Merge pull request #231 from xenit-eu/DOCKER-471

kpiot123 · web-flow · commit 1e7e3663d5c5 · 2025-11-03T13:42:59.000+01:00
DOCKER-471 Added remote IP valve to Tomcat
diff --git a/Changelog.md b/Changelog.md
@@ -15,6 +15,7 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/).
 * [PR #78](https://github.com/xenit-eu/docker-alfresco/pull/78) DOCKER-408 Add timeout to health check commands
 
 ### Added
+* [PR #231](https://github.com/xenit-eu/docker-alfresco/pull/231) DOCKER-471 Added remote ip valve to Tomcat 10 
 * [PR #223](https://github.com/xenit-eu/docker-alfresco/pull/223) DOCKER-466 Added Support for v25.1 
 * [PR #222](https://github.com/xenit-eu/docker-alfresco/pull/222) DOCKER-464 Added json logging test
 * [PR #219](https://github.com/xenit-eu/docker-alfresco/pull/219) ALFREDAPI-569 Added Alfresco V23.3 & V23.4 support
diff --git a/README.md b/README.md
@@ -75,6 +75,7 @@ in the following tables, are the values that are used when the environment varia
 | TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING               | false                            | Set to true if Tomcat should automatically parse multipart/form-data request bodies when HttpServletRequest.getPart* or HttpServletRequest.getParameter* is called. The default is false.                                                                                                                |
 | TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH | false                            | Tomcat will collapse multiple leading / characters at the start of the return value for HttpServletRequest#getContextPath() to a single /. The default is false.                                                                                                                                         |
 | TOMCAT_CROSS_CONTEXT                                | false                            | Set to true if you want calls within this application to ServletContext.getContext() to successfully return a request dispatcher for other web applications running on this virtual host. Set to false (the default) in security conscious environments, to make getContext() always return null.        |
+| TOMCAT_REMOTE_IP_VALVE_ENABLED                      | true                             | If this is set to true, it will allow Tomcat to pick up remote ip headers like "X-Forwarded-For“, “X-Forwarded-Proto“ and “X-Forwarded-Port“. If Alfresco/Share are behind a proxy, they will be aware of that.                                                                                          |
 | JAVA_XMS                                            |                                  | -Xmx                                                                                                                                                                                                                                                                                                     |
 | JAVA_XMX                                            |                                  | -Xms                                                                                                                                                                                                                                                                                                     |
 | DEBUG                                               | false                            | -Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n                                                                                                                                                                                                                                    |
diff --git a/tomcat-base/build.gradle b/tomcat-base/build.gradle
@@ -50,6 +50,9 @@ subprojects {
         implementation "eu.xenit.logging:json-logging:${jsonLoggingVersion}"
         testImplementation "org.junit.jupiter:junit-jupiter-api:5.10.0"
         testImplementation("org.junit-pioneer:junit-pioneer:2.1.0")
+        testImplementation group: 'io.rest-assured', name: 'rest-assured', version: '5.3.2'
+        testImplementation group: 'io.rest-assured', name: 'json-path', version: '5.3.2'
+        testImplementation group: 'io.rest-assured', name: 'rest-assured-common', version: '5.3.2'
         testRuntimeOnly "org.junit.jupiter:junit-jupiter-engine:5.10.0"
         sharedLibs("eu.xenit.logging:json-logging:${jsonLoggingVersion}") {
             transitive = false
@@ -82,7 +85,9 @@ subprojects {
         test {
             java {
                 srcDir file("$project.parent.projectDir/src/shared/test/java")
-
+                if (tomcatVersion.contains("10")) {
+                    srcDir file("$project.projectDir/src/test/java")
+                }
             }
             resources {
                 srcDir file("$project.parent.projectDir/src/shared/test/resources")
diff --git a/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/alfresco/tomcat/AlfrescoTomcatFactoryHelper.java b/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/alfresco/tomcat/AlfrescoTomcatFactoryHelper.java
@@ -63,7 +63,8 @@ public static void createSSLConnector(Tomcat tomcat, AlfrescoConfiguration alfre
                 tomcatConfiguration.getTomcatMaxThreads(),
                 tomcatConfiguration.getTomcatMaxHttpHeaderSize(),
                 tomcatConfiguration.getTomcatRelaxedPathChars(),
-                tomcatConfiguration.getTomcatRelaxedQueryChars()
+                tomcatConfiguration.getTomcatRelaxedQueryChars(),
+                tomcatConfiguration.isRemoteIpValveEnabled()
         );
 
         SSLHostConfig sslHostConfig = new SSLHostConfig();
diff --git a/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/DefaultConfigurationProvider.java b/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/DefaultConfigurationProvider.java
@@ -22,6 +22,7 @@ public TomcatConfiguration getConfiguration(TomcatConfiguration baseConfiguratio
         baseConfiguration.setAllowCasualMultipartParsing(false);
         baseConfiguration.setAllowMultipleLeadingForwardSlashInPath(false);
         baseConfiguration.setCrossContext(false);
+        baseConfiguration.setRemoteIpValveEnabled(true);
         return baseConfiguration;
     }
 }
diff --git a/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/EnvironmentVariableConfigurationProvider.java b/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/EnvironmentVariableConfigurationProvider.java
@@ -14,6 +14,7 @@
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_BASE_DIR;
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_CACHE_MAX_SIZE;
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_CROSS_CONTEXT;
+import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_REMOTE_IP_VALVE_ENABLED;
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_MAX_HTTP_HEADER_SIZE;
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_MAX_THREADS;
 import static eu.xenit.alfresco.tomcat.embedded.config.EnvironmentVariables.TOMCAT_PORT;
@@ -50,6 +51,7 @@ public TomcatConfiguration getConfiguration(TomcatConfiguration baseConfiguratio
         setPropertyFromEnv(TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING, value -> baseConfiguration.setAllowCasualMultipartParsing(Boolean.parseBoolean(value)));
         setPropertyFromEnv(TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH, value -> baseConfiguration.setAllowMultipleLeadingForwardSlashInPath(Boolean.parseBoolean(value)));
         setPropertyFromEnv(TOMCAT_CROSS_CONTEXT, value -> baseConfiguration.setCrossContext(Boolean.parseBoolean(value)));
+        setPropertyFromEnv(TOMCAT_REMOTE_IP_VALVE_ENABLED, value -> baseConfiguration.setRemoteIpValveEnabled(Boolean.parseBoolean(value)));
         return baseConfiguration;
     }
 }
diff --git a/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/EnvironmentVariables.java b/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/EnvironmentVariables.java
@@ -22,6 +22,7 @@ public class EnvironmentVariables {
     public static final String TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING = "TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING";
     public static final String TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH = "TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH";
     public static final String TOMCAT_CROSS_CONTEXT = "TOMCAT_CROSS_CONTEXT";
+    public static final String TOMCAT_REMOTE_IP_VALVE_ENABLED = "TOMCAT_REMOTE_IP_VALVE_ENABLED";
     private EnvironmentVariables() {
     }
 
diff --git a/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/TomcatConfiguration.java b/tomcat-base/src/shared/main/java/eu/xenit/alfresco/tomcat/embedded/config/TomcatConfiguration.java
@@ -31,4 +31,5 @@ public class TomcatConfiguration {
     protected boolean allowCasualMultipartParsing;
     protected boolean allowMultipleLeadingForwardSlashInPath;
     protected boolean crossContext;
+    protected boolean remoteIpValveEnabled;
 }
diff --git a/tomcat-base/src/shared/test/java/eu/xenit/alfresco/tomcat/embedded/config/DefaultConfigurationProviderTest.java b/tomcat-base/src/shared/test/java/eu/xenit/alfresco/tomcat/embedded/config/DefaultConfigurationProviderTest.java
@@ -28,6 +28,7 @@ void testGetConfiguration() {
         expected.setAllowCasualMultipartParsing(false);
         expected.setAllowMultipleLeadingForwardSlashInPath(false);
         expected.setCrossContext(false);
+        expected.setRemoteIpValveEnabled(true);
         assertEquals(configuration, expected);
     }
 
diff --git a/tomcat-base/tomcat-embedded-10/src/main/java/eu/xenit/alfresco/tomcat/embedded/tomcat/TomcatFactory.java b/tomcat-base/tomcat-embedded-10/src/main/java/eu/xenit/alfresco/tomcat/embedded/tomcat/TomcatFactory.java
@@ -17,6 +17,7 @@
 import org.apache.catalina.connector.Connector;
 import org.apache.catalina.core.StandardContext;
 import org.apache.catalina.startup.Tomcat;
+import org.apache.catalina.valves.RemoteIpValve;
 import org.apache.catalina.webresources.DirResourceSet;
 import org.apache.catalina.webresources.StandardRoot;
 
@@ -37,7 +38,8 @@ public static Connector getConnector(
             int maxThreads,
             int maxHttpHeaderSize,
             String relaxedPathChars,
-            String relaxedQueryChars) {
+            String relaxedQueryChars,
+            boolean isRemoteIpValveEnabled) {
         Connector connector = new Connector(protocol);
         connector.setPort(port);
         connector.setProperty("connectionTimeout", "240000");
@@ -49,11 +51,25 @@ public static Connector getConnector(
         connector.setProperty("relaxedQueryChars", relaxedQueryChars);
         connector.setScheme(scheme);
         Service service = tomcat.getService();
+        if (isRemoteIpValveEnabled) {
+            RemoteIpValve remoteIpValve = createRemoteIpValve();
+            tomcat.getEngine().getPipeline().addValve(remoteIpValve);
+        }
         service.setContainer(tomcat.getEngine());
         connector.setService(service);
         return connector;
     }
 
+    private static RemoteIpValve createRemoteIpValve() {
+        RemoteIpValve remoteIpValve = new RemoteIpValve();
+        remoteIpValve.setRemoteIpHeader("X-Forwarded-For");
+        remoteIpValve.setProtocolHeader("X-Forwarded-Proto");
+        remoteIpValve.setHostHeader("Host");
+        remoteIpValve.setPortHeader("X-Forwarded-Port");
+
+        return remoteIpValve;
+    }
+
     private TomcatConfiguration getConfiguration() {
         return configuration;
     }
@@ -147,7 +163,8 @@ private void createDefaultConnector(Tomcat tomcat) {
                 getConfiguration().getTomcatMaxThreads(),
                 getConfiguration().getTomcatMaxHttpHeaderSize(),
                 getConfiguration().getTomcatRelaxedPathChars(),
-                getConfiguration().getTomcatRelaxedQueryChars()
+                getConfiguration().getTomcatRelaxedQueryChars(),
+                getConfiguration().isRemoteIpValveEnabled()
         );
         connector.setRedirectPort(getConfiguration().getTomcatSslPort());
         tomcat.setConnector(connector);
diff --git a/tomcat-base/tomcat-embedded-10/src/test/java/valves/RemoteIpValveTests.java b/tomcat-base/tomcat-embedded-10/src/test/java/valves/RemoteIpValveTests.java
@@ -0,0 +1,78 @@
+package valves;
+
+import eu.xenit.alfresco.tomcat.embedded.config.DefaultConfigurationProvider;
+import eu.xenit.alfresco.tomcat.embedded.config.TomcatConfiguration;
+import eu.xenit.alfresco.tomcat.embedded.tomcat.TomcatFactory;
+import io.restassured.RestAssured;
+import io.restassured.parsing.Parser;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.apache.catalina.Context;
+import org.apache.catalina.LifecycleException;
+import org.apache.catalina.startup.Tomcat;
+import org.junit.jupiter.api.Test;
+
+import java.io.File;
+import java.io.IOException;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+class RemoteIpValveTests {
+    @Test
+    void testRemoteIpValveHeadersConfig() throws IOException, LifecycleException {
+        TomcatConfiguration configuration = new DefaultConfigurationProvider().getConfiguration();
+        configuration.setTomcatBaseDir("tomcat-base");
+        TomcatFactory tomcatFactory = new TomcatFactory(configuration);
+        Tomcat tomcat = tomcatFactory.getTomcat();
+
+        Context context = tomcat.addContext("/", new File(".").getAbsolutePath());
+        Tomcat.addServlet(context, "testServlet", new HttpServlet() {
+            @Override
+            protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
+                String scheme = req.getScheme();
+                assertEquals("https", scheme);
+                String serverName = req.getServerName();
+                assertEquals("test.host.eu", serverName);
+                int serverPort = req.getServerPort();
+                assertEquals(443, serverPort);
+                String remoteHost = req.getRemoteHost();
+                assertEquals("81.82.199.31", remoteHost);
+                String remoteAddr = req.getRemoteAddr();
+                assertEquals("81.82.199.31", remoteAddr);
+
+                String jsonResponseString = String.format(
+                        "{\"request.scheme\":\"%s\",\"request.serverName\":\"%s\",\"request.serverPort\":%d,\"request.remoteHost\":\"%s\",\"request.remoteAddr\":\"%s\"}",
+                        scheme, serverName, serverPort, remoteHost, remoteAddr
+                );
+
+                resp.setContentType("application/json; charset=UTF-8");
+                resp.setCharacterEncoding("UTF-8");
+                resp.getWriter().write(jsonResponseString);
+            }
+        });
+        context.addServletMappingDecoded("/test", "testServlet");
+
+        tomcat.start();
+
+        RestAssured.defaultParser = Parser.JSON;
+        String responseString = RestAssured.given()
+                .log().method()
+                .log().uri()
+                .log().headers()
+                .header("X-Forwarded-For", "81.82.199.31")
+                .header("X-Forwarded-Proto", "https")
+                .header("Host", "test.host.eu")
+                .header("X-Forwarded-Port", 443)
+                .when()
+                .get("/test")
+                .then()
+                .log().status()
+                .log().ifValidationFails()
+                .log().body(false)
+                .statusCode(200)
+                .extract().asString();
+
+        System.out.println("Raw Response Body: " + responseString);
+    }
+}
diff --git a/tomcat-base/tomcat-embedded-9/src/main/java/eu/xenit/alfresco/tomcat/embedded/tomcat/TomcatFactory.java b/tomcat-base/tomcat-embedded-9/src/main/java/eu/xenit/alfresco/tomcat/embedded/tomcat/TomcatFactory.java
@@ -29,7 +29,7 @@ public TomcatFactory(TomcatConfiguration configuration) {
         this.configuration = configuration;
     }
 
-    public static Connector getConnector(Tomcat tomcat, String protocol, int port, boolean sslEnabled, String scheme, int maxThreads, int maxHttpHeaderSize, String relaxedPathChars, String relaxedQueryChars) {
+    public static Connector getConnector(Tomcat tomcat, String protocol, int port, boolean sslEnabled, String scheme, int maxThreads, int maxHttpHeaderSize, String relaxedPathChars, String relaxedQueryChars, boolean isRemoteIpValveEnabled) {
         Connector connector = new Connector(protocol);
         connector.setPort(port);
         connector.setProperty("connectionTimeout", "240000");
@@ -124,7 +124,8 @@ private void createDefaultConnector(Tomcat tomcat) {
                 getConfiguration().getTomcatMaxThreads(),
                 getConfiguration().getTomcatMaxHttpHeaderSize(),
                 getConfiguration().getTomcatRelaxedPathChars(),
-                getConfiguration().getTomcatRelaxedQueryChars()
+                getConfiguration().getTomcatRelaxedQueryChars(),
+                false
         );
         connector.setRedirectPort(getConfiguration().getTomcatSslPort());
         tomcat.setConnector(connector);

Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@ public TomcatConfiguration getConfiguration(TomcatConfiguration baseConfiguratio`
`22`	`22`	`baseConfiguration.setAllowCasualMultipartParsing(false);`
`23`	`23`	`baseConfiguration.setAllowMultipleLeadingForwardSlashInPath(false);`
`24`	`24`	`baseConfiguration.setCrossContext(false);`
	`25`	`+ baseConfiguration.setRemoteIpValveEnabled(true);`
`25`	`26`	`return baseConfiguration;`
`26`	`27`	`}`
`27`	`28`	`}`
Original file line number	Diff line number	Diff line change
`@@ -22,6 +22,7 @@ public class EnvironmentVariables {`
`22`	`22`	`public static final String TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING = "TOMCAT_ALLOW_CASUAL_MULTIPART_PARSING";`
`23`	`23`	`public static final String TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH = "TOMCAT_ALLOW_MULTIPLE_LEADING_FORWARD_SLASH_IN_PATH";`
`24`	`24`	`public static final String TOMCAT_CROSS_CONTEXT = "TOMCAT_CROSS_CONTEXT";`
	`25`	`+ public static final String TOMCAT_REMOTE_IP_VALVE_ENABLED = "TOMCAT_REMOTE_IP_VALVE_ENABLED";`
`25`	`26`	`private EnvironmentVariables() {`
`26`	`27`	`}`
`27`	`28`
Original file line number	Diff line number	Diff line change
`@@ -31,4 +31,5 @@ public class TomcatConfiguration {`
`31`	`31`	`protected boolean allowCasualMultipartParsing;`
`32`	`32`	`protected boolean allowMultipleLeadingForwardSlashInPath;`
`33`	`33`	`protected boolean crossContext;`
	`34`	`+ protected boolean remoteIpValveEnabled;`
`34`	`35`	`}`
Original file line number	Diff line number	Diff line change
`@@ -28,6 +28,7 @@ void testGetConfiguration() {`
`28`	`28`	`expected.setAllowCasualMultipartParsing(false);`
`29`	`29`	`expected.setAllowMultipleLeadingForwardSlashInPath(false);`
`30`	`30`	`expected.setCrossContext(false);`
	`31`	`+ expected.setRemoteIpValveEnabled(true);`
`31`	`32`	`assertEquals(configuration, expected);`
`32`	`33`	`}`
`33`	`34`