* There are alternatives to a servlet based proxy such as Apache mod_proxy if that is available to you. However this * servlet is easily * customizable by Java, secure-able by your web application's security (e.g. spring-security), portable across servlet * engines, and is * embeddable into another web application. *
** Inspiration: http://httpd.apache.org/docs/2.0/mod/mod_proxy.html *
* * @author David Smiley dsmiley@mitre.org */ @SuppressWarnings({ "deprecation", "serial" }) public class ProxyServlet extends HttpServlet { /* INIT PARAMETER NAME CONSTANTS */ /** * A boolean parameter name to enable forwarding of the client IP */ public static final String P_FORWARDEDFOR = "forwardip"; /** * A boolean parameter name to keep HOST parameter as-is */ public static final String P_PRESERVEHOST = "preserveHost"; /** * A boolean parameter name to keep COOKIES as-is */ public static final String P_PRESERVECOOKIES = "preserveCookies"; /** * A String parameter name to match urls which content needs to be rewritten */ public static final String P_RESPONSE_URL_MATCHERS = "responseUrlMatchers"; /** * Patterns and replacements for replacing String in the response content, replaced with comma. Example: * "/asd/:/aaa/asd, /bbb/:/ccc/" */ public static final String P_RESPONSE_CONTENT_REWRITE_PAIRS = "responseContentRewritePairs"; /** * A String parameter name to skip response content types */ public static final String P_SKIP_RESPONSE_CONTENT_TYPES = "skipResponseContentTypes"; /** * A String parameter name to skip url matches */ public static final String P_SKIP_RESPONSE_URL_MATCHERS = "skipResponseUrlMatchers"; /** * A String parameter name to append params for given url matcher */ public static final String P_APPEND_URL_PARAMS = "appendUrlParams"; /** * A String parameter name to set additional headers for given url matcher */ public static final String P_SET_ADDITIONAL_HEADERS = "setAdditionalHeaders"; public static final String P_REQUEST_URL_MATCHERS = "requestUrlMatchers"; public static final String P_REQUEST_CONTENT_REWRITE_PAIRS = "requestContentRewritePairs"; public static final String JSESSIONID = "JSESSIONID"; public static final String PENTAHO_LOGOUT = "/Logout"; /** * The parameter name for the target (destination) URI to proxy to. */ protected static final String P_TARGET_URI = "targetUri"; protected static final String ATTR_TARGET_URI = ProxyServlet.class.getSimpleName() + ".targetUri"; protected static final String ATTR_TARGET_HOST = ProxyServlet.class.getSimpleName() + ".targetHost"; /** * These are the "hop-by-hop" headers that should not be copied. * http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html I use an * HttpClient HeaderGroup class instead of Set<String> because this approach does case insensitive lookup * faster. */ protected static final HeaderGroup hopByHopHeaders; protected static final BitSet asciiQueryChars; static { hopByHopHeaders = new HeaderGroup(); final String[] headers = new String[] { "Connection", "Keep-Alive", "Proxy-Authenticate", "Proxy-Authorization", "TE", "Trailers", "Transfer-Encoding", "Upgrade" }; for (final String header : headers) { hopByHopHeaders.addHeader(new BasicHeader(header, null)); } } static { asciiQueryChars = new BitSet(128); IntStream.rangeClosed('a', 'z').forEach(asciiQueryChars::set); IntStream.rangeClosed('A', 'Z').forEach(asciiQueryChars::set); IntStream.rangeClosed('0', '9').forEach(asciiQueryChars::set); "_-!.~'()*,;:$&+=?/[]@".chars().forEach(asciiQueryChars::set); asciiQueryChars.set('%');// leave existing percent escapes in place } /** * Logger instance. */ public final Logger logger = LogManager.getLogger(ProxyServlet.class); /** * List containing urls which need to be matched for rewriting strings in the content. */ protected final List*
* Unfortunately, an incoming URI sometimes has characters disallowed by the spec. HttpClient insists that the * outgoing proxied request * has a valid URI because it uses Java's {@link URI}. To be more forgiving, we must escape the problematic * characters. See the URI * class for the spec. * * @param in * example: name=value&foo=bar#fragment */ protected static CharSequence encodeUriQuery(CharSequence in) { // Note that I can't simply use URI.java to encode because it will escape pre-existing escaped things. StringBuilder outBuf = null; for (int i = 0; i < in.length(); i++) { char c = in.charAt(i); boolean escape = true; if (c < 128) { if (asciiQueryChars.get(c)) { escape = false; } } else if (!Character.isISOControl(c) && !Character.isSpaceChar(c)) {// not-ascii escape = false; } if (!escape) { if (outBuf != null) { outBuf.append(c); } } else { // escape if (outBuf == null) { outBuf = new StringBuilder(in.length() + 5 * 3); outBuf.append(in, 0, i); } try (Formatter formatter = new Formatter(outBuf)) { // leading %, 0 padded, width 2, capital hex formatter.format("%%%02X", (int) c); } } } return outBuf != null ? outBuf : in; } @Override public String getServletInfo() { return "A proxy servlet by David Smiley, dsmiley@apache.org"; } protected String getTargetUri(HttpServletRequest servletRequest) { return (String) servletRequest.getAttribute(ATTR_TARGET_URI); } protected HttpHost getTargetHost(HttpServletRequest servletRequest) { return (HttpHost) servletRequest.getAttribute(ATTR_TARGET_HOST); } /** * Reads a configuration parameter. By default it reads servlet init parameters but it can be overridden. */ protected String getConfigParam(String key) { return getServletConfig().getInitParameter(key); } @Override public void init() throws ServletException { initMutableInstanceFields(); String doForwardIPString = getConfigParam(P_FORWARDEDFOR); if (doForwardIPString != null) { mutableInstanceFields.put("doForwardIP", Boolean.parseBoolean(doForwardIPString)); } String preserveHostString = getConfigParam(P_PRESERVEHOST); if (preserveHostString != null) { mutableInstanceFields.put("doPreserveHost", Boolean.parseBoolean(preserveHostString)); } String preserveCookiesString = getConfigParam(P_PRESERVECOOKIES); if (preserveCookiesString != null) { mutableInstanceFields.put("doPreserveCookies", Boolean.parseBoolean(preserveCookiesString)); } // make sure that parameters are not null skipResponseContentTypes.addAll(parseCsvAsList(getConfigParam(P_SKIP_RESPONSE_CONTENT_TYPES))); responseContentRewritePairs.addAll(parseCsvAsList(getConfigParam(P_RESPONSE_CONTENT_REWRITE_PAIRS))); responseUrlMatchers.addAll(parseCsvAsList(getConfigParam(P_RESPONSE_URL_MATCHERS))); skipResponseUrlMatchers.addAll(parseCsvAsList(getConfigParam(P_SKIP_RESPONSE_URL_MATCHERS))); appendUrlParams.addAll(parseCsvAsList(getConfigParam(P_APPEND_URL_PARAMS))); additionalHeaders.addAll(parseCsvAsList(getConfigParam(P_SET_ADDITIONAL_HEADERS))); requestUrlMatchers.addAll(parseCsvAsList(getConfigParam(P_REQUEST_URL_MATCHERS))); requestContentRewritePairs.addAll(parseCsvAsList(getConfigParam(P_REQUEST_CONTENT_REWRITE_PAIRS))); initTarget();// sets target* HttpParams hcParams = new BasicHttpParams(); hcParams.setParameter(ClientPNames.COOKIE_POLICY, CookiePolicy.IGNORE_COOKIES); hcParams.setBooleanParameter(ClientPNames.HANDLE_REDIRECTS, false); // See #70 readConfigParam(hcParams, ClientPNames.HANDLE_REDIRECTS, Boolean.class); mutableInstanceFields.put("proxyClient", createHttpClient(hcParams)); } protected void initTarget() throws ServletException { mutableInstanceFields.put("targetUri", getConfigParam(P_TARGET_URI)); if (mutableInstanceFields.get("targetUri") == null) { throw new ServletException(P_TARGET_URI + " is required."); } // test it's valid URI targetUriObj = null; try { targetUriObj = new URI((String) mutableInstanceFields.get("targetUri")); mutableInstanceFields.put("targetUriObj", targetUriObj); } catch (Exception e) { throw new ServletException("Trying to process targetUri init parameter: " + e, e); } mutableInstanceFields.put("targetHost", URIUtils.extractHost((URI) mutableInstanceFields.get("targetUriObj"))); } /** * Called from {@link #init(javax.servlet.ServletConfig)}. HttpClient offers many opportunities for customization. * By default, * * SystemDefaultHttpClient is used if available, otherwise it falls back to: *
* *
* new DefaultHttpClient(new ThreadSafeClientConnManager(), hcParams)
*
*
* SystemDefaultHttpClient uses PoolingClientConnectionManager. In any case, it should be thread-safe.
*/
protected HttpClient createHttpClient(HttpParams hcParams)
{
try
{
// as of HttpComponents v4.2, this class is better since it uses System
// Properties:
Class clientClazz = Class.forName("org.apache.http.impl.client.SystemDefaultHttpClient");
Constructor constructor = clientClazz.getConstructor(HttpParams.class);
return (HttpClient) constructor.newInstance(hcParams);
}
catch (ClassNotFoundException e)
{
// no problem; use v4.1 below
}
catch (Exception e)
{
throw new RuntimeException(e);
}
// Fallback on using older client:
return new DefaultHttpClient(new ThreadSafeClientConnManager(), hcParams);
}
/**
* Reads a servlet config parameter by the name {@code hcParamName} of type {@code type}, and set it in
* {@code hcParams}.
*/
protected void readConfigParam(HttpParams hcParams, String hcParamName, Class type)
{
String val_str = getConfigParam(hcParamName);
if (val_str == null)
{
return;
}
Object val_obj;
if (type == String.class)
{
val_obj = val_str;
}
else
{
try
{
// noinspection unchecked
val_obj = type.getMethod("valueOf", String.class).invoke(type, val_str);
}
catch (Exception e)
{
throw new RuntimeException(e);
}
}
hcParams.setParameter(hcParamName, val_obj);
}
@Override
public void destroy()
{
// As of HttpComponents v4.3, clients implement closeable
HttpClient proxyClient = (HttpClient) mutableInstanceFields.get("proxyClient");
if (proxyClient instanceof Closeable)
{// TODO AutoCloseable in Java 1.6
try
{
((Closeable) proxyClient).close();
}
catch (IOException e)
{
log("While destroying servlet, shutting down HttpClient: " + e, e);
}
}
else
{
// Older releases require we do this:
if (proxyClient != null)
{
proxyClient.getConnectionManager().shutdown();
}
}
super.destroy();
}
@Override
protected void service(HttpServletRequest servletRequest, HttpServletResponse servletResponse) throws ServletException, IOException
{
// initialize request attributes from caches if unset by a subclass by this point
if (servletRequest.getAttribute(ATTR_TARGET_URI) == null)
{
servletRequest.setAttribute(ATTR_TARGET_URI, mutableInstanceFields.get("targetUri"));
}
if (servletRequest.getAttribute(ATTR_TARGET_HOST) == null)
{
servletRequest.setAttribute(ATTR_TARGET_HOST, mutableInstanceFields.get("targetHost"));
}
// Make the Request
// note: we won't transfer the protocol version because I'm not sure it would truly be compatible
String method = servletRequest.getMethod();
String proxyRequestUri = rewriteUrlFromRequest(servletRequest);
HttpRequest proxyRequest;
// spec: RFC 2616, sec 4.3: either of these two headers signal that there is a message body.
if (servletRequest.getHeader(HttpHeaders.CONTENT_LENGTH) != null || servletRequest.getHeader(HttpHeaders.TRANSFER_ENCODING) != null)
{
proxyRequest = newProxyRequestWithEntity(method, proxyRequestUri, servletRequest);
}
else
{
proxyRequest = new BasicHttpRequest(method, proxyRequestUri);
}
copyRequestHeaders(servletRequest, proxyRequest);
setAdditionalHeaders(servletRequest, proxyRequest);
setXForwardedForHeader(servletRequest, proxyRequest);
HttpResponse proxyResponse = null;
try
{
// Rewrites request content based on configured patterns before executing the request
if (requiresRequestContentRewrite(servletRequest.getRequestURI()))
{
rewriteRequestContent(proxyRequest);
}
// Execute the request
proxyResponse = doExecute(servletRequest, servletResponse, proxyRequest);
// Process the response:
// Pass the response code. This method with the "reason phrase" is deprecated but it's the
// only way to pass the reason along too.
int statusCode = proxyResponse.getStatusLine().getStatusCode();
// noinspection deprecation
servletResponse.setStatus(statusCode, proxyResponse.getStatusLine().getReasonPhrase());
// Copying response headers to make sure SESSIONID or other Cookie which comes from the remote
// server will be saved in client when the proxied url was redirected to another one.
// See issue [#51](https://github.com/mitre/HTTP-Proxy-Servlet/issues/51)
copyResponseHeaders(proxyResponse, servletRequest, servletResponse);
if (statusCode == HttpServletResponse.SC_NOT_MODIFIED)
{
// 304 needs special handling. See:
// http://www.ics.uci.edu/pub/ietf/http/rfc1945.html#Code304
// Don't send body entity/content!
servletResponse.setIntHeader(HttpHeaders.CONTENT_LENGTH, 0);
}
else
{
// Send the content to the client
copyResponseEntity(proxyResponse, servletResponse, proxyRequest, servletRequest);
}
}
catch (Exception e)
{
logger.error("Error in proxy servlet!", e);
// abort request, according to best practice with HttpClient
if (proxyRequest instanceof AbortableHttpRequest)
{
AbortableHttpRequest abortableHttpRequest = (AbortableHttpRequest) proxyRequest;
abortableHttpRequest.abort();
}
if (e instanceof RuntimeException)
{
throw (RuntimeException) e;
}
if (e instanceof ServletException)
{
throw (ServletException) e;
}
// noinspection ConstantConditions
if (e instanceof IOException)
{
throw (IOException) e;
}
throw new RuntimeException(e);
}
finally
{
// make sure the entire entity was consumed, so the connection is released
if (proxyResponse != null)
{
consumeQuietly(proxyResponse.getEntity());
// Note: Don't need to close servlet outputStream:
// http://stackoverflow.com/questions/1159168/should-one-call-close-on-httpservletresponse-getoutputstream-getwriter
}
}
}
protected HttpResponse doExecute(HttpServletRequest servletRequest, HttpServletResponse servletResponse, HttpRequest proxyRequest)
throws IOException
{
logger.debug("proxy [{} {}] -- [{}]", servletRequest.getMethod(), servletRequest.getRequestURI(),
proxyRequest.getRequestLine().getUri());
HttpClient proxyClient = (HttpClient) mutableInstanceFields.get("proxyClient");
return proxyClient.execute(getTargetHost(servletRequest), proxyRequest);
}
protected HttpRequest newProxyRequestWithEntity(String method, String proxyRequestUri, HttpServletRequest servletRequest)
throws IOException
{
HttpEntityEnclosingRequest eProxyRequest = new BasicHttpEntityEnclosingRequest(method, proxyRequestUri);
HttpEntity entity;
// because of reason that media type is form_url_encoded
// inputStream of the request is empty i.e. already consumed
// so we need to send those parameters to the proxyRequest
if (servletRequest.getContentType() != null &&
servletRequest.getContentType().contains(MediaType.APPLICATION_FORM_URLENCODED_VALUE))
{
List