host-original-value");
128
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, proxy2");
129
 
        
130
 
        // TEST
131
 
        remoteIpValve.invoke(request, null);
132
 
        
133
 
        // VERIFY
134
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
135
 
        assertNull("all proxies are trusted, x-forwarded-for must be null", actualXForwardedFor);
136
 
        
137
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
138
 
        assertEquals("all proxies are trusted, they must appear in x-forwarded-by", "proxy1, proxy2", actualXForwardedBy);
139
 
        
140
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
141
 
        assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
142
 
        
143
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
144
 
        assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
145
 
        
146
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
147
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
148
 
        
149
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
150
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
151
 
    }
152
 
    
153
 
    public void testInvokeAllProxiesAreTrustedOrInternal() throws Exception {
154
 
        
155
 
        // PREPARE
156
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
157
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
158
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
159
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
160
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
161
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
162
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
163
 
        
164
 
        Request request = new Request();
165
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
166
 
        request.setRemoteAddr("192.168.0.10");
167
 
        request.setRemoteHost("remote-host-original-value");
168
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for")
169
 
            .setString("140.211.11.130, proxy1, proxy2, 192.168.0.10, 192.168.0.11");
170
 
        
171
 
        // TEST
172
 
        remoteIpValve.invoke(request, null);
173
 
        
174
 
        // VERIFY
175
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
176
 
        assertNull("all proxies are trusted, x-forwarded-for must be null", actualXForwardedFor);
177
 
        
178
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
179
 
        assertEquals("all proxies are trusted, they must appear in x-forwarded-by", "proxy1, proxy2", actualXForwardedBy);
180
 
        
181
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
182
 
        assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
183
 
        
184
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
185
 
        assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
186
 
        
187
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
188
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
189
 
        
190
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
191
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
192
 
    }
193
 
    
194
 
    public void testInvokeAllProxiesAreInternal() throws Exception {
195
 
        
196
 
        // PREPARE
197
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
198
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
199
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
200
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
201
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
202
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
203
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
204
 
        
205
 
        Request request = new Request();
206
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
207
 
        request.setRemoteAddr("192.168.0.10");
208
 
        request.setRemoteHost("remote-host-original-value");
209
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, 192.168.0.10, 192.168.0.11");
210
 
        
211
 
        // TEST
212
 
        remoteIpValve.invoke(request, null);
213
 
        
214
 
        // VERIFY
215
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
216
 
        assertNull("all proxies are internal, x-forwarded-for must be null", actualXForwardedFor);
217
 
        
218
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
219
 
        assertNull("all proxies are internal, x-forwarded-by must be null", actualXForwardedBy);
220
 
        
221
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
222
 
        assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
223
 
        
224
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
225
 
        assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
226
 
        
227
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
228
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
229
 
        
230
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
231
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
232
 
    }
233
 
    
234
 
    public void testInvokeAllProxiesAreTrustedAndRemoteAddrMatchRegexp() throws Exception {
235
 
        
236
 
        // PREPARE
237
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
238
 
        remoteIpValve.setInternalProxies("127\\.0\\.0\\.1, 192\\.168\\..*, another-internal-proxy");
239
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
240
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
241
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
242
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
243
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
244
 
        
245
 
        Request request = new Request();
246
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
247
 
        request.setRemoteAddr("192.168.0.10");
248
 
        request.setRemoteHost("remote-host-original-value");
249
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, proxy2");
250
 
        
251
 
        // TEST
252
 
        remoteIpValve.invoke(request, null);
253
 
        
254
 
        // VERIFY
255
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
256
 
        assertNull("all proxies are trusted, x-forwarded-for must be null", actualXForwardedFor);
257
 
        
258
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
259
 
        assertEquals("all proxies are trusted, they must appear in x-forwarded-by", "proxy1, proxy2", actualXForwardedBy);
260
 
        
261
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
262
 
        assertEquals("remoteAddr", "140.211.11.130", actualRemoteAddr);
263
 
        
264
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
265
 
        assertEquals("remoteHost", "140.211.11.130", actualRemoteHost);
266
 
        
267
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
268
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
269
 
        
270
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
271
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
272
 
    }
273
 
    
274
 
    public void testInvokeNotAllowedRemoteAddr() throws Exception {
275
 
        // PREPARE
276
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
277
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
278
 
        remoteIpValve.setTrustedProxies("proxy1,proxy2,proxy3");
279
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
280
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
281
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
282
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
283
 
        
284
 
        Request request = new Request();
285
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
286
 
        request.setRemoteAddr("not-allowed-internal-proxy");
287
 
        request.setRemoteHost("not-allowed-internal-proxy-host");
288
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for").setString("140.211.11.130, proxy1, proxy2");
289
 
        
290
 
        // TEST
291
 
        remoteIpValve.invoke(request, null);
292
 
        
293
 
        // VERIFY
294
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
295
 
        assertEquals("x-forwarded-for must be unchanged", "140.211.11.130, proxy1, proxy2", actualXForwardedFor);
296
 
        
297
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
298
 
        assertNull("x-forwarded-by must be null", actualXForwardedBy);
299
 
        
300
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
301
 
        assertEquals("remoteAddr", "not-allowed-internal-proxy", actualRemoteAddr);
302
 
        
303
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
304
 
        assertEquals("remoteHost", "not-allowed-internal-proxy-host", actualRemoteHost);
305
 
        
306
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
307
 
        assertEquals("postInvoke remoteAddr", "not-allowed-internal-proxy", actualPostInvokeRemoteAddr);
308
 
        
309
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
310
 
        assertEquals("postInvoke remoteAddr", "not-allowed-internal-proxy-host", actualPostInvokeRemoteHost);
311
 
    }
312
 
    
313
 
    public void testInvokeUntrustedProxyInTheChain() throws Exception {
314
 
        // PREPARE
315
 
        RemoteIpValve remoteIpValve = new RemoteIpValve();
316
 
        remoteIpValve.setInternalProxies("192\\.168\\.0\\.10, 192\\.168\\.0\\.11");
317
 
        remoteIpValve.setTrustedProxies("proxy1, proxy2, proxy3");
318
 
        remoteIpValve.setRemoteIpHeader("x-forwarded-for");
319
 
        remoteIpValve.setProxiesHeader("x-forwarded-by");
320
 
        RemoteAddrAndHostTrackerValve remoteAddrAndHostTrackerValve = new RemoteAddrAndHostTrackerValve();
321
 
        remoteIpValve.setNext(remoteAddrAndHostTrackerValve);
322
 
        
323
 
        Request request = new Request();
324
 
        request.setCoyoteRequest(new org.apache.coyote.Request());
325
 
        request.setRemoteAddr("192.168.0.10");
326
 
        request.setRemoteHost("remote-host-original-value");
327
 
        request.getCoyoteRequest().getMimeHeaders().addValue("x-forwarded-for")
328
 
            .setString("140.211.11.130, proxy1, untrusted-proxy, proxy2");
329
 
        
330
 
        // TEST
331
 
        remoteIpValve.invoke(request, null);
332
 
        
333
 
        // VERIFY
334
 
        String actualXForwardedFor = request.getHeader("x-forwarded-for");
335
 
        assertEquals("ip/host before untrusted-proxy must appear in x-forwarded-for", "140.211.11.130, proxy1", actualXForwardedFor);
336
 
        
337
 
        String actualXForwardedBy = request.getHeader("x-forwarded-by");
338
 
        assertEquals("ip/host after untrusted-proxy must appear in  x-forwarded-by", "proxy2", actualXForwardedBy);
339
 
        
340
 
        String actualRemoteAddr = remoteAddrAndHostTrackerValve.getRemoteAddr();
341
 
        assertEquals("remoteAddr", "untrusted-proxy", actualRemoteAddr);
342
 
        
343
 
        String actualRemoteHost = remoteAddrAndHostTrackerValve.getRemoteHost();
344
 
        assertEquals("remoteHost", "untrusted-proxy", actualRemoteHost);
345
 
        
346
 
        String actualPostInvokeRemoteAddr = request.getRemoteAddr();
347
 
        assertEquals("postInvoke remoteAddr", "192.168.0.10", actualPostInvokeRemoteAddr);
348
 
        
349
 
        String actualPostInvokeRemoteHost = request.getRemoteHost();
350
 
        assertEquals("postInvoke remoteAddr", "remote-host-original-value", actualPostInvokeRemoteHost);
351
 
    }
352
 
    
353
 
    public void testListToCommaDelimitedString() {
354
 
        String[] actual = RemoteIpValve.commaDelimitedListToStringArray("element1, element2, element3");
355
 
        String[] expected = new String[] {
356
 
            "element1", "element2", "element3"
357
 
        };
358
 
        assertArrayEquals(expected, actual);
359
 
    }
360
 
    
361
 
    public void testListToCommaDelimitedStringMixedSpaceChars() {
362
 
        String[] actual = RemoteIpValve.commaDelimitedListToStringArray("element1  , element2,\t element3");
363
 
        String[] expected = new String[] {
364
 
            "element1", "element2", "element3"
365
 
        };
366
 
        assertArrayEquals(expected, actual);
367
 
    }
368
 
    
369
 
    private void assertArrayEquals(String[] expected, String[] actual) {
370
 
        if (expected == null) {
371
 
            assertNull(actual);
372
 
            return;
373
 
        }
374
 
        assertNotNull(actual);
375
 
        assertEquals(expected.length, actual.length);
376
 
        List<String> e = new ArrayList<String>();
377
 
        e.addAll(Arrays.asList(expected));
378
 
        List<String> a = new ArrayList<String>();
379
 
        a.addAll(Arrays.asList(actual));
380
 
        
381
 
        for (String entry : e) {
382
 
            assertTrue(a.remove(entry));
383
 
        }
384
 
        assertTrue(a.isEmpty());
385
 
    }
386
 
}