> On 2025 Nov 12, at 13:06, James H. H. Lampert > <[email protected]> wrote: > > On 11/12/25 10:55 AM, Chuck Caldarale wrote: > >> The valve configurations for webapps included with Tomcat 9.0.110 and >> prior versions were for RemoteAddrValve; for 9.0.111 and beyond, >> they’re for RemoteCIDRValve. As previously noted, the syntax rules >> are different for these valves. > > Curiouser and curiouser: I see the change from RemoteAddrFilter and > RemoteAddrValve to RemoteCIDRFilter and RemoteCIDRValve in the changelog. > > But what was the reason for the change? And was it announced (because if it > was, I missed it entirely)? > > We routinely add our IP addresses, because (1) IBM Midrange boxes don't have > web browsers, and neither do cloud Linux boxes, and (2) even if they did, we > don't have access to the physical boxes (other than our own on-site boxes).
The 9.0.111 release announcement included the following: - Add CIDR support to the RemoteIp[Filter|Valve] and deprecate the RemoteAddr[Filter|Valve] in favour of the RemoteCIDR[Filter|Valve] The discussion on the dev list was triggered by a PR, resulting in the deprecation of the ancient RemoteAddr* variants. The thread starts here: https://marc.info/?l=tomcat-dev&m=175913810815171&w=2 - Chuck
