org.mitre.dsmiley.httpproxy

Class ProxyServlet

java.lang.Object

javax.servlet.GenericServlet

javax.servlet.http.HttpServlet

org.mitre.dsmiley.httpproxy.ProxyServlet

All Implemented Interfaces:

Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

Direct Known Subclasses:

URITemplateProxyServlet

public class ProxyServlet
extends javax.servlet.http.HttpServlet

An HTTP reverse proxy/gateway servlet. It is designed to be extended for customization if desired. Most of the work is handled by Apache HttpClient.

There are alternatives to a servlet based proxy such as Apache mod_proxy if that is available to you. However this servlet is easily customizable by Java, secure-able by your web application's security (e.g. spring-security), portable across servlet engines, and is embeddable into another web application.

Inspiration: http://httpd.apache.org/docs/2.0/mod/mod_proxy.html

Author:

David Smiley dsmiley@mitre.org

See Also:

Serialized Form

Field Summary

Fields

Modifier and Type	Field and Description
protected static BitSet	asciiQueryChars
protected static String	ATTR_TARGET_HOST
protected static String	ATTR_TARGET_URI
protected boolean	doForwardIP
protected boolean	doLog
protected boolean	doSendUrlFragment User agents shouldn't send the url fragment but what if it does?
protected static org.apache.http.message.HeaderGroup	hopByHopHeaders These are the "hop-by-hop" headers that should not be copied.
static String	P_FORWARDEDFOR A boolean parameter name to enable forwarding of the client IP
static String	P_LOG A boolean parameter name to enable logging of input and target URLs to the servlet log.
protected static String	P_TARGET_URI The parameter name for the target (destination) URI to proxy to.
protected org.apache.http.HttpHost	targetHost
protected String	targetUri From the configured parameter "targetUri".
protected URI	targetUriObj

Constructor Summary

Constructors

Constructor and Description
ProxyServlet()

Method Summary

Methods

Modifier and Type	Method and Description
protected void	closeQuietly(Closeable closeable)
protected void	consumeQuietly(org.apache.http.HttpEntity entity) HttpClient v4.1 doesn't have the EntityUtils.consumeQuietly(org.apache.http.HttpEntity) method.
protected void	copyProxyCookie(javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse, org.apache.http.Header header) Copy cookie from the proxy to the servlet client.
protected void	copyRequestHeaders(javax.servlet.http.HttpServletRequest servletRequest, org.apache.http.HttpRequest proxyRequest) Copy request headers from the servlet client to the proxy request.
protected void	copyResponseEntity(org.apache.http.HttpResponse proxyResponse, javax.servlet.http.HttpServletResponse servletResponse) Copy response body data (the entity) from the proxy to the servlet client.
protected void	copyResponseHeaders(org.apache.http.HttpResponse proxyResponse, javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse) Copy proxied response headers back to the servlet client.
protected org.apache.http.client.HttpClient	createHttpClient(org.apache.http.params.HttpParams hcParams) Called from GenericServlet.init(javax.servlet.ServletConfig).
void	destroy()
protected boolean	doResponseRedirectOrNotModifiedLogic(javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse, org.apache.http.HttpResponse proxyResponse, int statusCode)
protected static CharSequence	encodeUriQuery(CharSequence in) Encodes characters in the query or fragment part of the URI.
protected String	getConfigParam(String key) Reads a configuration parameter.
protected String	getCookieNamePrefix() The string prefixing rewritten cookies.
protected org.apache.http.client.HttpClient	getProxyClient() The http client used.
protected String	getRealCookie(String cookieValue) Take any client cookies that were originally from the proxy and prepare them to send to the proxy.
String	getServletInfo()
String	getTargetUri() The target URI as configured.
protected String	getTargetUri(javax.servlet.http.HttpServletRequest servletRequest)
void	init()
protected void	initTarget()
protected void	readConfigParam(org.apache.http.params.HttpParams hcParams, String hcParamName, Class type) Reads a servlet config parameter by the name hcParamName of type type, and set it in hcParams.
protected String	rewriteQueryStringFromRequest(javax.servlet.http.HttpServletRequest servletRequest, String queryString)
protected String	rewriteUrlFromRequest(javax.servlet.http.HttpServletRequest servletRequest) Reads the request URI from servletRequest and rewrites it, considering targetUri.
protected String	rewriteUrlFromResponse(javax.servlet.http.HttpServletRequest servletRequest, String theUrl) For a redirect response from the target server, this translates theUrl to redirect to and translates it to one the original client can use.
protected void	service(javax.servlet.http.HttpServletRequest servletRequest, javax.servlet.http.HttpServletResponse servletResponse)

Methods inherited from class javax.servlet.http.HttpServlet

doDelete, doGet, doHead, doOptions, doPost, doPut, doTrace, getLastModified, service

Methods inherited from class javax.servlet.GenericServlet

getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletName, init, log, log

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

P_LOG

public static final String P_LOG

A boolean parameter name to enable logging of input and target URLs to the servlet log.

See Also:

Constant Field Values

P_FORWARDEDFOR

public static final String P_FORWARDEDFOR

A boolean parameter name to enable forwarding of the client IP

See Also:

Constant Field Values

P_TARGET_URI

protected static final String P_TARGET_URI

The parameter name for the target (destination) URI to proxy to.

See Also:

Constant Field Values

ATTR_TARGET_URI

protected static final String ATTR_TARGET_URI

ATTR_TARGET_HOST

protected static final String ATTR_TARGET_HOST

doLog

protected boolean doLog

doForwardIP

protected boolean doForwardIP

doSendUrlFragment

protected boolean doSendUrlFragment

User agents shouldn't send the url fragment but what if it does?

targetUri

protected String targetUri

From the configured parameter "targetUri".

targetUriObj

protected URI targetUriObj

targetHost

protected org.apache.http.HttpHost targetHost

hopByHopHeaders

protected static final org.apache.http.message.HeaderGroup hopByHopHeaders

These are the "hop-by-hop" headers that should not be copied. http://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html I use an HttpClient HeaderGroup class instead of Set because this approach does case insensitive lookup faster.

asciiQueryChars

protected static final BitSet asciiQueryChars

Constructor Detail

ProxyServlet

public ProxyServlet()

Method Detail

getServletInfo

public String getServletInfo()

Specified by:

getServletInfo in interface javax.servlet.Servlet

Overrides:

getServletInfo in class javax.servlet.GenericServlet

getTargetUri

protected String getTargetUri(javax.servlet.http.HttpServletRequest servletRequest)

getConfigParam

protected String getConfigParam(String key)

Reads a configuration parameter. By default it reads servlet init parameters but it can be overridden.

init

public void init()
          throws javax.servlet.ServletException

Overrides:

init in class javax.servlet.GenericServlet

Throws:

javax.servlet.ServletException

initTarget

protected void initTarget()
                   throws javax.servlet.ServletException

Throws:

javax.servlet.ServletException

createHttpClient

protected org.apache.http.client.HttpClient createHttpClient(org.apache.http.params.HttpParams hcParams)

Called from GenericServlet.init(javax.servlet.ServletConfig). HttpClient offers many opportunities for customization. By default, SystemDefaultHttpClient is used if available, otherwise it falls back to:

new DefaultHttpClient(new ThreadSafeClientConnManager(),hcParams)

SystemDefaultHttpClient uses PoolingClientConnectionManager. In any case, it should be thread-safe.

getProxyClient

protected org.apache.http.client.HttpClient getProxyClient()

The http client used.

See Also:

createHttpClient(HttpParams)

readConfigParam

protected void readConfigParam(org.apache.http.params.HttpParams hcParams,
                   String hcParamName,
                   Class type)

Reads a servlet config parameter by the name hcParamName of type type, and set it in hcParams.

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Servlet

Overrides:

destroy in class javax.servlet.GenericServlet

service

protected void service(javax.servlet.http.HttpServletRequest servletRequest,
           javax.servlet.http.HttpServletResponse servletResponse)
                throws javax.servlet.ServletException,
                       IOException

Overrides:

service in class javax.servlet.http.HttpServlet

Throws:

javax.servlet.ServletException

IOException

doResponseRedirectOrNotModifiedLogic

protected boolean doResponseRedirectOrNotModifiedLogic(javax.servlet.http.HttpServletRequest servletRequest,
                                           javax.servlet.http.HttpServletResponse servletResponse,
                                           org.apache.http.HttpResponse proxyResponse,
                                           int statusCode)
                                                throws javax.servlet.ServletException,
                                                       IOException

Throws:

javax.servlet.ServletException

IOException

closeQuietly

protected void closeQuietly(Closeable closeable)

consumeQuietly

protected void consumeQuietly(org.apache.http.HttpEntity entity)

HttpClient v4.1 doesn't have the EntityUtils.consumeQuietly(org.apache.http.HttpEntity) method.

copyRequestHeaders

protected void copyRequestHeaders(javax.servlet.http.HttpServletRequest servletRequest,
                      org.apache.http.HttpRequest proxyRequest)

Copy request headers from the servlet client to the proxy request.

copyResponseHeaders

protected void copyResponseHeaders(org.apache.http.HttpResponse proxyResponse,
                       javax.servlet.http.HttpServletRequest servletRequest,
                       javax.servlet.http.HttpServletResponse servletResponse)

Copy proxied response headers back to the servlet client.

copyProxyCookie

protected void copyProxyCookie(javax.servlet.http.HttpServletRequest servletRequest,
                   javax.servlet.http.HttpServletResponse servletResponse,
                   org.apache.http.Header header)

Copy cookie from the proxy to the servlet client. Replaces cookie path to local path and renames cookie to avoid collisions.

getRealCookie

protected String getRealCookie(String cookieValue)

Take any client cookies that were originally from the proxy and prepare them to send to the proxy. This relies on cookie headers being set correctly according to RFC 6265 Sec 5.4. This also blocks any local cookies from being sent to the proxy.

getCookieNamePrefix

protected String getCookieNamePrefix()

The string prefixing rewritten cookies.

copyResponseEntity

protected void copyResponseEntity(org.apache.http.HttpResponse proxyResponse,
                      javax.servlet.http.HttpServletResponse servletResponse)
                           throws IOException

Copy response body data (the entity) from the proxy to the servlet client.

Throws:

IOException

rewriteUrlFromRequest

protected String rewriteUrlFromRequest(javax.servlet.http.HttpServletRequest servletRequest)

Reads the request URI from servletRequest and rewrites it, considering targetUri. It's used to make the new request.

rewriteQueryStringFromRequest

protected String rewriteQueryStringFromRequest(javax.servlet.http.HttpServletRequest servletRequest,
                                   String queryString)

rewriteUrlFromResponse

protected String rewriteUrlFromResponse(javax.servlet.http.HttpServletRequest servletRequest,
                            String theUrl)

For a redirect response from the target server, this translates theUrl to redirect to and translates it to one the original client can use.

getTargetUri

public String getTargetUri()

The target URI as configured. Not null.

encodeUriQuery

protected static CharSequence encodeUriQuery(CharSequence in)

Encodes characters in the query or fragment part of the URI.

Unfortunately, an incoming URI sometimes has characters disallowed by the spec. HttpClient insists that the outgoing proxied request has a valid URI because it uses Java's URI. To be more forgiving, we must escape the problematic characters. See the URI class for the spec.

Parameters:

in - example: name=value&foo=bar#fragment