apache/cloudstack
1
0
Fork 0
mirror of https://github.com/apache/cloudstack.git synced 2025-10-26 08:42:29 +01:00
Code Issues Packages Projects Releases Wiki Activity

get forward header for proxies and apply it in Jetty (#11386)

Browse Source 
* get forward header and apply it fro proxies

Co-authored-by: Daan Hoogland <dahn@apache.org>
This commit is contained in:
dahn 2025-08-07 14:45:16 +02:00 committed by GitHub
parent f020b5b5df
commit fe8f3c8eeb
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
3 changed files with 22 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
client/src/main/java/org/apache/cloudstack/ServerDaemon.java
View File

@ -24,12 +24,15 @@ import java.io.IOException;
import java.io.InputStream; import java.io.InputStream;
import java.lang.management.ManagementFactory; import java.lang.management.ManagementFactory;
import java.net.URL; import java.net.URL;
import java.util.Arrays;
import java.util.Properties; import java.util.Properties;
import com.cloud.api.ApiServer;
import org.apache.commons.daemon.Daemon; import org.apache.commons.daemon.Daemon;
import org.apache.commons.daemon.DaemonContext; import org.apache.commons.daemon.DaemonContext;
import org.apache.commons.lang3.StringUtils; import org.apache.commons.lang3.StringUtils;
import org.eclipse.jetty.jmx.MBeanContainer; import org.eclipse.jetty.jmx.MBeanContainer;
import org.eclipse.jetty.server.ForwardedRequestCustomizer;
import org.eclipse.jetty.server.HttpConfiguration; import org.eclipse.jetty.server.HttpConfiguration;
import org.eclipse.jetty.server.HttpConnectionFactory; import org.eclipse.jetty.server.HttpConnectionFactory;
import org.eclipse.jetty.server.RequestLog; import org.eclipse.jetty.server.RequestLog;
@ -184,6 +187,7 @@ public class ServerDaemon implements Daemon {
httpConfig.setResponseHeaderSize(8192); httpConfig.setResponseHeaderSize(8192);
httpConfig.setSendServerVersion(false); httpConfig.setSendServerVersion(false);
httpConfig.setSendDateHeader(false); httpConfig.setSendDateHeader(false);
addForwardingCustomiser(httpConfig);
// HTTP Connector // HTTP Connector
createHttpConnector(httpConfig); createHttpConnector(httpConfig);
@ -206,6 +210,21 @@ public class ServerDaemon implements Daemon {
server.join(); server.join();
} }
/**
* Adds a ForwardedRequestCustomizer to the HTTP configuration to handle forwarded headers.
* The header used for forwarding is determined by the ApiServer.listOfForwardHeaders property.
* Only non empty headers are considered and only the first of the comma-separated list is used.
* @param httpConfig the HTTP configuration to which the customizer will be added
*/
private static void addForwardingCustomiser(HttpConfiguration httpConfig) {
ForwardedRequestCustomizer customiser = new ForwardedRequestCustomizer();
String header = Arrays.stream(ApiServer.listOfForwardHeaders.value().split(",")).findFirst().orElse(null);
if (com.cloud.utils.StringUtils.isNotEmpty(header)) {
customiser.setForwardedForHeader(header);
}
httpConfig.addCustomizer(customiser);
}
@Override @Override
public void stop() throws Exception { public void stop() throws Exception {
server.stop(); server.stop();

4
server/src/main/java/com/cloud/api/ApiServer.java
View File

@ -315,14 +315,14 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer
, "enables/disables checking of ipaddresses from a proxy set header. See \"proxy.header.names\" for the headers to allow." , "enables/disables checking of ipaddresses from a proxy set header. See \"proxy.header.names\" for the headers to allow."
, true , true
, ConfigKey.Scope.Global); , ConfigKey.Scope.Global);
static final ConfigKey<String> listOfForwardHeaders = new ConfigKey<>(ConfigKey.CATEGORY_NETWORK public static final ConfigKey<String> listOfForwardHeaders = new ConfigKey<>(ConfigKey.CATEGORY_NETWORK
, String.class , String.class
, "proxy.header.names" , "proxy.header.names"
, "X-Forwarded-For,HTTP_CLIENT_IP,HTTP_X_FORWARDED_FOR" , "X-Forwarded-For,HTTP_CLIENT_IP,HTTP_X_FORWARDED_FOR"
, "a list of names to check for allowed ipaddresses from a proxy set header. See \"proxy.cidr\" for the proxies allowed to set these headers." , "a list of names to check for allowed ipaddresses from a proxy set header. See \"proxy.cidr\" for the proxies allowed to set these headers."
, true , true
, ConfigKey.Scope.Global); , ConfigKey.Scope.Global);
static final ConfigKey<String> proxyForwardList = new ConfigKey<>(ConfigKey.CATEGORY_NETWORK public static final ConfigKey<String> proxyForwardList = new ConfigKey<>(ConfigKey.CATEGORY_NETWORK
, String.class , String.class
, "proxy.cidr" , "proxy.cidr"
, "" , ""

5
utils/src/main/java/com/cloud/utils/ConstantTimeComparator.java
View File

@ -19,8 +19,6 @@
package com.cloud.utils; package com.cloud.utils;
import java.nio.charset.Charset;
public class ConstantTimeComparator { public class ConstantTimeComparator {
public static boolean compareBytes(byte[] b1, byte[] b2) { public static boolean compareBytes(byte[] b1, byte[] b2) {
@ -36,7 +34,6 @@ public class ConstantTimeComparator {
} }
public static boolean compareStrings(String s1, String s2) { public static boolean compareStrings(String s1, String s2) {
final Charset encoding = Charset.forName("UTF-8"); return compareBytes(s1.getBytes(StringUtils.getPreferredCharset()), s2.getBytes(StringUtils.getPreferredCharset()));
return compareBytes(s1.getBytes(encoding), s2.getBytes(encoding));
} }
} }