1 |
//---PACKAGE DECLARATION--- |
2 |
//package uk.org.iscream.cms.server.util; |
3 |
|
4 |
//---IMPORTS--- |
5 |
import uk.org.iscream.cms.server.util.*; |
6 |
import java.util.LinkedList; |
7 |
import java.util.Iterator; |
8 |
import java.net.InetAddress; |
9 |
|
10 |
/** |
11 |
* Access Control List for use primarily |
12 |
* with the ACLServerSocket. It could, however |
13 |
* have other uses as it has a fairly generic |
14 |
* behaviour. Rules are added using the add |
15 |
* method, and then checks can be made using |
16 |
* the relevant check method. |
17 |
* |
18 |
* @author $Author$ |
19 |
* @version $Id$ |
20 |
*/ |
21 |
public class ACL { |
22 |
|
23 |
//---FINAL ATTRIBUTES--- |
24 |
|
25 |
/** |
26 |
* The current CVS revision of this class |
27 |
*/ |
28 |
public static final String REVISION = "$Revision$"; |
29 |
|
30 |
/** |
31 |
* static to be used when adding an ALLOW rule to the ACL. |
32 |
*/ |
33 |
public static final boolean ALLOW = true; |
34 |
|
35 |
/** |
36 |
* static to be used when adding a DENY rule to the ACL. |
37 |
*/ |
38 |
public static final boolean DENY = false; |
39 |
|
40 |
//---STATIC METHODS--- |
41 |
|
42 |
//---CONSTRUCTORS--- |
43 |
|
44 |
/** |
45 |
* Construct a new Access Control List. The default |
46 |
* mode is to ALLOW anything that isn't explicitly |
47 |
* blocked by a rule. |
48 |
*/ |
49 |
public ACL() { |
50 |
// default to ACL.ALLOW |
51 |
this(ACL.ALLOW); |
52 |
} |
53 |
|
54 |
/** |
55 |
* Construct a new Access Control List with a given |
56 |
* default mode. This mode specifies what should |
57 |
* happen if a check does not match any rules. |
58 |
* |
59 |
* @param defaultMode the default mode for non-matched checks |
60 |
*/ |
61 |
public ACL(boolean defaultMode) { |
62 |
_defaultMode = defaultMode; |
63 |
} |
64 |
|
65 |
//---PUBLIC METHODS--- |
66 |
|
67 |
/** |
68 |
* Add a new rule to the ACL immediately after the |
69 |
* previous rule. The rule can either be an ACL.ALLOW |
70 |
* rule, or an ACL.DENY rule. The expression can |
71 |
* contain a wildcard (a * only). Rules can only be |
72 |
* added to the end of the list. |
73 |
* |
74 |
* param allow whether this is an ALLOW or DENY rule |
75 |
* param expression what this rule matches using wildcards |
76 |
*/ |
77 |
public void add(boolean allow, String expression) { |
78 |
_acl.add(new ACLRule(allow, expression)); |
79 |
} |
80 |
|
81 |
/** |
82 |
* Check to see if a string is permitted by the |
83 |
* ACL. Useful for testing, and non-Socket uses |
84 |
* of this class. |
85 |
* |
86 |
* @param address the string to check |
87 |
* @return whether the address was permitted by the ACL |
88 |
*/ |
89 |
public boolean check(String address) { |
90 |
Iterator i = _acl.iterator(); |
91 |
while(i.hasNext()) { |
92 |
ACLRule item = (ACLRule) i.next(); |
93 |
if(StringUtils.wildcardCheck(address, item._expression)) { |
94 |
return item._allow; |
95 |
} |
96 |
} |
97 |
return _defaultMode; |
98 |
} |
99 |
|
100 |
/** |
101 |
* Check to see if an InetAddress is permitted |
102 |
* by the ACL. Perfect for Socket uses of this |
103 |
* class. It should be made clear that this will |
104 |
* check both the hostname AND IP address against |
105 |
* each rule in turn. The hostname will always be |
106 |
* checked BEFORE the IP address. |
107 |
* |
108 |
* @param address the InetAddress to check |
109 |
* @return whether the InetAddress was permitted by the ACL |
110 |
*/ |
111 |
public boolean check(InetAddress address) { |
112 |
Iterator i = _acl.iterator(); |
113 |
while(i.hasNext()) { |
114 |
ACLRule item = (ACLRule) i.next(); |
115 |
if(StringUtils.wildcardCheck(address.getHostName(), item._expression)) { |
116 |
return item._allow; |
117 |
} |
118 |
if(StringUtils.wildcardCheck(address.getHostAddress(), item._expression)) { |
119 |
return item._allow; |
120 |
} |
121 |
} |
122 |
return _defaultMode; |
123 |
} |
124 |
|
125 |
/** |
126 |
* Gets the ACL as a String for debugging. |
127 |
* |
128 |
* @return A String representation of this ACL. |
129 |
*/ |
130 |
public String getStringACL() { |
131 |
String acl = ""; |
132 |
Iterator i = _acl.iterator(); |
133 |
while(i.hasNext()) { |
134 |
ACLRule item = (ACLRule) i.next(); |
135 |
if(item._allow) { |
136 |
acl += "ALLOW:" + item._expression + " "; |
137 |
} |
138 |
else { |
139 |
acl += "DENY:" + item._expression + " "; |
140 |
} |
141 |
} |
142 |
return acl.substring(0, acl.length()-1); |
143 |
} |
144 |
|
145 |
/** |
146 |
* Overrides the {@link java.lang.Object#toString() Object.toString()} |
147 |
* method to provide clean logging (every class should have this). |
148 |
* |
149 |
* This uses the uk.org.iscream.cms.server.util.FormatName class |
150 |
* to format the toString() |
151 |
* |
152 |
* @return the name of this class and its CVS revision |
153 |
*/ |
154 |
public String toString() { |
155 |
return FormatName.getName( |
156 |
_name, |
157 |
getClass().getName(), |
158 |
REVISION); |
159 |
} |
160 |
|
161 |
//---PRIVATE METHODS--- |
162 |
|
163 |
//---ACCESSOR/MUTATOR METHODS--- |
164 |
|
165 |
//---ATTRIBUTES--- |
166 |
|
167 |
/** |
168 |
* This is the friendly identifier of the |
169 |
* component this class is running in. |
170 |
* eg, a Filter may be called "filter1", |
171 |
* If this class does not have an owning |
172 |
* component, a name from the configuration |
173 |
* can be placed here. This name could also |
174 |
* be changed to null for utility classes. |
175 |
*/ |
176 |
private String _name = null; |
177 |
|
178 |
/** |
179 |
* The ACL is stored in this LinkedList. |
180 |
* This is ideal as the list is always searched |
181 |
* from beginning to end in an iterative fashion. |
182 |
*/ |
183 |
private LinkedList _acl = new LinkedList(); |
184 |
|
185 |
/** |
186 |
* The default mode of this ACL. |
187 |
*/ |
188 |
private boolean _defaultMode; |
189 |
|
190 |
//---STATIC ATTRIBUTES--- |
191 |
|
192 |
//---INNER CLASSES--- |
193 |
|
194 |
/** |
195 |
* Wrapper class for an ACL rule. |
196 |
*/ |
197 |
private class ACLRule { |
198 |
|
199 |
/** |
200 |
* Construct an ACL rule. |
201 |
* |
202 |
* @param allow whether this is an ALLOW or DENY rule |
203 |
* @param expression what this rule matches |
204 |
*/ |
205 |
private ACLRule(boolean allow, String expression) { |
206 |
_allow = allow; |
207 |
_expression = expression; |
208 |
} |
209 |
|
210 |
/** |
211 |
* Whether this is an ALLOW or DENY rule. |
212 |
*/ |
213 |
private boolean _allow; |
214 |
|
215 |
/** |
216 |
* What this rule matches. |
217 |
*/ |
218 |
private String _expression; |
219 |
|
220 |
} |
221 |
|
222 |
} |