Issue/540 567 no proxy config, trusted reverse proxies

[hhund]

• Fixed typos in variable names, class names, and javadoc.
• Fixed some log messages.
• Added missing final modifier to some constants.
• Replaces set variable to empty string with unset variable in apache httpd config.
• Adds trusted reverse proxy allow-list feature
  • The ForwardedSecureRequestCustomizer (used in reverse proxy -> app server deployments) now only accepts X-ClientCert header values from trusted / configured reverse proxy senders.
  • Default config sets hostname "proxy" as allowed reverse proxy and periodically resolves the name against the DNS.
  • The feature can be disabled by setting disabled as the only allowed reverse proxy.
  • Hostnames, IPv4/IPv6 addresses and IPv4/IPv6 CIDR networks can be configured as allowed.
  • Hostnames are resolved against the DNS and periodically refreshed. The timeout can be configured and should be chosen according to the acceptable stale-authorization window and e.g. the expected reverse-proxy replacement time.
• Extends no-proxy config to allow for multi wildcard, IP and CIDR rules
  • The "dev.dsf.proxy.noProxy" config property can now be configured with exact domains example.com, one level wildcard sub-domains *.example.com, one or more level wildcard sub-domains **.example.com, IP-addresses and CIDR Networks.
  • IP/CIDR rules are applied if the target no-proxy URL is specified as an IP-address.
  • IPv6 addresses and CIDR networks need to be specified in square brackets to allow for the optional specification of a target port.
  • Examples: sub.exact.com:80, *.one.level.wildcard.com, **.multilevel.com:443, 192.168.1.1, 192.168.1.0/24:80, [2001:db8::1]:443, [2001:db8::/32]
  • If no port is specified the target port is ignored.

Breaking Change: No-proxy hostnames without *. prefix no longer match subdomains.

closes #540
closes #567

Modified config property

DEV_DSF_PROXY_NOPROXY

• Property: dev.dsf.proxy.noProxy
• Required: No
• Description: Forward proxy no-proxy list: Target URLs will match exact domains example.com, against one level sub-domains *.example.com, one or more level sub-domains **.example.com, against IP-addresses and CIDR Networks if the target URL is specified as IP-address (IPv6 in square brackets), if no port is specified - all ports are matched; comma or space separated list, YAML block scalars supported
• Example: sub.exact.com:80, *.one.level.wildcard.com, **.multilevel.com:443, 192.168.1.1, 192.168.1.0/24:80, [2001:db8::1]:443, [2001:db8::/32]

New config properties

DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY

• Property: dev.dsf.server.auth.trust.reverse.proxy
• Required: No
• Description: Defines allowed source IPs for the reverse proxy, supported definitions: by hostname - resolved periodically (see DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY_HOSTNAME_REFRESH_TIMEOUT), by single IPv4 or IPv6 address, by IPv4 CIDR or IPv6 CIDR network; comma or space separated list, YAML block scalars supported; use disabled to allow all incoming IP addresses
• Example: proxy, ingress.cluster.local, 192.168.1.1, 192.168.1.0/24, [2001:db8::1], [2001:db8::/32]
• Recommendation: In Kubernetes deployments set disabled and use Network Policies
• Default: proxy

DEV_DSF_SERVER_AUTH_TRUST_REVERSE_PROXY_HOSTNAME_REFRESH_TIMEOUT

• Property: dev.dsf.server.auth.trust.reverse.proxy.hostname.refresh.timeout
• Required: No
• Description: Refresh timeout after which a trusted reverse proxy hostname is re-resolved
• Recommendation: The refresh timeout should be chosen according to the acceptable stale-authorization window and e.g. the expected reverse-proxy replacement time
• Default: PT10S

[schwzr]

• We should disable / reject wildcards in the allowed reverse proxies config, as they are silently converted to the base domain
• We should remember to announce the breaking change (by default)
• We should maybe inform that internal caching of DNS Records is happening as well (see https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/net/doc-files/net-properties.html#address-cache-heading)
• We might have to allow * as a no-proxy URL, as https://github.com/datasharingframework/dsf/blob/main/dsf-common/dsf-common-config/src/main/java/dev/dsf/common/config/ProxyConfig.java#L35C1-L36C1 describes this case

[hhund]

• We should disable / reject wildcards in the allowed reverse proxies config, as they are silently converted to the base domain

They were never enabled, but the code had an inconsistent config value type (domain or wildcard-domain) checks. Wildcard domains would have been full ignored. Fixed via b6d060e.

• We should remember to announce the breaking change (by default)

Yes.

• We should maybe inform that internal caching of DNS Records is happening as well (see https://docs.oracle.com/en/java/javase/25/docs/api/java.base/java/net/doc-files/net-properties.html#address-cache-heading)

I added a comment about the Java networkaddress.cache... security properties to our documentation via 55cc0c7.

• We might have to allow * as a no-proxy URL, as https://github.com/datasharingframework/dsf/blob/main/dsf-common/dsf-common-config/src/main/java/dev/dsf/common/config/ProxyConfig.java#L35C1-L36C1 describes this case

I removed the special * case from the JavaDoc via c844d39. I don't think that removing the special case could be a problem for any custom process plugins code.