proper IP recognition using header X-Real-IP when YaCy is behind a

reverse proxy

1 files changed, 43 insertions, 0 deletions

diff --git a/test/java/net/yacy/http/Jetty12HttpServerTest.java b/test/java/net/yacy/http/Jetty12HttpServerTest.java
index 457eaa8ae..f591db7b9 100644
--- a/test/java/net/yacy/http/Jetty12HttpServerTest.java
+++ b/test/java/net/yacy/http/Jetty12HttpServerTest.java
@@ -10,6 +10,7 @@ import static org.junit.Assert.assertTrue;
 import java.io.ByteArrayOutputStream;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.lang.reflect.Proxy;
 import java.net.Socket;
 import java.nio.charset.StandardCharsets;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -42,6 +43,7 @@ import org.junit.experimental.runners.Enclosed;
 import org.junit.runner.RunWith;
 
 import net.yacy.cora.order.Digest;
+import net.yacy.cora.protocol.RequestHeader;
 import net.yacy.search.SwitchboardConstants;
 
 /**
@@ -115,6 +117,47 @@ public class Jetty12HttpServerTest {
         }
 
         @Test
+        public void tracksForwardedClientOnlyForTrustedReverseProxy() {
+            final HttpServletRequest trustedProxyRequest = requestWithRemoteAddress(
+                    "127.0.0.1", "198.51.100.23");
+            assertEquals("198.51.100.23",
+                    Jetty12HttpServer.AdminSecurityHandler.resolveTrackingClientIp(
+                            trustedProxyRequest,
+                            SwitchboardConstants.SERVER_REVERSE_PROXY_TRUSTED_DEFAULT));
+
+            final HttpServletRequest spoofedDirectRequest = requestWithRemoteAddress(
+                    "203.0.113.10", "127.0.0.1");
+            assertEquals("203.0.113.10",
+                    Jetty12HttpServer.AdminSecurityHandler.resolveTrackingClientIp(
+                            spoofedDirectRequest,
+                            SwitchboardConstants.SERVER_REVERSE_PROXY_TRUSTED_DEFAULT));
+
+            final HttpServletRequest invalidForwardedAddress = requestWithRemoteAddress(
+                    "127.0.0.1", "unknown, 198.51.100.23");
+            assertEquals("127.0.0.1",
+                    Jetty12HttpServer.AdminSecurityHandler.resolveTrackingClientIp(
+                            invalidForwardedAddress,
+                            SwitchboardConstants.SERVER_REVERSE_PROXY_TRUSTED_DEFAULT));
+        }
+
+        private static HttpServletRequest requestWithRemoteAddress(final String socketRemoteIp,
+                final String forwardedRemoteIp) {
+            return (HttpServletRequest) Proxy.newProxyInstance(
+                    Jetty12HttpServerTest.class.getClassLoader(),
+                    new Class<?>[]{HttpServletRequest.class},
+                    (proxy, method, args) -> {
+                        if ("getRemoteAddr".equals(method.getName())) {
+                            return socketRemoteIp;
+                        }
+                        if ("getHeader".equals(method.getName())
+                                && RequestHeader.X_Real_IP.equals(args[0])) {
+                            return forwardedRemoteIp;
+                        }
+                        return null;
+                    });
+        }
+
+        @Test
         public void preservesJetty9SvgCompressionContract() {
             final GzipHandler compression = Jetty12HttpServer.createGzipHandler(null, true);
             assertTrue(compression.isMimeTypeDeflatable("image/svg+xml"));