DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #23 from Francis Galiegue fgalie...@gmail.com 2011-10-20 09:31:34 UTC --- Comments? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #22 from Francis Galiegue fgalie...@gmail.com 2011-10-16 08:19:47 UTC --- Well, I can now confirm that both the filter and valve work, however the messages I log are NOT shown at all. As to exceptions, when running the valve, they are not raised AT ALL. Error messages are shown, ie: SEVERE: 1127.0.0.1: invalid address specification but only for the Valve :( Is that the expected behavior? If so, then my patch is basically ready... -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #21 from Francis Galiegue fgalie...@gmail.com 2011-10-15 11:03:31 UTC --- OK, I don't understand what is happening at all. The filter does work, exceptions are thrown, but nothing is logged with the default Tomcat log configuration, and a bad filter doesn't prevent the context from reloading! Is that expected? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 Francis Galiegue fgalie...@gmail.com changed: What|Removed |Added Attachment #27691|0 |1 is obsolete|| Attachment #27726|0 |1 is obsolete|| --- Comment #18 from Francis Galiegue fgalie...@gmail.com 2011-10-14 23:03:25 UTC --- Created attachment 27782 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27782 Version 0.1 of the patch Full patch over Apache's tomcat70 git repo (therefore over tomcat's trunk if I get it right). This patch addresses the following remarks raised on the devel mailing list: * .get*() now return a suitable input for .set*(); * as the process of filling lists for deny and allow is the same, for the filter and the valve, factorize it; * more comments in NetMask; * coding style issues; * javadoc; * throw IllegalArgumentException from the Valve and Filter if a wrongly formatted NetMask is passed in. Now, I have a problem which I cannot understand, wrt error handling... I use the base tar.gz as built by ant release, in output/release/v8.0.0-dev/bin/apache-tomcat-8.0.0-dev.tar.gz. I unarchive in a directory, do startup.sh, it starts. I then edit the web.xml so as to apply the RemoteCIDRFilter: Tomcat reloads the webapp, the filter applies. Then I edit web.xml so as to apply an ILLEGAL netmask: even though the base NetMask tests work (constructor refuses the input), when reloading the webapp, it seems that nothing is even LOGGED (I do log errors about bad netmasks) and the previous filter stays in place :/ What am I doing wrong? I have a list of TODOs but don't even want to mention that list before I understand what the problem is with the filter. Note: I have not debugged yet... I use IDEA, so if someone knows how to debug that I'd be happy. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #19 from Francis Galiegue fgalie...@gmail.com 2011-10-14 23:16:06 UTC --- Well, my filter is not the only one affected. I also added this to web.xml: filter filter-namehost/filter-name filter-classorg.apache.catalina.filters.RemoteHostFilter/filter-class init-param param-namedeny/param-name param-value$127.0.0.1/param-value /init-param /filter filter-mapping filter-namehost/filter-name url-pattern/*/url-pattern /filter-mapping Of course, the regex is invalid. BUT THE CONTEXT RELOADS!! -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #20 from Konstantin Kolinko knst.koli...@gmail.com 2011-10-15 03:02:36 UTC --- (In reply to comment #19) param-value$127.0.0.1/param-value Of course, the regex is invalid. BUT THE CONTEXT RELOADS!! The regex is valid. There is nothing syntactically wrong with it. It just does not match anything (because you expect some text after the end of string). %= java.util.regex.Pattern.compile($127.0.0.1) % compiles successfully without any exceptions. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #17 from Francis Galiegue fgalie...@gmail.com 2011-10-09 12:37:21 UTC --- Still waiting for input... -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #16 from Francis Galiegue fgalie...@gmail.com 2011-10-07 13:53:05 UTC --- Created attachment 27726 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27726 Tests for the NetMask class Here are the first tests for this class. Only errors at object initialization time for now. Can I have hints for error handling? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #15 from Francis Galiegue fgalie...@gmail.com 2011-10-06 07:34:50 UTC --- OK, I need advice. How should errors be handled and at which level? What should happen if one specified netmask is invalid? Should the Valve/Filter fail completely? What should be logged and how? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #10 from Francis Galiegue fgalie...@gmail.com 2011-10-05 09:22:33 UTC --- Created attachment 27694 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27694 Alternative netmask class, using byte arrays Here is another implementation using byte arrays only. I believe it is even faster than a string compare on exact byte matching, _and_ it doesn't get fooled by :::* addresses. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953
--- Comment #11 from Francis Galiegue fgalie...@gmail.com 2011-10-05 12:51:19
UTC ---
This crude test using the following code shows indeed that the byte array based
implementation is indeed MUCH faster:
private static final int COUNT = 5;
public static void main(final String[] args) throws UnknownHostException
{
final NetMask nm = new NetMask(22.3.25.8/24);
final NetMask2 nm2 = new NetMask2(22.3.25.8/24);
final InetAddress in1 = InetAddress.getByName(22.3.25.10),
in2 = InetAddress.getByName(cf83::ef:13:1),
in3 = InetAddress.getByName(12.143.110.1);
int i;
long start, end;
start = System.currentTimeMillis();
for (i = 0; i COUNT; i++) {
nm.matches(in1);
nm.matches(in2);
nm.matches(in3);
}
end = System.currentTimeMillis();
System.out.println(impl1: + (end - start));
start = System.currentTimeMillis();
for (i = 0; i COUNT; i++) {
nm2.matches(in1);
nm2.matches(in2);
nm2.matches(in3);
}
end = System.currentTimeMillis();
System.out.println(impl2: + (end - start));
}
Results:
impl1: 147
impl2: 11
So, it's definitely the byte-based class. I'll try and throw the string compare
into the mix and see how it fares for good measure.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
--- You are receiving this mail because: ---
You are the assignee for the bug.
-
To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org
For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #12 from Christopher Schultz ch...@christopherschultz.net 2011-10-05 14:21:03 UTC --- I like this NetMask implementation *much* better. It took me a while to convince myself that it was correct, but it looks good to me, now. :) There are only a few nits of coding style that I would change. I'll post an updated patch that includes this implementation. Did you get a chance to look at my patch? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #13 from Francis Galiegue fgalie...@gmail.com 2011-10-05 14:38:27 UTC --- (In reply to comment #12) I like this NetMask implementation *much* better. It took me a while to convince myself that it was correct, but it looks good to me, now. :) There are only a few nits of coding style that I would change. I'll post an updated patch that includes this implementation. Did you get a chance to look at my patch? Yes I did. But I'm really not convinced that string matching is a good idea. It may be for IPv4, but for IPv6 it will be a mess. If you remember, I've had the problem that ::1 wouldn't match because the address reported by request.getRemoteHost() (is it the name?) was actually 0:0:0:0:0:0:0:1, which means you have to write it all. Furthermore, it is quite easy to miss a :0 in the mix... I'll continue the work when I get time. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #14 from Christopher Schultz ch...@christopherschultz.net 2011-10-05 15:35:07 UTC --- (In reply to comment #13) But I'm really not convinced that string matching is a good idea. It may be for IPv4, but for IPv6 it will be a mess. I think you're right. With your faster implementation of NetMask, it makes this more reasonable. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #1 from Francis Galiegue fgalie...@gmail.com 2011-10-04 18:06:15 UTC --- Created attachment 27686 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27686 As title says -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #2 from Francis Galiegue fgalie...@gmail.com 2011-10-04 18:06:30 UTC --- Created attachment 27687 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27687 As title says -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 Francis Galiegue fgalie...@gmail.com changed: What|Removed |Added Attachment #27686|As title says |Netmask class description|| -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 Francis Galiegue fgalie...@gmail.com changed: What|Removed |Added Attachment #27687|As title says |Netmask filter description|| -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #3 from Francis Galiegue fgalie...@gmail.com 2011-10-04 18:07:25 UTC --- Created attachment 27688 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27688 Netmask valve -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #4 from Francis Galiegue fgalie...@gmail.com 2011-10-04 18:46:53 UTC --- Created attachment 27689 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27689 Whole patch (git diff origin/trunk..) -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #5 from Christopher Schultz ch...@christopherschultz.net 2011-10-04 20:52:36 UTC --- I might make this filter/valve a bit more generic: there's no reason to go through all the trouble of doing an InetAddress lookup, creating a BigInteger, shifting it, and then comparing it if there is no CIDR spec in the IP specified by the configuration. You could create a fairly generic IP-matching interface and then two implementations: one simple string-equals one and a more complicated netmask-matching one. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #6 from Francis Galiegue fgalie...@gmail.com 2011-10-04 21:05:25 UTC --- (In reply to comment #5) I might make this filter/valve a bit more generic: there's no reason to go through all the trouble of doing an InetAddress lookup, creating a BigInteger, shifting it, and then comparing it if there is no CIDR spec in the IP specified by the configuration. Well, the remote host is always an IP address in string form, so there is no lookup performed at all. When supplied with an IP address in string form, InetAddress.getByName() only validates the validity of the IP address (whether it be IPv4 and IPv6). Also, the current implementation also does simple IP matching, since if there is no CIDR the right shift is 0, thus an exact match is required. More to the point, I don't see how I could make this generic? It would mean dispatching at some point, but how? -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #7 from Christopher Schultz ch...@christopherschultz.net 2011-10-04 21:15:43 UTC --- This code is executed unconditionally: final InetAddress addr = InetAddress.getByName(property); for (final NetMask nm: deny) if (nm.matches(addr)) NetMask.matches does a new BigInteger().shiftRight (though the shift should be 0 bytes, and so should be pretty quick). Remember that this code may be executed for every request, include, and forward, so you'd better take every opportunity to reduce the amount of time required to run it. In terms of making it more generic, what I meant was that you would be able to quickly match exact-matches (using a simple String.equals) and only do the extra work when there was a netmask to actually check. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 --- Comment #8 from Francis Galiegue fgalie...@gmail.com 2011-10-04 21:30:27 UTC --- (In reply to comment #7) This code is executed unconditionally: final InetAddress addr = InetAddress.getByName(property); for (final NetMask nm: deny) if (nm.matches(addr)) NetMask.matches does a new BigInteger().shiftRight (though the shift should be 0 bytes, and so should be pretty quick). Remember that this code may be executed for every request, include, and forward, so you'd better take every opportunity to reduce the amount of time required to run it. Good point. I was tempted at first to do a byte[] manipulation but found BigInteger to be very practical, especially since it requires the byte array to be in network order -- which is what I wanted. I'll have that second implementation working and compare the results in speed. In terms of making it more generic, what I meant was that you would be able to quickly match exact-matches (using a simple String.equals) and only do the extra work when there was a netmask to actually check. That's true, but consider :::127.0.0.1: it actually is the same than 127.0.0.1. An .equals() won't work here. OK, that's going far, but still. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 Christopher Schultz ch...@christopherschultz.net changed: What|Removed |Added Attachment #27686|0 |1 is obsolete|| Attachment #27687|0 |1 is obsolete|| Attachment #27688|0 |1 is obsolete|| Attachment #27689|0 |1 is obsolete|| --- Comment #9 from Christopher Schultz ch...@christopherschultz.net 2011-10-04 21:53:31 UTC --- Created attachment 27691 -- https://issues.apache.org/bugzilla/attachment.cgi?id=27691 Unified patch for RemoteAddrNetmaskFilter Take a look at this implementation (Filter only, for now), which I believe is a bit simpler and also allows fast string-matching when there is no / in the allow/deny spec. -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
DO NOT REPLY [Bug 51953] Proposal: netmask filtering valve and filter
https://issues.apache.org/bugzilla/show_bug.cgi?id=51953 Mark Thomas ma...@apache.org changed: What|Removed |Added Severity|normal |enhancement -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email --- You are receiving this mail because: --- You are the assignee for the bug. - To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
