java.lang.Object
com.google.protobuf.AbstractMessageLite
com.google.protobuf.AbstractMessage
com.google.protobuf.GeneratedMessageV3
io.envoyproxy.envoy.extensions.http.original_ip_detection.xff.v3.XffConfig
All Implemented Interfaces:
com.google.protobuf.Message, com.google.protobuf.MessageLite, com.google.protobuf.MessageLiteOrBuilder, com.google.protobuf.MessageOrBuilder, XffConfigOrBuilder, Serializable

public final class XffConfig extends com.google.protobuf.GeneratedMessageV3 implements XffConfigOrBuilder
 This extension allows for the original downstream remote IP to be detected
 by reading the :ref:`config_http_conn_man_headers_x-forwarded-for` header.

 [#extension: envoy.http.original_ip_detection.xff]
 
Protobuf type envoy.extensions.http.original_ip_detection.xff.v3.XffConfig
See Also:
  • Nested Class Summary

    Nested Classes
    Modifier and Type
    Class
    Description
    static final class 
    This extension allows for the original downstream remote IP to be detected by reading the :ref:`config_http_conn_man_headers_x-forwarded-for` header.

    Nested classes/interfaces inherited from class com.google.protobuf.GeneratedMessageV3

    com.google.protobuf.GeneratedMessageV3.BuilderParent, com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>,BuilderT extends com.google.protobuf.GeneratedMessageV3.ExtendableBuilder<MessageT,BuilderT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.ExtendableMessageOrBuilder<MessageT extends com.google.protobuf.GeneratedMessageV3.ExtendableMessage<MessageT>>, com.google.protobuf.GeneratedMessageV3.FieldAccessorTable, com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter

    Nested classes/interfaces inherited from class com.google.protobuf.AbstractMessageLite

    com.google.protobuf.AbstractMessageLite.InternalOneOfEnum
  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final int
     
    static final int
     
    static final int
     

    Fields inherited from class com.google.protobuf.GeneratedMessageV3

    alwaysUseFieldBuilders, unknownFields

    Fields inherited from class com.google.protobuf.AbstractMessage

    memoizedSize

    Fields inherited from class com.google.protobuf.AbstractMessageLite

    memoizedHashCode
  • Method Summary

    Modifier and Type
    Method
    Description
    boolean
     
    static XffConfig
     
     
    static final com.google.protobuf.Descriptors.Descriptor
     
    com.google.protobuf.Parser<XffConfig>
     
    int
     
    com.google.protobuf.BoolValue
    If set, Envoy will not append the remote address to the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. .. attention:: For proper proxy behaviour it is not recommended to set this option.
    com.google.protobuf.BoolValueOrBuilder
    If set, Envoy will not append the remote address to the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. .. attention:: For proper proxy behaviour it is not recommended to set this option.
    int
    The number of additional ingress proxy hops from the right side of the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header to trust when determining the origin client's IP address.
    The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when evaluating the remote IP address to determine the original client's IP address.
    The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when evaluating the remote IP address to determine the original client's IP address.
    int
     
    boolean
    If set, Envoy will not append the remote address to the :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header. .. attention:: For proper proxy behaviour it is not recommended to set this option.
    boolean
    The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when evaluating the remote IP address to determine the original client's IP address.
    protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable
     
    final boolean
     
     
    newBuilder(XffConfig prototype)
     
     
    newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent)
     
    protected Object
    newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)
     
    static XffConfig
     
    static XffConfig
    parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static XffConfig
    parseFrom(byte[] data)
     
    static XffConfig
    parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static XffConfig
    parseFrom(com.google.protobuf.ByteString data)
     
    static XffConfig
    parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static XffConfig
    parseFrom(com.google.protobuf.CodedInputStream input)
     
    static XffConfig
    parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static XffConfig
     
    static XffConfig
    parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static XffConfig
     
    static XffConfig
    parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry)
     
    static com.google.protobuf.Parser<XffConfig>
     
     
    void
    writeTo(com.google.protobuf.CodedOutputStream output)
     

    Methods inherited from class com.google.protobuf.GeneratedMessageV3

    canUseUnsafe, computeStringSize, computeStringSizeNoTag, emptyBooleanList, emptyDoubleList, emptyFloatList, emptyIntList, emptyList, emptyLongList, getAllFields, getDescriptorForType, getField, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof, internalGetMapField, internalGetMapFieldReflection, isStringEmpty, makeExtensionsImmutable, makeMutableCopy, makeMutableCopy, mergeFromAndMakeImmutableInternal, mutableCopy, mutableCopy, mutableCopy, mutableCopy, mutableCopy, newBooleanList, newBuilderForType, newDoubleList, newFloatList, newIntList, newLongList, parseDelimitedWithIOException, parseDelimitedWithIOException, parseUnknownField, parseUnknownFieldProto3, parseWithIOException, parseWithIOException, parseWithIOException, parseWithIOException, serializeBooleanMapTo, serializeIntegerMapTo, serializeLongMapTo, serializeStringMapTo, writeReplace, writeString, writeStringNoTag

    Methods inherited from class com.google.protobuf.AbstractMessage

    findInitializationErrors, getInitializationErrorString, hashBoolean, hashEnum, hashEnumList, hashFields, hashLong, toString

    Methods inherited from class com.google.protobuf.AbstractMessageLite

    addAll, addAll, checkByteStringIsUtf8, toByteArray, toByteString, writeDelimitedTo, writeTo

    Methods inherited from class java.lang.Object

    clone, finalize, getClass, notify, notifyAll, wait, wait, wait

    Methods inherited from interface com.google.protobuf.MessageLite

    toByteArray, toByteString, writeDelimitedTo, writeTo

    Methods inherited from interface com.google.protobuf.MessageOrBuilder

    findInitializationErrors, getAllFields, getDescriptorForType, getField, getInitializationErrorString, getOneofFieldDescriptor, getRepeatedField, getRepeatedFieldCount, getUnknownFields, hasField, hasOneof
  • Field Details

    • XFF_NUM_TRUSTED_HOPS_FIELD_NUMBER

      public static final int XFF_NUM_TRUSTED_HOPS_FIELD_NUMBER
      See Also:
    • XFF_TRUSTED_CIDRS_FIELD_NUMBER

      public static final int XFF_TRUSTED_CIDRS_FIELD_NUMBER
      See Also:
    • SKIP_XFF_APPEND_FIELD_NUMBER

      public static final int SKIP_XFF_APPEND_FIELD_NUMBER
      See Also:
  • Method Details

    • newInstance

      protected Object newInstance(com.google.protobuf.GeneratedMessageV3.UnusedPrivateParameter unused)
      Overrides:
      newInstance in class com.google.protobuf.GeneratedMessageV3
    • getDescriptor

      public static final com.google.protobuf.Descriptors.Descriptor getDescriptor()
    • internalGetFieldAccessorTable

      protected com.google.protobuf.GeneratedMessageV3.FieldAccessorTable internalGetFieldAccessorTable()
      Specified by:
      internalGetFieldAccessorTable in class com.google.protobuf.GeneratedMessageV3
    • getXffNumTrustedHops

      public int getXffNumTrustedHops()
       The number of additional ingress proxy hops from the right side of the
       :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header to trust when
       determining the origin client's IP address. The default is zero if this option
       is not specified. See the documentation for
       :ref:`config_http_conn_man_headers_x-forwarded-for` for more information.
      
       Only one of ``xff_num_trusted_hops`` and ``xff_trusted_cidrs`` can be set.
       
      uint32 xff_num_trusted_hops = 1;
      Specified by:
      getXffNumTrustedHops in interface XffConfigOrBuilder
      Returns:
      The xffNumTrustedHops.
    • hasXffTrustedCidrs

      public boolean hasXffTrustedCidrs()
       The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when
       evaluating the remote IP address to determine the original client's IP address.
       This is used instead of
       :ref:`use_remote_address <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`.
       When the remote IP address matches a trusted CIDR and the
       :ref:`config_http_conn_man_headers_x-forwarded-for` header was sent, each entry
       in the ``x-forwarded-for`` header is evaluated from right to left and the first
       non-trusted address is used as the original client address. If all
       addresses in ``x-forwarded-for`` are within the trusted list, the first (leftmost)
       entry is used.
      
       .. warning::
      
         Starting with Envoy v1.33.0, private IP address ranges are **not** automatically skipped
         when determining the original client address. We'll return the first address that is not
         in the ``xff_trusted_cidrs`` list, even if it is a private IP address.
      
         If you want to skip private IP addresses, explicitly add them to the ``xff_trusted_cidrs``
         list. For example:
      
         .. code-block:: yaml
      
           xff_trusted_cidrs:
             cidrs:
               - address_prefix: "10.0.0.0"
                 prefix_len: 8
               - address_prefix: "172.16.0.0"
                 prefix_len: 12
               - address_prefix: "192.168.0.0"
                 prefix_len: 16
               - address_prefix: "127.0.0.0"
                 prefix_len: 8
               - address_prefix: "fc00::"
                 prefix_len: 7
               - address_prefix: "::1"
                 prefix_len: 128
      
         See :ref:`internal_address_config
         <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config>`
         for more information about the v1.33.0 behavior change.
      
       This is typically used when requests are proxied by a
       `CDN <https://en.wikipedia.org/wiki/Content_delivery_network>`_.
      
       Only one of ``xff_num_trusted_hops`` and ``xff_trusted_cidrs`` can be set.
       
      .envoy.extensions.http.original_ip_detection.xff.v3.XffTrustedCidrs xff_trusted_cidrs = 2;
      Specified by:
      hasXffTrustedCidrs in interface XffConfigOrBuilder
      Returns:
      Whether the xffTrustedCidrs field is set.
    • getXffTrustedCidrs

      public XffTrustedCidrs getXffTrustedCidrs()
       The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when
       evaluating the remote IP address to determine the original client's IP address.
       This is used instead of
       :ref:`use_remote_address <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`.
       When the remote IP address matches a trusted CIDR and the
       :ref:`config_http_conn_man_headers_x-forwarded-for` header was sent, each entry
       in the ``x-forwarded-for`` header is evaluated from right to left and the first
       non-trusted address is used as the original client address. If all
       addresses in ``x-forwarded-for`` are within the trusted list, the first (leftmost)
       entry is used.
      
       .. warning::
      
         Starting with Envoy v1.33.0, private IP address ranges are **not** automatically skipped
         when determining the original client address. We'll return the first address that is not
         in the ``xff_trusted_cidrs`` list, even if it is a private IP address.
      
         If you want to skip private IP addresses, explicitly add them to the ``xff_trusted_cidrs``
         list. For example:
      
         .. code-block:: yaml
      
           xff_trusted_cidrs:
             cidrs:
               - address_prefix: "10.0.0.0"
                 prefix_len: 8
               - address_prefix: "172.16.0.0"
                 prefix_len: 12
               - address_prefix: "192.168.0.0"
                 prefix_len: 16
               - address_prefix: "127.0.0.0"
                 prefix_len: 8
               - address_prefix: "fc00::"
                 prefix_len: 7
               - address_prefix: "::1"
                 prefix_len: 128
      
         See :ref:`internal_address_config
         <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config>`
         for more information about the v1.33.0 behavior change.
      
       This is typically used when requests are proxied by a
       `CDN <https://en.wikipedia.org/wiki/Content_delivery_network>`_.
      
       Only one of ``xff_num_trusted_hops`` and ``xff_trusted_cidrs`` can be set.
       
      .envoy.extensions.http.original_ip_detection.xff.v3.XffTrustedCidrs xff_trusted_cidrs = 2;
      Specified by:
      getXffTrustedCidrs in interface XffConfigOrBuilder
      Returns:
      The xffTrustedCidrs.
    • getXffTrustedCidrsOrBuilder

      public XffTrustedCidrsOrBuilder getXffTrustedCidrsOrBuilder()
       The `CIDR <https://tools.ietf.org/html/rfc4632>`_ ranges to trust when
       evaluating the remote IP address to determine the original client's IP address.
       This is used instead of
       :ref:`use_remote_address <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`.
       When the remote IP address matches a trusted CIDR and the
       :ref:`config_http_conn_man_headers_x-forwarded-for` header was sent, each entry
       in the ``x-forwarded-for`` header is evaluated from right to left and the first
       non-trusted address is used as the original client address. If all
       addresses in ``x-forwarded-for`` are within the trusted list, the first (leftmost)
       entry is used.
      
       .. warning::
      
         Starting with Envoy v1.33.0, private IP address ranges are **not** automatically skipped
         when determining the original client address. We'll return the first address that is not
         in the ``xff_trusted_cidrs`` list, even if it is a private IP address.
      
         If you want to skip private IP addresses, explicitly add them to the ``xff_trusted_cidrs``
         list. For example:
      
         .. code-block:: yaml
      
           xff_trusted_cidrs:
             cidrs:
               - address_prefix: "10.0.0.0"
                 prefix_len: 8
               - address_prefix: "172.16.0.0"
                 prefix_len: 12
               - address_prefix: "192.168.0.0"
                 prefix_len: 16
               - address_prefix: "127.0.0.0"
                 prefix_len: 8
               - address_prefix: "fc00::"
                 prefix_len: 7
               - address_prefix: "::1"
                 prefix_len: 128
      
         See :ref:`internal_address_config
         <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.internal_address_config>`
         for more information about the v1.33.0 behavior change.
      
       This is typically used when requests are proxied by a
       `CDN <https://en.wikipedia.org/wiki/Content_delivery_network>`_.
      
       Only one of ``xff_num_trusted_hops`` and ``xff_trusted_cidrs`` can be set.
       
      .envoy.extensions.http.original_ip_detection.xff.v3.XffTrustedCidrs xff_trusted_cidrs = 2;
      Specified by:
      getXffTrustedCidrsOrBuilder in interface XffConfigOrBuilder
    • hasSkipXffAppend

      public boolean hasSkipXffAppend()
       If set, Envoy will not append the remote address to the
       :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header.
      
       .. attention::
      
         For proper proxy behaviour it is not recommended to set this option.
         For backwards compatibility, if this option is unset it defaults to true.
      
       This only applies when :ref:`use_remote_address
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
       is false, otherwise :ref:`skip_xff_append
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append>`
       applies.
       
      .google.protobuf.BoolValue skip_xff_append = 3;
      Specified by:
      hasSkipXffAppend in interface XffConfigOrBuilder
      Returns:
      Whether the skipXffAppend field is set.
    • getSkipXffAppend

      public com.google.protobuf.BoolValue getSkipXffAppend()
       If set, Envoy will not append the remote address to the
       :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header.
      
       .. attention::
      
         For proper proxy behaviour it is not recommended to set this option.
         For backwards compatibility, if this option is unset it defaults to true.
      
       This only applies when :ref:`use_remote_address
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
       is false, otherwise :ref:`skip_xff_append
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append>`
       applies.
       
      .google.protobuf.BoolValue skip_xff_append = 3;
      Specified by:
      getSkipXffAppend in interface XffConfigOrBuilder
      Returns:
      The skipXffAppend.
    • getSkipXffAppendOrBuilder

      public com.google.protobuf.BoolValueOrBuilder getSkipXffAppendOrBuilder()
       If set, Envoy will not append the remote address to the
       :ref:`config_http_conn_man_headers_x-forwarded-for` HTTP header.
      
       .. attention::
      
         For proper proxy behaviour it is not recommended to set this option.
         For backwards compatibility, if this option is unset it defaults to true.
      
       This only applies when :ref:`use_remote_address
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.use_remote_address>`
       is false, otherwise :ref:`skip_xff_append
       <envoy_v3_api_field_extensions.filters.network.http_connection_manager.v3.HttpConnectionManager.skip_xff_append>`
       applies.
       
      .google.protobuf.BoolValue skip_xff_append = 3;
      Specified by:
      getSkipXffAppendOrBuilder in interface XffConfigOrBuilder
    • isInitialized

      public final boolean isInitialized()
      Specified by:
      isInitialized in interface com.google.protobuf.MessageLiteOrBuilder
      Overrides:
      isInitialized in class com.google.protobuf.GeneratedMessageV3
    • writeTo

      public void writeTo(com.google.protobuf.CodedOutputStream output) throws IOException
      Specified by:
      writeTo in interface com.google.protobuf.MessageLite
      Overrides:
      writeTo in class com.google.protobuf.GeneratedMessageV3
      Throws:
      IOException
    • getSerializedSize

      public int getSerializedSize()
      Specified by:
      getSerializedSize in interface com.google.protobuf.MessageLite
      Overrides:
      getSerializedSize in class com.google.protobuf.GeneratedMessageV3
    • equals

      public boolean equals(Object obj)
      Specified by:
      equals in interface com.google.protobuf.Message
      Overrides:
      equals in class com.google.protobuf.AbstractMessage
    • hashCode

      public int hashCode()
      Specified by:
      hashCode in interface com.google.protobuf.Message
      Overrides:
      hashCode in class com.google.protobuf.AbstractMessage
    • parseFrom

      public static XffConfig parseFrom(ByteBuffer data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(ByteBuffer data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(com.google.protobuf.ByteString data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(com.google.protobuf.ByteString data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(byte[] data) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(byte[] data, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws com.google.protobuf.InvalidProtocolBufferException
      Throws:
      com.google.protobuf.InvalidProtocolBufferException
    • parseFrom

      public static XffConfig parseFrom(InputStream input) throws IOException
      Throws:
      IOException
    • parseFrom

      public static XffConfig parseFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException
    • parseDelimitedFrom

      public static XffConfig parseDelimitedFrom(InputStream input) throws IOException
      Throws:
      IOException
    • parseDelimitedFrom

      public static XffConfig parseDelimitedFrom(InputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException
    • parseFrom

      public static XffConfig parseFrom(com.google.protobuf.CodedInputStream input) throws IOException
      Throws:
      IOException
    • parseFrom

      public static XffConfig parseFrom(com.google.protobuf.CodedInputStream input, com.google.protobuf.ExtensionRegistryLite extensionRegistry) throws IOException
      Throws:
      IOException
    • newBuilderForType

      public XffConfig.Builder newBuilderForType()
      Specified by:
      newBuilderForType in interface com.google.protobuf.Message
      Specified by:
      newBuilderForType in interface com.google.protobuf.MessageLite
    • newBuilder

      public static XffConfig.Builder newBuilder()
    • newBuilder

      public static XffConfig.Builder newBuilder(XffConfig prototype)
    • toBuilder

      public XffConfig.Builder toBuilder()
      Specified by:
      toBuilder in interface com.google.protobuf.Message
      Specified by:
      toBuilder in interface com.google.protobuf.MessageLite
    • newBuilderForType

      protected XffConfig.Builder newBuilderForType(com.google.protobuf.GeneratedMessageV3.BuilderParent parent)
      Specified by:
      newBuilderForType in class com.google.protobuf.GeneratedMessageV3
    • getDefaultInstance

      public static XffConfig getDefaultInstance()
    • parser

      public static com.google.protobuf.Parser<XffConfig> parser()
    • getParserForType

      public com.google.protobuf.Parser<XffConfig> getParserForType()
      Specified by:
      getParserForType in interface com.google.protobuf.Message
      Specified by:
      getParserForType in interface com.google.protobuf.MessageLite
      Overrides:
      getParserForType in class com.google.protobuf.GeneratedMessageV3
    • getDefaultInstanceForType

      public XffConfig getDefaultInstanceForType()
      Specified by:
      getDefaultInstanceForType in interface com.google.protobuf.MessageLiteOrBuilder
      Specified by:
      getDefaultInstanceForType in interface com.google.protobuf.MessageOrBuilder