Thanks for the update
I enabled logging for remoteIpFilter like: org.apache.catalina.filters.RemoteIpFilter.level = ALL I do get matches when visiting. Is it also possible to print the list of IP’s? I have no clue how to do that. Regards, Harrie On 5 January 2018 at 16:32, Felix Schumacher <felix.schumac...@internetallee.de <mailto:felix.schumac...@internetallee.de> > wrote: Am 05.01.2018 um 15:43 schrieb Harrie Robins: All clear. I apologize, I was in fact not masking the backslashes, I did a wrong copy paste from the pattern I was using in my test I tested the following 2 patterns: ^103\.21\.(2(4[4-7]))\.([0- 9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$|^103\.22 \.(2(0[0-3]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$ 103\.21\.(2(4[4-7]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|103\.22\.(2(0[0-3]))\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])) The regex can be "simplified" to 103\.21\.24[4-7]\.(1?[1-9]?[0-9]|2([0-4][0-9]|5[0-5]))|103\.22\.20[0-3]\.(1?[1-9]?[0-9]|2([0-4][0-9]|5[0-5])) or even 103\.(21\.24[4-7]|22\.20[0-3])\.(1?[1-9]?[0-9]|2([0-4][0-9]|5[0-5])) But it looks OK, if you want to match IPs from 103.21.244.x-103.21.247.x and 103.22.200.x-103.22.203.x Have you enabled debug-logs for the RemoteIpValve? It should print out the IP it tries to match. Regards, Felix Regards, Harrie On 5 January 2018 at 14:46, Felix Schumacher < felix.schumac...@internetallee.de <mailto:felix.schumac...@internetallee.de> > wrote: Am 05.01.2018 um 09:47 schrieb Harrie Robins: Hi Mark, our tomcat application server are fronted by 1. cloudflare, and 2. amazon load balancer. In apache there is mod_remote IP and I can simply put in CIDR range: https://www.cloudflare.com/ips/ that will swallow all those IP and will get the correct IP to tomcat. In Tomcat I need https://tomcat.apache.org/tomcat-8.5-doc/api/org/apache/cata lina/valves/RemoteIpValve.html which does not accept CIDR range however. I wrote a regex to match all the addresses and it works, it's matching way to many addresses however so I rewrote the pattern. My new pattern is not functioning however, so I tested then pattern in a small application. In my test I made a list of all addresses in this range: ^103\\.21\\.(2(4[4-7]))\\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2( [0-4][0-9]|5[0-5]))$|^103\\.22\\.(2(0[0-3]))\\.([0-9]|[1- 9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$ If you configure the valve through the internalProxies attribute, you are using 'real' strings and don't need to mask the backslashes as you would have to do with java strings. When you look at the documentation, you will find no double backslashes there.|||| And regarding the usage of the anchors '^' and '$'. They are not needed, either. Tomcat will use match instead of find and thus they are implicitly added. Regards, Felix || I matched all these addresses and it works. When I set in tomcat however it does not, I have no understanding why not? Hope you understand what I am trying to do. thanks On 2 January 2018 at 19:33, Mark Thomas <ma...@apache.org <mailto:ma...@apache.org> > wrote: On 02/01/18 09:50, Harrie Robins wrote: I'm still having problems with matching my pattern. Right now I'm feeding the following to internalProxies: ^103\\.21\\.(2(4[4-7]))\\.([0-9]|[1-9][0-9]|1([0-9][0-9])|2( [0-4][0-9]|5[0-5]))$|^103\\.22\\.(2(0[0-3]))\\.([0-9]|[1- 9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))$ I created a list of all involved IP addresses and matched those IP addresses: java.util.regex.Matcher / java.util.regex.Pattern, please see https://pastebin.com/Lija7n9k All addresses from the list I created are matching, just not in tomcat. What is the value of the remote IP address that is failing to match? You might want to look at writing a short custom Valve to log that and insert it into the Pipeline ahead of the RemoteIpValve. Another option would be to simply remove the RemoteIpValve and write a simple servlet that logs the remote IP. Mark Regards, Harrie -----Oorspronkelijk bericht----- Van: Harrie Robins [mailto:har...@eyequestion.nl <mailto:har...@eyequestion.nl> ] Verzonden: 21 December 2017 09:55 Aan: 'Tomcat Users List' <users@tomcat.apache.org <mailto:users@tomcat.apache.org> > Onderwerp: RE: internalProxies regex This makes perfect sense. I tested my regex, just against wrong engine. Thanks for pointing me in the right direction -----Oorspronkelijk bericht----- Van: Konstantin Kolinko [mailto:knst.koli...@gmail.com <mailto:knst.koli...@gmail.com> ] Verzonden: 20 December 2017 15:19 Aan: Tomcat Users List <users@tomcat.apache.org <mailto:users@tomcat.apache.org> > Onderwerp: Re: internalProxies regex 2017-12-20 11:37 GMT+03:00 Harrie Robins <har...@eyequestion.nl <mailto:har...@eyequestion.nl> >: Hello everyone, I have a question about the remoteipvalve in tomcat 8.5: https://tomcat.apache.org/tomcat-8.5-doc/api/org/apache/catalina/valve s/Remo teIpValve.html internalProxies Regular expression that matches the IP addresses of internal proxies. If they appear in the remoteIpHeader value, they will be trusted and will not appear in the proxiesHeader value RemoteIPInternalProxy Regular expression (in the syntax supported by java.util.regex) 10\.\d{1,3}\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}| 169\.254\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}| 172\.1[6-9]{1}\.\d{1,3}\.\d{1,3}|172\.2[0-9]{1}\.\d{1,3}\.\d{1,3}| 172\.3[0-1]{1}\.\d{1,3}\.\d{1,3} By default, 10/8, 192.168/16, 169.254/16, 127/8 and 172.16/12 are allowed. I need to convert some CIDR ranges to regex: my concern is that /d{1,3} wil match too many (non exist) addresses 103\.21\.24\d[4-7]\.\d[0-9]\d{1,3}|103\.22\.20\d[0-3]\.\d[0-9]\d{1,3}| 103\.3 1\.\d[4-7]\.\d[0-9]\d{1,3} So I re-wrote using capture groups, below does not function however, and I assume it is due to OR (|) which tomcat will affectively see as a new entry? So I tried escaping, but I cannot get it to work: 103\.21\.(2(4[4-7]))\.([0-9]\|[1-9][0-9]\|1([0-9][0-9])\|2([0-4][0-9]\ |5[0-5 ]))|103\.22\.(2(0[0-3]))\.([0-9]\|[1-9][0-9]\|1([0-9][0-9])\|2([0-4][0 -9]\|5 [0-5])) Your assumption that "tomcat will affectively see as a new entry" is wrong. The string is used as whole to initialize a java.util.regex.Pattern(). Tomcat does not split it. You may write a simple program / junit test to test how java.util.regex.Pattern() processes your value. Or you may run Tomcat with debugger, https://wiki.apache.org/tomcat/FAQ/Developing#Debugging https://wiki.apache.org/tomcat/FAQ/Troubleshooting_ and_Diagnostics#Common_Troubleshooting_Scenario AFAIK, '\|' in a regular expression will be interpreted as expecting literal '|' character in the matched string. No IP address has this character so none will match. Best regards, Konstantin Kolinko --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org <mailto:users-unsubscr...@tomcat.apache.org> For additional commands, e-mail: users-h...@tomcat.apache.org <mailto:users-h...@tomcat.apache.org> --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org <mailto:users-unsubscr...@tomcat.apache.org> For additional commands, e-mail: users-h...@tomcat.apache.org <mailto:users-h...@tomcat.apache.org> --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org <mailto:users-unsubscr...@tomcat.apache.org> For additional commands, e-mail: users-h...@tomcat.apache.org <mailto:users-h...@tomcat.apache.org> --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org <mailto:users-unsubscr...@tomcat.apache.org> For additional commands, e-mail: users-h...@tomcat.apache.org <mailto:users-h...@tomcat.apache.org>
