Fixes to whitelist filter

tessera-jaxrs/common-jaxrs/src/main/java/com/quorum/tessera/api/filter/IPWhitelistFilter.java

@@ -26,8 +26,6 @@ public class IPWhitelistFilter implements ContainerRequestFilter {
 
     private static final Logger LOGGER = LoggerFactory.getLogger(IPWhitelistFilter.class);
 
-    private boolean disabled;
-
     private HttpServletRequest httpServletRequest;
 
     /**
@@ -43,34 +41,30 @@ public class IPWhitelistFilter implements ContainerRequestFilter {
     @Override
     public void filter(final ContainerRequestContext requestContext) {
         RuntimeContext runtimeContext = RuntimeContext.getInstance();
-        disabled = disabled ? disabled : !runtimeContext.isUseWhiteList();
-        if (disabled) {
+        if (!runtimeContext.isUseWhiteList()) {
             return;
         }
 
-        try {
-
-            final Set<String> whitelisted = runtimeContext.getPeers().stream()
-                .map(URI::getHost).collect(Collectors.toSet());
+        final Set<String> whitelisted =
+                runtimeContext.getPeers().stream().map(URI::getHost).collect(Collectors.toSet());
 
-            if (whitelisted.contains("localhost")) {
-                whitelisted.add("127.0.0.1");
-                whitelisted.add("0:0:0:0:0:0:0:1");
-            }
-
-            final String remoteAddress = httpServletRequest.getRemoteAddr();
-            final String remoteHost = httpServletRequest.getRemoteHost();
+        // If local host is whitelisted then ensure all the various forms are allowed, including the IPv6 localhost
+        // as sent by curl
+        if (whitelisted.contains("localhost") || whitelisted.contains("127.0.0.1")) {
+            whitelisted.add("localhost");
+            whitelisted.add("127.0.0.1");
+            whitelisted.add("0:0:0:0:0:0:0:1");
+        }
 
-            final boolean allowed = whitelisted.stream()
-                .anyMatch(v -> Arrays.asList(remoteAddress,remoteHost).contains(v));
+        final String remoteAddress = httpServletRequest.getRemoteAddr();
+        final String remoteHost = httpServletRequest.getRemoteHost();
 
-            if (!allowed) {
-                requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
-            }
+        final boolean allowed =
+                whitelisted.stream().anyMatch(v -> Arrays.asList(remoteAddress, remoteHost).contains(v));
 
-        } catch (final Exception ex) {
-            LOGGER.error("Unexpected error while processing request.", ex);
-            this.disabled = true;
+        if (!allowed) {
+            LOGGER.warn("Remote host {} with IP {} failed whitelist validation", remoteHost, remoteAddress);
+            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
         }
     }
 

tessera-jaxrs/common-jaxrs/src/test/java/com/quorum/tessera/api/filter/IPWhitelistFilterTest.java

@@ -42,8 +42,6 @@ public void init() throws URISyntaxException {
         when(uriInfo.getBaseUri()).thenReturn(new URI("otherhost"));
         when(ctx.getUriInfo()).thenReturn(uriInfo);
 
-
-
         this.filter = new IPWhitelistFilter();
     }
 
@@ -104,38 +102,6 @@ public void hostInWhitelistGetsAccepted() {
         verifyNoMoreInteractions(ctx);
     }
 
-    @Test
-    public void errorFilteringStopsFutureFilters() {
-
-
-        when(configService.isUseWhiteList()).thenReturn(true);
-        // show that one request goes through okay
-        final HttpServletRequest request = mock(HttpServletRequest.class);
-        doReturn("whitelistedHost").when(request).getRemoteAddr();
-        filter.setHttpServletRequest(request);
-        filter.filter(ctx);
-        verify(request).getRemoteHost();
-        verify(request).getRemoteAddr();
-
-        verifyNoMoreInteractions(ctx);
-
-        // show the second one errors
-        final HttpServletRequest requestError = mock(HttpServletRequest.class);
-        doThrow(RuntimeException.class).when(requestError).getRemoteHost();
-        filter.setHttpServletRequest(requestError);
-        filter.filter(ctx);
-
-        verifyNoMoreInteractions(ctx);
-        verify(request).getRemoteAddr();
-
-        // show the third doesn't get filtered
-        final HttpServletRequest requestIgnored = mock(HttpServletRequest.class);
-        filter.setHttpServletRequest(requestIgnored);
-        filter.filter(ctx);
-        verifyZeroInteractions(requestIgnored);
-        verifyZeroInteractions(ctx);
-    }
-
     @Test
     public void defaultConstructor() {
         when(configService.isUseWhiteList()).thenReturn(Boolean.TRUE);
@@ -179,4 +145,21 @@ public void localhostIPv6IsAlsoWhiteListed() {
         verify(request).getRemoteAddr();
         verifyNoMoreInteractions(ctx);
     }
+
+    @Test
+    public void localAddrIPv6IsAlsoWhiteListed() {
+        URI peer = URI.create("http://127.0.0.1:8080");
+        when(configService.getPeers()).thenReturn(singletonList(peer));
+
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        doReturn("0:0:0:0:0:0:0:1").when(request).getRemoteAddr();
+
+        filter.setHttpServletRequest(request);
+
+        filter.filter(ctx);
+
+        verify(request).getRemoteHost();
+        verify(request).getRemoteAddr();
+        verifyNoMoreInteractions(ctx);
+    }
 }