ViewVC Help

View File | Revision Log | Show Annotations | Revision Graph | Root Listing

root/i-scream/experimental/server/ACL/ACL.java

Comparing experimental/server/ACL/ACL.java (file contents):
Revision 1.3 by tdb, Fri Dec 21 16:49:18 2001 UTC vs.
Revision 1.12 by tdb, Tue Jan 8 13:31:34 2002 UTC

#	Line 4 | Line 4
4		//---IMPORTS---
5		import uk.org.iscream.cms.server.util.*;
6		import java.util.ArrayList;
7	+	import java.util.StringTokenizer;
8		import java.net.InetAddress;
9	+	import java.io.Serializable;
10
11		/**
12		* Access Control List for use primarily
#	Line 17 | Line 19 | import java.net.InetAddress;
19		* @author  $Author$
20		* @version $Id$
21		*/
22	<	public class ACL {
22	>	public class ACL implements Serializable {
23
24		//---FINAL ATTRIBUTES---
25
#	Line 74 | Line 76 | public class ACL {
76		* param expression what this rule matches using wildcards
77		*/
78		public void add(boolean allow, String expression) {
79	<	_acl.add(new ACLRule(allow, expression));
79	>	// try and convert the expression into an IP address
80	>	short[] ipaddr = ipStringToShort(expression);
81	>	// a result of null means it's not an IP address
82	>	// add either a name rule or an IP rule
83	>	if(ipaddr != null) {
84	>	_acl.add(new ACLRule(allow, expression, ipaddr, true));
85	>	}
86	>	else {
87	>	_acl.add(new ACLRule(allow, expression, ipaddr, false));
88	>	}
89		}
90
91		/**
#	Line 88 | Line 99 | public class ACL {
99		public boolean check(String address) {
100		for(int i=0; i < _acl.size(); i++) {
101		ACLRule rule = (ACLRule) _acl.get(i);
102	<	if(StringUtils.wildcardCheck(address, rule._expression)) {
102	>	if(StringUtils.wildcardMatch(address, rule._expression)) {
103		return rule._allow;
104		}
105		}
#	Line 98 | Line 109 | public class ACL {
109		/**
110		* Check to see if an InetAddress is permitted
111		* by the ACL. Perfect for Socket uses of this
112	<	* class. It should be made clear that this will
113	<	* check both the hostname AND IP address against
114	<	* each rule in turn. The hostname will always be
115	<	* checked BEFORE the IP address.
112	>	* class. A rule will either be for a name, or
113	>	* an IP address (this is determined in the add
114	>	* method), and the appropriate comparison will
115	>	* be performed.
116		*
117		* @param address the InetAddress to check
118		* @return whether the InetAddress was permitted by the ACL
119		*/
120		public boolean check(InetAddress address) {
121	+	// gather the details first
122	+	String hostname = address.getHostName();
123	+	String ip = address.getHostAddress();
124	+	short[] ipaddr = ipStringToShort(ip);
125	+	// check each rule against this InetAddress
126		for(int i=0; i < _acl.size(); i++) {
127		ACLRule rule = (ACLRule) _acl.get(i);
128	<	if(StringUtils.wildcardCheck(address.getHostName(), rule._expression)) {
129	<	return rule._allow;
128	>	if(rule._iprule) {
129	>	// if this is an IP rule do a short comparison
130	>	// must specify the wildcarded rule first
131	>	if(compareShorts(rule._ipaddr, ipaddr)) {
132	>	return rule._allow;
133	>	}
134		}
135	<	if(StringUtils.wildcardCheck(address.getHostAddress(), rule._expression)) {
136	<	return rule._allow;
135	>	else {
136	>	// if not do a full blown String comparsion
137	>	if(StringUtils.wildcardMatch(hostname, rule._expression)) {
138	>	return rule._allow;
139	>	}
140		}
141	+
142		}
143	+	// if we haven't matched a rule, return the default
144		return _defaultMode;
145		}
146
147		/**
148	<	* Gets the ACL as a String for debugging.
148	>	* Gives a String representation of this ACL.
149		*
150		* @return A String representation of this ACL.
151		*/
152	<	public String getStringACL() {
153	<	String acl = "";
152	>	public String toString() {
153	>	StringBuffer acl = new StringBuffer();
154	>	// put in the i-scream toString code
155	>	acl.append(FormatName.getName(_name, getClass().getName(), REVISION));
156	>	acl.append("{");
157	>	// put the value of each Rule in the result
158		for(int i=0; i < _acl.size(); i++) {
159	<	ACLRule rule = (ACLRule) _acl.get(i);
160	<	if(rule._allow) {
132	<	acl += "ALLOW:" + rule._expression + " ";
133	<	}
134	<	else {
135	<	acl += "DENY:" + rule._expression + " ";
136	<	}
159	>	acl.append((ACLRule) _acl.get(i));
160	>	acl.append(",");
161		}
162	+	// put the default mode in the result
163		if(_defaultMode) {
164	<	acl += "DEFAULT:ALLOW";
164	>	acl.append("DEFAULT=ALLOW");
165		}
166		else {
167	<	acl += "DEFAULT:DENY";
167	>	acl.append("DEFAULT=DENY");
168		}
169	<	return acl;
169	>	acl.append("}");
170	>	return acl.toString();
171		}
172	+
173	+	//---PRIVATE METHODS---
174	+
175	+	/**
176	+	* Converts an IP address in String format into
177	+	* a short array of length 4. Any wildcards, *,
178	+	* found in the IP address are represented by
179	+	* a -1. If the given String is not an IP address
180	+	* null is returned instead.
181	+	*
182	+	* @param ip The IP address in String format
183	+	* @return The IP address in a short[]
184	+	*/
185	+	private short[] ipStringToShort(String ip) {
186	+	// default to expecting it to be an IP
187	+	// we will try to disprove this :)
188	+	short[] ipaddr = {-1, -1, -1, -1};
189	+	int i = 0;
190	+	String s = "";
191	+	// tokenize the String on fullstops, so we can break
192	+	// up the quads of an IP (if it's an IP!)
193	+	StringTokenizer st = new StringTokenizer(ip, ".");
194	+	while(st.hasMoreTokens() && i++ < 4) {
195	+	s = st.nextToken();
196	+	// if it's a wildcard, we'll skip to the next one
197	+	// as no more checks are required
198	+	if(s.equals("*")) {
199	+	continue;
200	+	}
201	+	// attempt to parse it into a short
202	+	try {
203	+	short n = Short.parseShort(s);
204	+	// if it's an int but outside of the
205	+	// valid range, it can't be an IP
206	+	if(n < 0 || n > 255) {
207	+	// give up checking further
208	+	return null;
209	+	}
210	+	ipaddr[i-1] = n;
211	+	}
212	+	// if it didn't parse as a short it can't be an IP
213	+	catch (NumberFormatException e) {
214	+	// give up checking further
215	+	return null;
216	+	}
217	+	}
218	+	// we've done 4 parts, so if there's any
219	+	// more this can't be an IP
220	+	if(st.hasMoreTokens()) {
221	+	return null;
222	+	}
223	+	// if we've done less than 4, see if the last one
224	+	// was a wildcard - if it isn't then it's not an IP
225	+	//   -- this allows 129.12.*
226	+	if(i < 4 && !s.equals("*")) {
227	+	return null;
228	+	}
229	+	// if we had one or less entries it can't be an IP
230	+	//   -- this disallows * matching as an IP due
231	+	//      to the rule above
232	+	if(i <= 1) {
233	+	return null;
234	+	}
235	+	return ipaddr;
236	+	}
237
238		/**
239	<	* Overrides the {@link java.lang.Object#toString() Object.toString()}
240	<	* method to provide clean logging (every class should have this).
239	>	* Compares two short arrays. The first array can contain a -1,
240	>	* which will always match any value -- it's a wildcard.
241	>	* They must be the same length to match.
242		*
243	<	* This uses the uk.org.iscream.cms.server.util.FormatName class
244	<	* to format the toString()
245	<	*
154	<	* @return the name of this class and its CVS revision
243	>	* @param first The first array to compare (with -1 wildcard if required)
244	>	* @param second The second array to compare
245	>	* @result the result of the comparison
246		*/
247	<	public String toString() {
248	<	return FormatName.getName(
249	<	_name,
250	<	getClass().getName(),
251	<	REVISION);
247	>	private boolean compareShorts(short[] first, short[] second) {
248	>	if(first.length != second.length) {
249	>	return false;
250	>	}
251	>	for(int i=0; i < first.length; i++) {
252	>	if(first[i] == -1) {
253	>	continue;
254	>	}
255	>	if(first[i] != second[i]) {
256	>	return false;
257	>	}
258	>	}
259	>	return true;
260		}
261
163	–	//---PRIVATE METHODS---
164	–
262		//---ACCESSOR/MUTATOR METHODS---
263
264		//---ATTRIBUTES---
#	Line 194 | Line 291 | public class ACL {
291		/**
292		* Wrapper class for an ACL rule.
293		*/
294	<	private class ACLRule {
294	>	private class ACLRule implements Serializable {
295
296		/**
297		* Construct an ACL rule.
298		*
299		* @param allow whether this is an ALLOW or DENY rule
300		* @param expression what this rule matches
301	+	* @param ipaddr the IP address wildcard this rule matches if it's an IP rule
302	+	* @param iprule whether this is an IP rule
303		*/
304	<	private ACLRule(boolean allow, String expression) {
304	>	private ACLRule(boolean allow, String expression, short[] ipaddr, boolean iprule) {
305		_allow = allow;
306		_expression = expression;
307	+	_ipaddr = ipaddr;
308	+	_iprule = iprule;
309		}
310
311		/**
312	+	* Returns a String representation of this rule.
313	+	*
314	+	* @return A String representation of this rule.
315	+	*/
316	+	public String toString() {
317	+	if(_allow) {
318	+	return _expression + "=ALLOW";
319	+	}
320	+	else {
321	+	return _expression + "=DENY";
322	+	}
323	+	}
324	+
325	+	/**
326		* Whether this is an ALLOW or DENY rule.
327		*/
328		private boolean _allow;
#	Line 216 | Line 331 | public class ACL {
331		* What this rule matches.
332		*/
333		private String _expression;
334	+
335	+	/**
336	+	* The IP wildcard, only valid if this
337	+	* is an IP rule.
338	+	*/
339	+	private short[] _ipaddr;
340	+
341	+	/**
342	+	* Whether this is an IP rule.
343	+	*/
344	+	private boolean _iprule;
345
346		}
347

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines