Fix logging of forwarded IPs in logs #11854

abh1sar · 2025-10-16T13:48:47Z

Description

This PR fixes a bug due to which forwarded IPs behind a proxy won't be logged in management.log, api.log and access.log.

Access log : addForwardingCustomiser() updates request's remoteAddr to the forwarded client's IP
But ACSRequestLog.log() was looking at getHttpChannel().getEndPoint().getRemoteAddress(), which still returns the proxy's address
AddForwardinfCustomizer would only look at the first header in proxy.header.names. If the user is sending client IP address via some other header, it won't be detected.
Changing the request's remoteAddr by addFOrwardingCustomizer changes the behaviour in ApiServlet.getClientAddress() which expects request.getRemoteAddr() to return the proxy's address, so that it can compare it with the allowed proxy cidrs as set in proxy.cidr

For the fix, I have removed addForwardingCustomizer and calling ApiServlet.getClientAddress() from ACSRequestLog. This way IPs in all the logs are consistent with each other and use the same method (getClientAddress()) to get the forwarded client's IP address.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Verified that the forwarded IP is being logged in all the logs.
Also tried the with the script test_forwareded_headers.sh as given here #11386 (review)

Settings used :

Forwarded IP : 203.0.113.1
management.log
2025-10-17 11:35:03,230 DEBUG [c.c.a.ApiServlet] (qtp1390913202-27:[ctx-e2a9983c]) (logid:294c8b7e) found ip 203.0.113.1 in header X-Forwarded-For
2025-10-17 11:35:03,230 DEBUG [c.c.a.ApiServlet] (qtp1390913202-27:[ctx-e2a9983c]) (logid:294c8b7e) ===START===  203.0.113.1 -- GET  command=listCapabilities&response=json

api.log
2025-10-17 11:34:58,164 INFO  [a.c.c.a.ApiServlet] (qtp1390913202-443:[ctx-1ba1de31, ctx-a7f19570]) (logid:041cfd8f)  203.0.113.1 -- GET command=listCapabilities&response=json 401 unable to verify user credentials and/or request signature

access.log
/203.0.113.1 - - [2025-10-17 11:34:58] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"


./test_forwareded_headers.sh

=== RESULTS ANALYSIS ===
CloudStack access log entries:
==============================
/10.0.3.251 - - [2025-10-17 11:34:58] "GET /client/api/?managementserverid=ff7ce98c-a53e-44a1-8df5-7adc455cd523&command=readyForShutdown&response=json& HTTP/1.1" 200 231 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0"
/203.0.113.1 - - [2025-10-17 11:34:58] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
/203.0.113.2 - - [2025-10-17 11:34:59] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
/203.0.113.3 - - [2025-10-17 11:35:00] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
/203.0.113.10 - - [2025-10-17 11:35:01] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
/0:0:0:0:0:0:0:1 - - [2025-10-17 11:35:02] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
/10.0.3.251 - - [2025-10-17 11:35:03] "GET /client/api/?managementserverid=ff7ce98c-a53e-44a1-8df5-7adc455cd523&command=readyForShutdown&response=json& HTTP/1.1" 200 231 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0"
/203.0.113.20 - - [2025-10-17 11:35:03] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"

=== VALIDATION ===
==================
SUCCESS: Forwarded IP addresses found in CloudStack access log!
PR #11386 forwarded headers functionality is working correctly

Detected forwarded IPs:
======================
  /203.0.113.1 - - [2025-10-17 11:34:58] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
  /203.0.113.2 - - [2025-10-17 11:34:59] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
  /203.0.113.3 - - [2025-10-17 11:35:00] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
  /203.0.113.10 - - [2025-10-17 11:35:01] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"
  /203.0.113.20 - - [2025-10-17 11:35:03] "GET /client/api?command=listCapabilities&response=json HTTP/1.1" 401 133 "-" "curl/7.61.1"

Analysis:
=========
Unique forwarded IPs detected:
  /203.0.113.1 (appeared 2 time(s))
  /203.0.113.10 (appeared 1 time(s))
  /203.0.113.2 (appeared 2 time(s))
  /203.0.113.20 (appeared 1 time(s))
  /203.0.113.3 (appeared 1 time(s))

Test completed at: Fri Oct 17 11:35:06 UTC 2025
===========================

The script ./test_forwareded_headers.sh fails without the fix

How did you try to break this feature and the system with this change?

…r.verify is enabled

abh1sar · 2025-10-16T13:51:00Z

@blueorangutan package

blueorangutan · 2025-10-16T13:52:03Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

DaanHoogland

clgtm

codecov · 2025-10-16T13:57:52Z

Codecov Report

❌ Patch coverage is 92.30769% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 17.56%. Comparing base (f63118c) to head (cad2aa4).

Files with missing lines	Patch %	Lines
server/src/main/java/com/cloud/api/ApiServlet.java	92.30%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #11854   +/-   ##
=========================================
  Coverage     17.55%   17.56%           
- Complexity    15529    15531    +2     
=========================================
  Files          5909     5909           
  Lines        529012   529010    -2     
  Branches      64604    64603    -1     
=========================================
+ Hits          92892    92909   +17     
+ Misses       425671   425653   -18     
+ Partials      10449    10448    -1

Flag	Coverage Δ
uitests	`3.58% <ø> (ø)`
unittests	`18.63% <92.30%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-10-16T14:43:24Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 15485

abh1sar · 2025-10-17T05:32:55Z

@blueorangutan package

blueorangutan · 2025-10-17T05:34:03Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-17T06:47:58Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15490

abh1sar · 2025-10-17T14:12:00Z

@blueorangutan package

blueorangutan · 2025-10-17T14:14:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-17T14:30:22Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 15495

abh1sar · 2025-10-17T15:24:24Z

@blueorangutan package

blueorangutan · 2025-10-17T15:26:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-17T15:45:55Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 15496

abh1sar · 2025-10-21T03:12:53Z

@blueorangutan package

blueorangutan · 2025-10-21T03:14:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-21T04:10:01Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 15509

abh1sar · 2025-10-21T15:17:41Z

@blueorangutan package

blueorangutan · 2025-10-21T15:20:04Z

@abh1sar a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-10-21T16:41:09Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15513

abh1sar · 2025-10-21T17:16:57Z

@blueorangutan test

blueorangutan · 2025-10-21T17:18:04Z

@abh1sar a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-10-21T18:18:27Z

[SF] Trillian Build Failed (tid-14708)

abh1sar · 2025-10-21T20:29:09Z

@blueorangutan test

blueorangutan · 2025-10-21T20:30:04Z

@abh1sar a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-10-21T21:21:49Z

[SF] Trillian Build Failed (tid-14710)

log the forwarded ip address in access log if the setting proxy.heade…

0ebddf7

…r.verify is enabled

boring-cyborg bot added the component:management-server label Oct 16, 2025

DaanHoogland approved these changes Oct 16, 2025

View reviewed changes

abh1sar closed this Oct 17, 2025

abh1sar reopened this Oct 17, 2025

abh1sar closed this Oct 17, 2025

abh1sar reopened this Oct 17, 2025

use static functions from ApiServlet and code refactoring

183482b

abh1sar changed the title ~~[Wip] Fix logging forwarded IP in access log~~ Fix logging of forwarded IPs in logs Oct 17, 2025

abh1sar marked this pull request as ready for review October 17, 2025 14:12

abh1sar requested a review from DaanHoogland October 17, 2025 14:13

Merge branch 'main' into forwarded-ip-accesslog

db63070

abh1sar marked this pull request as draft October 21, 2025 10:56

Fix ApiServletTest.java

2ca1e10

abh1sar force-pushed the forwarded-ip-accesslog branch from 63ce1c6 to 2ca1e10 Compare October 21, 2025 14:13

abh1sar added 2 commits October 21, 2025 19:47

fix precommit

cab7428

fix precommit

cad2aa4

abh1sar marked this pull request as ready for review October 21, 2025 15:17

DaanHoogland added the status:needs-testing label Oct 21, 2025

Uh oh!

Fix logging of forwarded IPs in logs #11854

Are you sure you want to change the base?

Fix logging of forwarded IPs in logs #11854

Uh oh!

Conversation

abh1sar commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

abh1sar commented Oct 16, 2025

Uh oh!

blueorangutan commented Oct 16, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Oct 16, 2025

Uh oh!

abh1sar commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

abh1sar commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

abh1sar commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

blueorangutan commented Oct 17, 2025

Uh oh!

abh1sar commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

abh1sar commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

abh1sar commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

abh1sar commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

blueorangutan commented Oct 21, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

abh1sar commented Oct 16, 2025 •

edited

Loading

codecov bot commented Oct 16, 2025 •

edited

Loading