ViewVC Help

View File | Revision Log | Show Annotations | Revision Graph | Root Listing

root/i-scream/experimental/server/ACL/ACL.java

Comparing experimental/server/ACL/ACL.java (file contents):
Revision 1.2 by tdb, Thu Dec 20 00:59:54 2001 UTC vs.
Revision 1.12 by tdb, Tue Jan 8 13:31:34 2002 UTC

#	Line 3 | Line 3
3
4		//---IMPORTS---
5		import uk.org.iscream.cms.server.util.*;
6	<	import java.util.LinkedList;
7	<	import java.util.Iterator;
6	>	import java.util.ArrayList;
7	>	import java.util.StringTokenizer;
8		import java.net.InetAddress;
9	+	import java.io.Serializable;
10
11		/**
12		* Access Control List for use primarily
#	Line 18 | Line 19 | import java.net.InetAddress;
19		* @author  $Author$
20		* @version $Id$
21		*/
22	<	public class ACL {
22	>	public class ACL implements Serializable {
23
24		//---FINAL ATTRIBUTES---
25
#	Line 75 | Line 76 | public class ACL {
76		* param expression what this rule matches using wildcards
77		*/
78		public void add(boolean allow, String expression) {
79	<	_acl.add(new ACLRule(allow, expression));
79	>	// try and convert the expression into an IP address
80	>	short[] ipaddr = ipStringToShort(expression);
81	>	// a result of null means it's not an IP address
82	>	// add either a name rule or an IP rule
83	>	if(ipaddr != null) {
84	>	_acl.add(new ACLRule(allow, expression, ipaddr, true));
85	>	}
86	>	else {
87	>	_acl.add(new ACLRule(allow, expression, ipaddr, false));
88	>	}
89		}
90
91		/**
#	Line 87 | Line 97 | public class ACL {
97		* @return whether the address was permitted by the ACL
98		*/
99		public boolean check(String address) {
100	<	Iterator i = _acl.iterator();
101	<	while(i.hasNext()) {
102	<	ACLRule item = (ACLRule) i.next();
103	<	if(StringUtils.wildcardCheck(address, item._expression)) {
94	<	return item._allow;
100	>	for(int i=0; i < _acl.size(); i++) {
101	>	ACLRule rule = (ACLRule) _acl.get(i);
102	>	if(StringUtils.wildcardMatch(address, rule._expression)) {
103	>	return rule._allow;
104		}
105		}
106		return _defaultMode;
#	Line 100 | Line 109 | public class ACL {
109		/**
110		* Check to see if an InetAddress is permitted
111		* by the ACL. Perfect for Socket uses of this
112	<	* class. It should be made clear that this will
113	<	* check both the hostname AND IP address against
114	<	* each rule in turn. The hostname will always be
115	<	* checked BEFORE the IP address.
112	>	* class. A rule will either be for a name, or
113	>	* an IP address (this is determined in the add
114	>	* method), and the appropriate comparison will
115	>	* be performed.
116		*
117		* @param address the InetAddress to check
118		* @return whether the InetAddress was permitted by the ACL
119		*/
120		public boolean check(InetAddress address) {
121	<	Iterator i = _acl.iterator();
122	<	while(i.hasNext()) {
123	<	ACLRule item = (ACLRule) i.next();
124	<	if(StringUtils.wildcardCheck(address.getHostName(), item._expression)) {
125	<	return item._allow;
121	>	// gather the details first
122	>	String hostname = address.getHostName();
123	>	String ip = address.getHostAddress();
124	>	short[] ipaddr = ipStringToShort(ip);
125	>	// check each rule against this InetAddress
126	>	for(int i=0; i < _acl.size(); i++) {
127	>	ACLRule rule = (ACLRule) _acl.get(i);
128	>	if(rule._iprule) {
129	>	// if this is an IP rule do a short comparison
130	>	// must specify the wildcarded rule first
131	>	if(compareShorts(rule._ipaddr, ipaddr)) {
132	>	return rule._allow;
133	>	}
134		}
135	<	if(StringUtils.wildcardCheck(address.getHostAddress(), item._expression)) {
136	<	return item._allow;
135	>	else {
136	>	// if not do a full blown String comparsion
137	>	if(StringUtils.wildcardMatch(hostname, rule._expression)) {
138	>	return rule._allow;
139	>	}
140		}
141	+
142		}
143	+	// if we haven't matched a rule, return the default
144		return _defaultMode;
145		}
146
147		/**
148	<	* Gets the ACL as a String for debugging.
148	>	* Gives a String representation of this ACL.
149		*
150		* @return A String representation of this ACL.
151		*/
152	<	public String getStringACL() {
153	<	String acl = "";
154	<	Iterator i = _acl.iterator();
155	<	while(i.hasNext()) {
156	<	ACLRule item = (ACLRule) i.next();
157	<	if(item._allow) {
158	<	acl += "ALLOW:" + item._expression + " ";
152	>	public String toString() {
153	>	StringBuffer acl = new StringBuffer();
154	>	// put in the i-scream toString code
155	>	acl.append(FormatName.getName(_name, getClass().getName(), REVISION));
156	>	acl.append("{");
157	>	// put the value of each Rule in the result
158	>	for(int i=0; i < _acl.size(); i++) {
159	>	acl.append((ACLRule) _acl.get(i));
160	>	acl.append(",");
161	>	}
162	>	// put the default mode in the result
163	>	if(_defaultMode) {
164	>	acl.append("DEFAULT=ALLOW");
165	>	}
166	>	else {
167	>	acl.append("DEFAULT=DENY");
168	>	}
169	>	acl.append("}");
170	>	return acl.toString();
171	>	}
172	>
173	>	//---PRIVATE METHODS---
174	>
175	>	/**
176	>	* Converts an IP address in String format into
177	>	* a short array of length 4. Any wildcards, *,
178	>	* found in the IP address are represented by
179	>	* a -1. If the given String is not an IP address
180	>	* null is returned instead.
181	>	*
182	>	* @param ip The IP address in String format
183	>	* @return The IP address in a short[]
184	>	*/
185	>	private short[] ipStringToShort(String ip) {
186	>	// default to expecting it to be an IP
187	>	// we will try to disprove this :)
188	>	short[] ipaddr = {-1, -1, -1, -1};
189	>	int i = 0;
190	>	String s = "";
191	>	// tokenize the String on fullstops, so we can break
192	>	// up the quads of an IP (if it's an IP!)
193	>	StringTokenizer st = new StringTokenizer(ip, ".");
194	>	while(st.hasMoreTokens() && i++ < 4) {
195	>	s = st.nextToken();
196	>	// if it's a wildcard, we'll skip to the next one
197	>	// as no more checks are required
198	>	if(s.equals("*")) {
199	>	continue;
200		}
201	<	else {
202	<	acl += "DENY:" + item._expression + " ";
201	>	// attempt to parse it into a short
202	>	try {
203	>	short n = Short.parseShort(s);
204	>	// if it's an int but outside of the
205	>	// valid range, it can't be an IP
206	>	if(n < 0 || n > 255) {
207	>	// give up checking further
208	>	return null;
209	>	}
210	>	ipaddr[i-1] = n;
211		}
212	+	// if it didn't parse as a short it can't be an IP
213	+	catch (NumberFormatException e) {
214	+	// give up checking further
215	+	return null;
216	+	}
217		}
218	<	return acl.substring(0, acl.length()-1);
218	>	// we've done 4 parts, so if there's any
219	>	// more this can't be an IP
220	>	if(st.hasMoreTokens()) {
221	>	return null;
222	>	}
223	>	// if we've done less than 4, see if the last one
224	>	// was a wildcard - if it isn't then it's not an IP
225	>	//   -- this allows 129.12.*
226	>	if(i < 4 && !s.equals("*")) {
227	>	return null;
228	>	}
229	>	// if we had one or less entries it can't be an IP
230	>	//   -- this disallows * matching as an IP due
231	>	//      to the rule above
232	>	if(i <= 1) {
233	>	return null;
234	>	}
235	>	return ipaddr;
236		}
237
238		/**
239	<	* Overrides the {@link java.lang.Object#toString() Object.toString()}
240	<	* method to provide clean logging (every class should have this).
239	>	* Compares two short arrays. The first array can contain a -1,
240	>	* which will always match any value -- it's a wildcard.
241	>	* They must be the same length to match.
242		*
243	<	* This uses the uk.org.iscream.cms.server.util.FormatName class
244	<	* to format the toString()
245	<	*
152	<	* @return the name of this class and its CVS revision
243	>	* @param first The first array to compare (with -1 wildcard if required)
244	>	* @param second The second array to compare
245	>	* @result the result of the comparison
246		*/
247	<	public String toString() {
248	<	return FormatName.getName(
249	<	_name,
250	<	getClass().getName(),
251	<	REVISION);
247	>	private boolean compareShorts(short[] first, short[] second) {
248	>	if(first.length != second.length) {
249	>	return false;
250	>	}
251	>	for(int i=0; i < first.length; i++) {
252	>	if(first[i] == -1) {
253	>	continue;
254	>	}
255	>	if(first[i] != second[i]) {
256	>	return false;
257	>	}
258	>	}
259	>	return true;
260		}
261
161	–	//---PRIVATE METHODS---
162	–
262		//---ACCESSOR/MUTATOR METHODS---
263
264		//---ATTRIBUTES---
#	Line 176 | Line 275 | public class ACL {
275		private String _name = null;
276
277		/**
278	<	* The ACL is stored in this LinkedList.
180	<	* This is ideal as the list is always searched
181	<	* from beginning to end in an iterative fashion.
278	>	* The ACL is stored in this ArrayList.
279		*/
280	<	private LinkedList _acl = new LinkedList();
280	>	private ArrayList _acl = new ArrayList();
281
282		/**
283		* The default mode of this ACL.
#	Line 194 | Line 291 | public class ACL {
291		/**
292		* Wrapper class for an ACL rule.
293		*/
294	<	private class ACLRule {
294	>	private class ACLRule implements Serializable {
295
296		/**
297		* Construct an ACL rule.
298		*
299		* @param allow whether this is an ALLOW or DENY rule
300		* @param expression what this rule matches
301	+	* @param ipaddr the IP address wildcard this rule matches if it's an IP rule
302	+	* @param iprule whether this is an IP rule
303		*/
304	<	private ACLRule(boolean allow, String expression) {
304	>	private ACLRule(boolean allow, String expression, short[] ipaddr, boolean iprule) {
305		_allow = allow;
306		_expression = expression;
307	+	_ipaddr = ipaddr;
308	+	_iprule = iprule;
309		}
310
311		/**
312	+	* Returns a String representation of this rule.
313	+	*
314	+	* @return A String representation of this rule.
315	+	*/
316	+	public String toString() {
317	+	if(_allow) {
318	+	return _expression + "=ALLOW";
319	+	}
320	+	else {
321	+	return _expression + "=DENY";
322	+	}
323	+	}
324	+
325	+	/**
326		* Whether this is an ALLOW or DENY rule.
327		*/
328		private boolean _allow;
#	Line 216 | Line 331 | public class ACL {
331		* What this rule matches.
332		*/
333		private String _expression;
334	+
335	+	/**
336	+	* The IP wildcard, only valid if this
337	+	* is an IP rule.
338	+	*/
339	+	private short[] _ipaddr;
340	+
341	+	/**
342	+	* Whether this is an IP rule.
343	+	*/
344	+	private boolean _iprule;
345
346		}
347

Diff Legend

–	Removed lines
+	Added lines
<	Changed lines
>	Changed lines