Re: Strangest thing I've ever seen: Manager doesn't like its allow clause.

Chuck,

On 11/12/25 12:04 PM, James H. H. Lampert wrote:
> I wrote:
>>>> I've updated a customer box from 9.0.106 to 9.0.111, and I'm getting 
>>>> a weird error that's keeping Manager from coming up.
>>>>
>>>>> 11-Nov-2025 18:44:59.637 SEVERE [main] 
>>>>> org.apache.catalina.valves.RemoteCIDRValve.setAllow 127\.\d+\.\d+\. 
>>>>> \d+|::1|0:0:0:0:0:0:0:1|65.76.160.206|68.4.199.145: The address 
>>>>> [127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1|65.76.160.206|68.4.199.145] 
>>>>> is not valid
> 
> On 11/12/25 7:16 AM, Christopher Schultz wrote:
>> Agreed: the port-matching uses regular expressions and is totally 
>> undocumented.
>>
>> The CIRD format is normal except for the totally-weird port matching:
>>
>> 127.0.0.1/32;^1*
>>
>> This would match any connection coming from localhost with a port 
>> number starting with a 1. I'm not sure why port-matching requires 
>> regular expressions, because you could just use multiple CIDR 
>> "patterns" each with a separate port number. I guess maybe for just 
>> numbers of explicit ports?
>>
>>> I think your allow expression should be something like 
>>> “127.0.0.0/8,::1,0:0:0:0:0:0:0:1,65.76.160.206,68.4.199.145”. (The 
>>> two IPv6 entries appear to be functionally identical, so one could 
>>> likely be removed.)
>>
>> Correct. Assuming you don't care about port numbers, just use a comma- 
>> separated list of CIDR addresses. Since you are using specific IPs, 
>> the /32 for IPv4 is implied and you can leave it out. If you want to 
>> make it SUPER CLEAR that the items are CIDR expressions, maybe you 
>> want to add the /32 (or /128) at the end.
> 
> This just keeps getting weirder.
> 
> I was mistaken about a nearly identical "allow" clause working on the 
> Tomcat 9.0.111 server on our own box: it's throwing the same exception.
> 
> So I shut it down, and switched our box back to the 9.0.110 server, and 
> manager comes up just fine.
> 
> The "straight-out-of-the-box" allow clause for the 110 manager is
> allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1"

Is it? Where did you find that?

> Hmm! The "straight-out-of-the-box" allow clause for the 111 manager is
> allow="127.0.0.0/8,::1/128"

Where do you see that, as well?

> I think I see where the problem is, but what changed, and why, after all 
> the years of the first syntax, do we have a completly different one?

Nothing should have changed for Tomcat 9 other than the documentation 
that says "you should use RemoteCIDR(Filter|Valve) instead". There was 
some refactoring, but the RemoteCIDRFilter and RemoteCIDRValve never 
accepted regular expressions for anything (except that weird port thins 
for the Valve specifically).

-chris