safebox/guacamole-client
4
0
Fork 0
mirror of https://github.com/gyurix1968/guacamole-client.git synced 2025-09-06 13:17:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

GUACAMOLE-540: Move remote address processing to Credentials class for consistency.

Browse Source
This commit is contained in:
Nick Couchman
2018-05-15 13:43:39 -04:00
parent bc1dc41a7c
commit cbd77b52ae
5 changed files with 42 additions and 64 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/ModeledUserContext.java
View File

@@ -137,7 +137,7 @@ public class ModeledUserContext extends RestrictedObject
userRecord = new ActivityRecordModel();
userRecord.setUsername(currentUser.getIdentifier());
userRecord.setStartDate(new Date());
userRecord.setRemoteHost(currentUser.getCredentials().getRemoteHostname());
userRecord.setRemoteHost(currentUser.getCredentials().getRemoteAddress());
// Insert record representing login
userRecordMapper.insert(userRecord);

60
extensions/guacamole-auth-jdbc/modules/guacamole-auth-jdbc-base/src/main/java/org/apache/guacamole/auth/jdbc/user/RemoteAuthenticatedUser.java
View File

@@ -19,9 +19,6 @@
package org.apache.guacamole.auth.jdbc.user;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import org.apache.guacamole.net.auth.AuthenticatedUser;
import org.apache.guacamole.net.auth.AuthenticationProvider;
import org.apache.guacamole.net.auth.Credentials;
@@ -45,60 +42,7 @@ public abstract class RemoteAuthenticatedUser implements AuthenticatedUser {
* The host from which this user authenticated.
*/
private final String remoteHost;
/**
* Regular expression which matches any IPv4 address.
*/
private static final String IPV4_ADDRESS_REGEX = "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})";
/**
* Regular expression which matches any IPv6 address.
*/
private static final String IPV6_ADDRESS_REGEX = "([0-9a-fA-F]*(:[0-9a-fA-F]*){0,7})";
/**
* Regular expression which matches any IP address, regardless of version.
*/
private static final String IP_ADDRESS_REGEX = "(" + IPV4_ADDRESS_REGEX + "|" + IPV6_ADDRESS_REGEX + ")";
/**
* Pattern which matches valid values of the de-facto standard
* "X-Forwarded-For" header.
*/
private static final Pattern X_FORWARDED_FOR = Pattern.compile("^" + IP_ADDRESS_REGEX + "(, " + IP_ADDRESS_REGEX + ")*$");
/**
* Derives the remote host of the authenticating user from the given
* credentials object. The remote host is derived from X-Forwarded-For
* in addition to the actual source IP of the request, and thus is not
* trusted. The derived remote host is really only useful for logging,
* unless the server is configured such that X-Forwarded-For is guaranteed
* to be trustworthy.
*
* @param credentials
* The credentials to derive the remote host from.
*
* @return
* The remote host from which the user with the given credentials is
* authenticating.
*/
private static String getRemoteHost(Credentials credentials) {
HttpServletRequest request = credentials.getRequest();
// Use X-Forwarded-For, if present and valid
String header = request.getHeader("X-Forwarded-For");
if (header != null) {
Matcher matcher = X_FORWARDED_FOR.matcher(header);
if (matcher.matches())
return matcher.group(1);
}
// If header absent or invalid, just use source IP
return request.getRemoteAddr();
}
/**
* Creates a new RemoteAuthenticatedUser, deriving the associated remote
* host from the given credentials.
@@ -113,7 +57,7 @@ public abstract class RemoteAuthenticatedUser implements AuthenticatedUser {
Credentials credentials) {
this.authenticationProvider = authenticationProvider;
this.credentials = credentials;
this.remoteHost = getRemoteHost(credentials);
this.remoteHost = credentials.getRemoteAddress();
}
@Override

38
guacamole-ext/src/main/java/org/apache/guacamole/net/auth/Credentials.java
View File

@@ -20,6 +20,8 @@
package org.apache.guacamole.net.auth;
import java.io.Serializable;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;
@@ -38,6 +40,27 @@ public class Credentials implements Serializable {
* Unique identifier associated with this specific version of Credentials.
*/
private static final long serialVersionUID = 1L;
/**
* Regular expression which matches any IPv4 address.
*/
private static final String IPV4_ADDRESS_REGEX = "([0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3})";
/**
* Regular expression which matches any IPv6 address.
*/
private static final String IPV6_ADDRESS_REGEX = "([0-9a-fA-F]*(:[0-9a-fA-F]*){0,7})";
/**
* Regular expression which matches any IP address, regardless of version.
*/
private static final String IP_ADDRESS_REGEX = "(" + IPV4_ADDRESS_REGEX + "|" + IPV6_ADDRESS_REGEX + ")";
/**
* Pattern which matches valid values of the de-facto standard
* "X-Forwarded-For" header.
*/
private static final Pattern X_FORWARDED_FOR = Pattern.compile("^" + IP_ADDRESS_REGEX + "(, " + IP_ADDRESS_REGEX + ")*$");
/**
* An arbitrary username.
@@ -124,6 +147,21 @@ public class Credentials implements Serializable {
*/
public void setRequest(HttpServletRequest request) {
this.request = request;
// Use X-Forwarded-For to get remote address, if present and valid
String header = request.getHeader("X-Forwarded-For");
if (header != null) {
Matcher matcher = X_FORWARDED_FOR.matcher(header);
if (matcher.matches())
setRemoteAddress(matcher.group(1));
}
// Header not present, just use remote address
else {
setRemoteAddress(request.getRemoteAddr());
}
setRemoteHostname(request.getRemoteHost());
}
/**

4
guacamole/src/main/java/org/apache/guacamole/rest/auth/TokenRESTService.java
View File

@@ -55,7 +55,7 @@ public class TokenRESTService {
* Logger for this class.
*/
private static final Logger logger = LoggerFactory.getLogger(TokenRESTService.class);
/**
* Service for authenticating users and managing their Guacamole sessions.
*/
@@ -122,8 +122,6 @@ public class TokenRESTService {
credentials.setPassword(password);
credentials.setRequest(request);
credentials.setSession(request.getSession(false));
credentials.setRemoteAddress(request.getRemoteAddr());
credentials.setRemoteHostname(request.getRemoteHost());
return credentials;

2
guacamole/src/main/java/org/apache/guacamole/rest/user/UserResource.java
View File

@@ -160,8 +160,6 @@ public class UserResource
credentials.setPassword(userPasswordUpdate.getOldPassword());
credentials.setRequest(request);
credentials.setSession(request.getSession(false));
credentials.setRemoteAddress(request.getRemoteAddr());
credentials.setRemoteHostname(request.getRemoteHost());
// Verify that the old password was correct
try {