/*
 * Copyright (c) 2011-Present VMware, Inc. or its affiliates, All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package reactor.netty.http.server;

import java.util.function.BiFunction;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import io.netty.handler.codec.http.HttpRequest;
import reactor.netty.transport.AddressUtils;

/**
 * @author Andrey Shlykov
 * @since 0.9.12
 */
final class DefaultHttpForwardedHeaderHandler implements BiFunction<ConnectionInfo, HttpRequest, ConnectionInfo> {

	static final DefaultHttpForwardedHeaderHandler INSTANCE = new DefaultHttpForwardedHeaderHandler();

	static final String  FORWARDED_HEADER         = "Forwarded";
	static final String  X_FORWARDED_IP_HEADER    = "X-Forwarded-For";
	static final String  X_FORWARDED_HOST_HEADER  = "X-Forwarded-Host";
	static final String  X_FORWARDED_PORT_HEADER  = "X-Forwarded-Port";
	static final String  X_FORWARDED_PROTO_HEADER = "X-Forwarded-Proto";

	static final Pattern FORWARDED_HOST_PATTERN   = Pattern.compile("host=\"?([^;,\"]+)\"?");
	static final Pattern FORWARDED_PROTO_PATTERN  = Pattern.compile("proto=\"?([^;,\"]+)\"?");
	static final Pattern FORWARDED_FOR_PATTERN    = Pattern.compile("for=\"?([^;,\"]+)\"?");

	@Override
	public ConnectionInfo apply(ConnectionInfo connectionInfo, HttpRequest request) {
		String forwardedHeader = request.headers().get(FORWARDED_HEADER);
		if (forwardedHeader != null) {
			return parseForwardedInfo(connectionInfo, forwardedHeader);
		}
		return parseXForwardedInfo(connectionInfo, request);
	}

	private ConnectionInfo parseForwardedInfo(ConnectionInfo connectionInfo, String forwardedHeader) {
		String forwarded = forwardedHeader.split(",", 2)[0];
		Matcher hostMatcher = FORWARDED_HOST_PATTERN.matcher(forwarded);
		if (hostMatcher.find()) {
			connectionInfo = connectionInfo.withHostAddress(
					AddressUtils.parseAddress(hostMatcher.group(1), connectionInfo.getHostAddress().getPort(), true));
		}
		Matcher protoMatcher = FORWARDED_PROTO_PATTERN.matcher(forwarded);
		if (protoMatcher.find()) {
			connectionInfo = connectionInfo.withScheme(protoMatcher.group(1).trim());
		}
		Matcher forMatcher = FORWARDED_FOR_PATTERN.matcher(forwarded);
		if (forMatcher.find()) {
			connectionInfo = connectionInfo.withRemoteAddress(
					AddressUtils.parseAddress(forMatcher.group(1).trim(), connectionInfo.getRemoteAddress().getPort(), true));
		}
		return connectionInfo;
	}

	private ConnectionInfo parseXForwardedInfo(ConnectionInfo connectionInfo, HttpRequest request) {
		String ipHeader = request.headers().get(X_FORWARDED_IP_HEADER);
		if (ipHeader != null) {
			connectionInfo = connectionInfo.withRemoteAddress(
					AddressUtils.parseAddress(ipHeader.split(",", 2)[0], connectionInfo.getRemoteAddress().getPort()));
		}
		String hostHeader = request.headers().get(X_FORWARDED_HOST_HEADER);
		if (hostHeader != null) {
			String portHeader = request.headers().get(X_FORWARDED_PORT_HEADER);
			int port = connectionInfo.getHostAddress().getPort();
			if (portHeader != null && !portHeader.isEmpty()) {
				String portStr = portHeader.split(",", 2)[0].trim();
				if (portStr.chars().allMatch(Character::isDigit)) {
					port = Integer.parseInt(portStr);
				}
				else {
					throw new IllegalArgumentException("Failed to parse a port from " + portHeader);
				}
			}
			connectionInfo = connectionInfo.withHostAddress(
					AddressUtils.createUnresolved(hostHeader.split(",", 2)[0].trim(), port));
		}
		String protoHeader = request.headers().get(X_FORWARDED_PROTO_HEADER);
		if (protoHeader != null) {
			connectionInfo = connectionInfo.withScheme(protoHeader.split(",", 2)[0].trim());
		}
		return connectionInfo;
	}

}

@@ -1758,16 +1758,568 @@
 %5C%22?%22);%0A%0A
+%09/**%0A%09 * Specifies whether the Http Server applies a strict %7B@code Forwarded%7D header validation.%0A%09 * By default it is enabled and strict validation is used.%0A%09 * @since 1.0.8%0A%09 * @deprecated The system property is used for backwards compatibility and will be removed in version 1.2.0.%0A%09 */%0A%09@Deprecated%0A%09static final String FORWARDED_HEADER_VALIDATION = %22reactor.netty.http.server.forwarded.strictValidation%22;%0A%09static final boolean DEFAULT_FORWARDED_HEADER_VALIDATION =%0A%09%09%09Boolean.parseBoolean(System.getProperty(FORWARDED_HEADER_VALIDATION, %22true%22));%0A%0A
 %09@Overri
@@ -2321,16 +2321,16 @@
 verride%0A
-
 %09public 
@@ -3020,37 +3020,75 @@
 ess().getPort(),
- true
+%0A%09%09%09%09%09%09%09DEFAULT_FORWARDED_HEADER_VALIDATION
 ));%0A%09%09%7D%0A%09%09Matche
@@ -3511,13 +3511,51 @@
 t(),
- true
+%0A%09%09%09%09%09%09%09DEFAULT_FORWARDED_HEADER_VALIDATION
 ));%0A
@@ -4382,16 +4382,16 @@
 %09%09%7D%0A
-
 %09%09%09%09else
  %7B%0A%09
@@ -4386,16 +4386,57 @@
 %09%09%09%09else
+ if (DEFAULT_FORWARDED_HEADER_VALIDATION)
  %7B%0A%09%09%09%09%09

Add system property for disabling strict Forwarded header validation (#1640)