ViewVC Help

View File | Revision Log | Show Annotations | Revision Graph | Root Listing

root/i-scream/experimental/server/ACL/ACL.java

Comparing experimental/server/ACL/ACL.java (file contents):
Revision 1.8 by tdb, Mon Dec 31 02:57:00 2001 UTC vs.
Revision 1.12 by tdb, Tue Jan 8 13:31:34 2002 UTC

#	Line 76 | Line 76 | public class ACL implements Serializable {
76		* param expression what this rule matches using wildcards
77		*/
78		public void add(boolean allow, String expression) {
79	<	// default to expecting it to be an IP
80	<	// we will try to disprove this :)
81	<	boolean ip = true;
82	<	short[] ipaddr = {-1, -1, -1, -1};
83	<	int i = 0;
84	<	String s = "";
85	<	// tokenize the expression on fullstops, so we can break
86	<	// up the quads of an IP (if it's an IP!)
87	<	StringTokenizer st = new StringTokenizer(expression, ".");
88	<	while(st.hasMoreTokens() && i++ < 4) {
89	<	s = st.nextToken();
90	<	// if it's a wildcard, we'll skip to the next one
91	<	// as no more checks are required
92	<	if(s.equals("*")) {
93	<	continue;
94	<	}
95	<	// attempt to parse it into a short
96	<	try {
97	<	short n = Short.parseShort(s);
98	<	// if it's an int but outside of the
99	<	// valid range, it can't be an IP
100	<	if(n < 0 || n > 255) {
101	<	ip = false;
102	<	// give up checking further
103	<	break;
104	<	}
105	<	ipaddr[i-1] = n;
106	<	}
107	<	// if it didn't parse as an int it can't be an IP
108	<	catch (NumberFormatException e) {
109	<	ip = false;
110	<	// give up checking further
111	<	break;
112	<	}
79	>	// try and convert the expression into an IP address
80	>	short[] ipaddr = ipStringToShort(expression);
81	>	// a result of null means it's not an IP address
82	>	// add either a name rule or an IP rule
83	>	if(ipaddr != null) {
84	>	_acl.add(new ACLRule(allow, expression, ipaddr, true));
85		}
86	<	// we've done 4 parts, so if there's any
87	<	// more this can't be an IP
116	<	if(st.hasMoreTokens()) {
117	<	ip = false;
86	>	else {
87	>	_acl.add(new ACLRule(allow, expression, ipaddr, false));
88		}
119	–	// if we've done less than 4, see if the last one
120	–	// was a wildcard - if it isn't then it's not an IP
121	–	//   -- this allows 129.12.*
122	–	if(i < 4 && !s.equals("*")) {
123	–	ip = false;
124	–	}
125	–	// if we had one or less entries it can't be an IP
126	–	//   -- this disallows * matching as an IP due
127	–	//      to the rule above
128	–	if(i <= 1) {
129	–	ip = false;
130	–	}
131	–	// finally print out what we've found.
132	–	System.out.println("IP("+ip+"): "+expression);
133	–	if(ip) {
134	–	for(int j=0; j < ipaddr.length; j++) {
135	–	System.out.print(ipaddr[j] + " ");
136	–	}
137	–	System.out.println();
138	–	}
139	–	_acl.add(new ACLRule(allow, expression, ipaddr, ip));
89		}
90
91		/**
#	Line 150 | Line 99 | public class ACL implements Serializable {
99		public boolean check(String address) {
100		for(int i=0; i < _acl.size(); i++) {
101		ACLRule rule = (ACLRule) _acl.get(i);
102	<	if(StringUtils.wildcardCheck(address, rule._expression)) {
102	>	if(StringUtils.wildcardMatch(address, rule._expression)) {
103		return rule._allow;
104		}
105		}
#	Line 160 | Line 109 | public class ACL implements Serializable {
109		/**
110		* Check to see if an InetAddress is permitted
111		* by the ACL. Perfect for Socket uses of this
112	<	* class. It should be made clear that this will
113	<	* check both the hostname AND IP address against
114	<	* each rule in turn. The hostname will always be
115	<	* checked BEFORE the IP address.
112	>	* class. A rule will either be for a name, or
113	>	* an IP address (this is determined in the add
114	>	* method), and the appropriate comparison will
115	>	* be performed.
116		*
117		* @param address the InetAddress to check
118		* @return whether the InetAddress was permitted by the ACL
119		*/
120		public boolean check(InetAddress address) {
121	+	// gather the details first
122		String hostname = address.getHostName();
123		String ip = address.getHostAddress();
124		short[] ipaddr = ipStringToShort(ip);
125	+	// check each rule against this InetAddress
126		for(int i=0; i < _acl.size(); i++) {
127		ACLRule rule = (ACLRule) _acl.get(i);
128		if(rule._iprule) {
129	<	System.out.println("checking ip rule "+rule._expression);
130	<	//if(StringUtils.wildcardCheck(ip, rule._expression)) {
131	<	if(compareShorts(ipaddr, rule._ipaddr)) {
129	>	// if this is an IP rule do a short comparison
130	>	// must specify the wildcarded rule first
131	>	if(compareShorts(rule._ipaddr, ipaddr)) {
132		return rule._allow;
133		}
134		}
135		else {
136	<	System.out.println("checking name rule: "+rule._expression);
137	<	if(StringUtils.wildcardCheck(hostname, rule._expression)) {
136	>	// if not do a full blown String comparsion
137	>	if(StringUtils.wildcardMatch(hostname, rule._expression)) {
138		return rule._allow;
139		}
140		}
141
142		}
143	+	// if we haven't matched a rule, return the default
144		return _defaultMode;
145		}
146
#	Line 199 | Line 151 | public class ACL implements Serializable {
151		*/
152		public String toString() {
153		StringBuffer acl = new StringBuffer();
154	+	// put in the i-scream toString code
155		acl.append(FormatName.getName(_name, getClass().getName(), REVISION));
156		acl.append("{");
157	+	// put the value of each Rule in the result
158		for(int i=0; i < _acl.size(); i++) {
159		acl.append((ACLRule) _acl.get(i));
160		acl.append(",");
161		}
162	+	// put the default mode in the result
163		if(_defaultMode) {
164		acl.append("DEFAULT=ALLOW");
165		}
#	Line 217 | Line 172 | public class ACL implements Serializable {
172
173		//---PRIVATE METHODS---
174
175	+	/**
176	+	* Converts an IP address in String format into
177	+	* a short array of length 4. Any wildcards, *,
178	+	* found in the IP address are represented by
179	+	* a -1. If the given String is not an IP address
180	+	* null is returned instead.
181	+	*
182	+	* @param ip The IP address in String format
183	+	* @return The IP address in a short[]
184	+	*/
185		private short[] ipStringToShort(String ip) {
186	+	// default to expecting it to be an IP
187	+	// we will try to disprove this :)
188		short[] ipaddr = {-1, -1, -1, -1};
189	+	int i = 0;
190	+	String s = "";
191	+	// tokenize the String on fullstops, so we can break
192	+	// up the quads of an IP (if it's an IP!)
193		StringTokenizer st = new StringTokenizer(ip, ".");
194	<	for(int i=0; i < 4 && st.hasMoreTokens(); i++) {
194	>	while(st.hasMoreTokens() && i++ < 4) {
195	>	s = st.nextToken();
196	>	// if it's a wildcard, we'll skip to the next one
197	>	// as no more checks are required
198	>	if(s.equals("*")) {
199	>	continue;
200	>	}
201	>	// attempt to parse it into a short
202		try {
203	<	ipaddr[i] = Short.parseShort(st.nextToken());
203	>	short n = Short.parseShort(s);
204	>	// if it's an int but outside of the
205	>	// valid range, it can't be an IP
206	>	if(n < 0 || n > 255) {
207	>	// give up checking further
208	>	return null;
209	>	}
210	>	ipaddr[i-1] = n;
211		}
212	<	catch(NumberFormatException e) {
213	<	// do nothing?
212	>	// if it didn't parse as a short it can't be an IP
213	>	catch (NumberFormatException e) {
214	>	// give up checking further
215	>	return null;
216		}
217		}
218	+	// we've done 4 parts, so if there's any
219	+	// more this can't be an IP
220	+	if(st.hasMoreTokens()) {
221	+	return null;
222	+	}
223	+	// if we've done less than 4, see if the last one
224	+	// was a wildcard - if it isn't then it's not an IP
225	+	//   -- this allows 129.12.*
226	+	if(i < 4 && !s.equals("*")) {
227	+	return null;
228	+	}
229	+	// if we had one or less entries it can't be an IP
230	+	//   -- this disallows * matching as an IP due
231	+	//      to the rule above
232	+	if(i <= 1) {
233	+	return null;
234	+	}
235		return ipaddr;
236		}
237
238	+	/**
239	+	* Compares two short arrays. The first array can contain a -1,
240	+	* which will always match any value -- it's a wildcard.
241	+	* They must be the same length to match.
242	+	*
243	+	* @param first The first array to compare (with -1 wildcard if required)
244	+	* @param second The second array to compare
245	+	* @result the result of the comparison
246	+	*/
247		private boolean compareShorts(short[] first, short[] second) {
248		if(first.length != second.length) {
236	–	System.out.println("not equal length");
249		return false;
250		}
251		for(int i=0; i < first.length; i++) {
252	<	// -- might want to consider specify which is the wildcard one?
241	<	System.out.println(i + ":" + first[i] + "," + second[i]);
242	<	if(first[i] == -1 || second[i] == -1) {
252	>	if(first[i] == -1) {
253		continue;
254		}
255		if(first[i] != second[i]) {
246	–	System.out.println("not equal");
256		return false;
257		}
258		}
250	–	System.out.println("equal");
259		return true;
260		}
261
#	Line 290 | Line 298 | public class ACL implements Serializable {
298		*
299		* @param allow whether this is an ALLOW or DENY rule
300		* @param expression what this rule matches
301	+	* @param ipaddr the IP address wildcard this rule matches if it's an IP rule
302		* @param iprule whether this is an IP rule
303		*/
304		private ACLRule(boolean allow, String expression, short[] ipaddr, boolean iprule) {
#	Line 323 | Line 332 | public class ACL implements Serializable {
332		*/
333		private String _expression;
334
335	+	/**
336	+	* The IP wildcard, only valid if this
337	+	* is an IP rule.
338	+	*/
339		private short[] _ipaddr;
340
341		/**

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines