| /* |
| * Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| package org.apache.catalina.valves; |
| |
| import java.io.IOException; |
| |
| import javax.servlet.ServletException; |
| |
| import static org.junit.Assert.assertEquals; |
| import static org.junit.Assert.fail; |
| |
| import org.junit.Assert; |
| import org.junit.Test; |
| |
| import org.apache.catalina.Context; |
| import org.apache.catalina.connector.Connector; |
| import org.apache.catalina.connector.Request; |
| import org.apache.catalina.connector.Response; |
| import org.apache.catalina.core.StandardContext; |
| |
| /** |
| * {@link RequestFilterValve} Tests |
| */ |
| public class TestRequestFilterValve { |
| |
| private static final int OK = 200; |
| private static final int FORBIDDEN = 403; |
| private static final int CUSTOM = 499; |
| |
| private static final String ADDR_ALLOW_PAT = "127\\.\\d*\\.\\d*\\.\\d*"; |
| private static final String ADDR_DENY_PAT = "\\d*\\.\\d*\\.\\d*\\.1"; |
| private static final String ADDR_ONLY_ALLOW = "127.0.0.2"; |
| private static final String ADDR_ONLY_DENY = "192.168.0.1"; |
| private static final String ADDR_ALLOW_AND_DENY = "127.0.0.1"; |
| private static final String ADDR_NO_ALLOW_NO_DENY = "192.168.0.2"; |
| |
| private static final String HOST_ALLOW_PAT = "www\\.example\\.[a-zA-Z0-9-]*"; |
| private static final String HOST_DENY_PAT = ".*\\.org"; |
| private static final String HOST_ONLY_ALLOW = "www.example.com"; |
| private static final String HOST_ONLY_DENY = "host.example.org"; |
| private static final String HOST_ALLOW_AND_DENY = "www.example.org"; |
| private static final String HOST_NO_ALLOW_NO_DENY = "host.example.com"; |
| |
| private static final int PORT = 8080; |
| private static final String PORT_MATCH_PATTERN = ";\\d*"; |
| private static final String PORT_NO_MATCH_PATTERN = ";8081"; |
| |
| |
| static class TerminatingValve extends ValveBase { |
| @Override |
| public void invoke(Request request, Response response) throws IOException, ServletException { |
| } |
| } |
| |
| public static class MockResponse extends Response { |
| private int status = OK; |
| |
| @Override |
| public void sendError(int status) throws IOException { |
| this.status = status; |
| } |
| |
| @Override |
| public int getStatus() { |
| return status; |
| } |
| } |
| |
| private void oneTest(String allow, String deny, boolean denyStatus, |
| boolean addConnectorPort, boolean auth, |
| String property, String type, boolean allowed) { |
| // PREPARE |
| RequestFilterValve valve = null; |
| Connector connector = new Connector(); |
| Context context = new StandardContext(); |
| Request request = new Request(); |
| Response response = new MockResponse(); |
| StringBuilder msg = new StringBuilder(); |
| int expected = allowed ? OK : FORBIDDEN; |
| |
| connector.setPort(PORT); |
| request.setConnector(connector); |
| request.getMappingData().context = context; |
| request.setCoyoteRequest(new org.apache.coyote.Request()); |
| |
| Assert.assertNotNull("Invalid test with null type", type); |
| if (property != null) { |
| if (type.equals("Addr")) { |
| valve = new RemoteAddrValve(); |
| request.setRemoteAddr(property); |
| msg.append(" ip='" + property + "'"); |
| } else if (type.equals("Host")) { |
| valve = new RemoteHostValve(); |
| request.setRemoteHost(property); |
| msg.append(" host='" + property + "'"); |
| } |
| } |
| Assert.assertNotNull("Invalid test type" + type, valve); |
| valve.setNext(new TerminatingValve()); |
| |
| if (allow != null) { |
| valve.setAllow(allow); |
| msg.append(" allow='" + allow + "'"); |
| } |
| if (deny != null) { |
| valve.setDeny(deny); |
| msg.append(" deny='" + deny + "'"); |
| } |
| if (denyStatus) { |
| valve.setDenyStatus(CUSTOM); |
| msg.append(" denyStatus='" + CUSTOM + "'"); |
| if (!allowed) { |
| expected = CUSTOM; |
| } |
| } |
| if (addConnectorPort) { |
| if (valve instanceof RemoteAddrValve) { |
| ((RemoteAddrValve)valve).setAddConnectorPort(true); |
| } else if (valve instanceof RemoteHostValve) { |
| ((RemoteHostValve)valve).setAddConnectorPort(true); |
| } else { |
| fail("Can only set 'addConnectorPort' for RemoteAddrValve and RemoteHostValve"); |
| } |
| msg.append(" addConnectorPort='true'"); |
| } |
| if (auth) { |
| context.setPreemptiveAuthentication(true); |
| valve.setInvalidAuthenticationWhenDeny(true); |
| msg.append(" auth='true'"); |
| } |
| |
| // TEST |
| try { |
| valve.invoke(request, response); |
| } catch (IOException ex) { |
| //Ignore |
| } catch (ServletException ex) { |
| //Ignore |
| } |
| |
| // VERIFY |
| if (!allowed && auth) { |
| assertEquals(msg.toString(), OK, response.getStatus()); |
| assertEquals(msg.toString(), "invalid", request.getHeader("authorization")); |
| } else { |
| assertEquals(msg.toString(), expected, response.getStatus()); |
| } |
| } |
| |
| private void standardTests(String allow_pat, String deny_pat, |
| String OnlyAllow, String OnlyDeny, |
| String AllowAndDeny, String NoAllowNoDeny, |
| boolean auth, String type) { |
| String apat; |
| String dpat; |
| |
| // Test without ports |
| apat = allow_pat; |
| dpat = deny_pat; |
| oneTest(null, null, false, false, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, false, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, false, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, false, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, true, false, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, false, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, false, false, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, false, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, true, false, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, false, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, false, false, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, true, false, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, AllowAndDeny, type, false); |
| |
| // Test with port in pattern but forgotten "addConnectorPort" |
| apat = allow_pat + PORT_MATCH_PATTERN; |
| dpat = deny_pat + PORT_MATCH_PATTERN; |
| oneTest(null, null, false, false, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, true, false, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, false, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, false, false, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, false, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, true, false, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, false, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, false, false, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, false, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, true, false, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, false, auth, AllowAndDeny, type, false); |
| |
| // Test with "addConnectorPort" but port not in pattern |
| apat = allow_pat; |
| dpat = deny_pat; |
| oneTest(null, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, false, true, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, true, true, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, AllowAndDeny, type, false); |
| |
| // Test "addConnectorPort" and with port matching in both patterns |
| apat = allow_pat + PORT_MATCH_PATTERN; |
| dpat = deny_pat + PORT_MATCH_PATTERN; |
| oneTest(null, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, true, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, false, true, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, true, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, true, true, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, false, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, true, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, AllowAndDeny, type, false); |
| |
| // Test "addConnectorPort" and with port not matching in both patterns |
| apat = allow_pat + PORT_NO_MATCH_PATTERN; |
| dpat = deny_pat + PORT_NO_MATCH_PATTERN; |
| oneTest(null, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, false, true, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, true, true, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, AllowAndDeny, type, false); |
| |
| // Test "addConnectorPort" and with port matching only in allow |
| apat = allow_pat + PORT_MATCH_PATTERN; |
| dpat = deny_pat + PORT_NO_MATCH_PATTERN; |
| oneTest(null, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, true, auth, AllowAndDeny, type, true); |
| oneTest(apat, null, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, false, true, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, true, auth, AllowAndDeny, type, true); |
| oneTest(null, dpat, true, true, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, false, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, AllowAndDeny, type, true); |
| oneTest(apat, dpat, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyAllow, type, true); |
| oneTest(apat, dpat, true, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, AllowAndDeny, type, true); |
| |
| // Test "addConnectorPort" and with port matching only in deny |
| apat = allow_pat + PORT_NO_MATCH_PATTERN; |
| dpat = deny_pat + PORT_MATCH_PATTERN; |
| oneTest(null, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, null, true, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, null, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(null, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, false, true, auth, NoAllowNoDeny, type, true); |
| oneTest(null, dpat, true, true, auth, AllowAndDeny, type, false); |
| oneTest(null, dpat, true, true, auth, NoAllowNoDeny, type, true); |
| oneTest(apat, dpat, false, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, false, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, false, true, auth, AllowAndDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, NoAllowNoDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyAllow, type, false); |
| oneTest(apat, dpat, true, true, auth, OnlyDeny, type, false); |
| oneTest(apat, dpat, true, true, auth, AllowAndDeny, type, false); |
| } |
| |
| @Test |
| public void testRemoteAddrValveIPv4() { |
| standardTests(ADDR_ALLOW_PAT, ADDR_DENY_PAT, |
| ADDR_ONLY_ALLOW, ADDR_ONLY_DENY, |
| ADDR_ALLOW_AND_DENY, ADDR_NO_ALLOW_NO_DENY, |
| false, "Addr"); |
| standardTests(ADDR_ALLOW_PAT, ADDR_DENY_PAT, |
| ADDR_ONLY_ALLOW, ADDR_ONLY_DENY, |
| ADDR_ALLOW_AND_DENY, ADDR_NO_ALLOW_NO_DENY, |
| true, "Addr"); |
| } |
| |
| @Test |
| public void testRemoteHostValve() { |
| standardTests(HOST_ALLOW_PAT, HOST_DENY_PAT, |
| HOST_ONLY_ALLOW, HOST_ONLY_DENY, |
| HOST_ALLOW_AND_DENY, HOST_NO_ALLOW_NO_DENY, |
| false, "Host"); |
| standardTests(HOST_ALLOW_PAT, HOST_DENY_PAT, |
| HOST_ONLY_ALLOW, HOST_ONLY_DENY, |
| HOST_ALLOW_AND_DENY, HOST_NO_ALLOW_NO_DENY, |
| true, "Host"); |
| } |
| } |
