Add support for CIDR notation in RemoteIpFilter
#632
Conversation
# Context Tomcat's `RemoteIpFilter` currently allows configuring trusted/internal proxies using regexp. When integrating with reverse proxies with a large number of IP addresses, regexp configuration gets cumbersome. # Suggestion I suggest adding support for IP ranges in CIDR notation to make it easier to setup the filter in these cases. For backward compatibility, matching with masks is only performed when the trusted/internal proxies patterns are null. Depending on the feedback I receive on this PR, I may add the same changes to Tomcat's `RemoteIpValve`.
|
I have not looked at your implementation suggestion, but did you notice there is: https://tomcat.apache.org/tomcat-9.0-doc/config/filter.html#Remote_CIDR_Filter |
|
Ah, sorry I just realized what you plan. Please ignore my reference to RemoteCIDRFilter. |
|
This PR should use NetMaskSet as well. |
|
Hi, If you want this PR to merge smoothly, please modify this change according to markt‘s comment. |
|
@aooohan @markt-asf Can you reassign this question to me，I want to try to solve it |
|
No need to assign it, you can just start work. You probably want to create a new PR. If you do, and if it looks more promising than this one, this one will be closed. |
Signed-off-by: abin <[email protected]>
@markt-asf hi，The code has been pushed for review. Please let me know if there are any further adjustments needed, such as optimizing error handling or supplementing documentation. thanks |
|
Please create a PR for your proposed solution. |
|
oh Sorry, I forgot. Now has been created. Please check. |
|
Closing in favour of #894 |
5 participants
Context
Tomcat's
RemoteIpFiltercurrently allows configuring trusted/internal proxies using regexp.When integrating with reverse proxies with a large number of IP addresses, regexp configuration gets cumbersome.
Suggestion
I suggest adding support for IP ranges in CIDR notation to make it easier to setup the filter in these cases.
For backward compatibility, matching with masks is only performed when the trusted/internal proxies patterns are null.
Depending on the feedback I receive on this PR, I may add the same changes to Tomcat's
RemoteIpValve.