Bug 62389

Summary: Add ipv6 loopback address to the default internalProxies
Product: Tomcat 8 Reporter: Craig <candrews>
Component: CatalinaAssignee: Tomcat Developers Mailing List <dev>
Status: RESOLVED FIXED    
Severity: normal CC: candrews, pwebb
Priority: P2 Keywords: PatchAvailable
Version: 8.5.x-trunk   
Target Milestone: ----   
Hardware: PC   
OS: Linux   
URL: https://github.com/apache/tomcat/pull/111

Description Craig 2018-05-20 00:04:05 UTC
0:0:0:0:0:0:0:1 is the IPv6 loopback address. It should be added to the default internalProxies regex.
Comment 1 Craig 2018-05-20 00:16:02 UTC
Pull request: https://github.com/apache/tomcat/pull/111
Comment 2 Mark Thomas 2018-06-01 18:13:16 UTC
Fixed in:
- trunk for 9.0.9 onwards
- 8.5.x for 8.5.32 onwards
- 8.0.x for 8.0.53 onwards
- 7.0.x for 7.0.89 onwards

Thanks for the patch.
Comment 3 Konstantin Kolinko 2018-06-05 01:59:04 UTC
::1 should be added to the list as well, like we do for RemoteAddrValve.

When Tomcat runs with APR connector, request.getRemoteAddr() returns "::1" when accessed from localhost. This value can be seen in access logs.