--- experimental/server/ACL/ACL.java 2001/12/20 00:59:54 1.2 +++ experimental/server/ACL/ACL.java 2001/12/31 02:57:00 1.8 @@ -3,9 +3,10 @@ //---IMPORTS--- import uk.org.iscream.cms.server.util.*; -import java.util.LinkedList; -import java.util.Iterator; +import java.util.ArrayList; +import java.util.StringTokenizer; import java.net.InetAddress; +import java.io.Serializable; /** * Access Control List for use primarily @@ -16,16 +17,16 @@ import java.net.InetAddress; * the relevant check method. * * @author $Author: tdb $ - * @version $Id: ACL.java,v 1.2 2001/12/20 00:59:54 tdb Exp $ + * @version $Id: ACL.java,v 1.8 2001/12/31 02:57:00 tdb Exp $ */ -public class ACL { +public class ACL implements Serializable { //---FINAL ATTRIBUTES--- /** * The current CVS revision of this class */ - public static final String REVISION = "$Revision: 1.2 $"; + public static final String REVISION = "$Revision: 1.8 $"; /** * static to be used when adding an ALLOW rule to the ACL. @@ -75,7 +76,67 @@ public class ACL { * param expression what this rule matches using wildcards */ public void add(boolean allow, String expression) { - _acl.add(new ACLRule(allow, expression)); + // default to expecting it to be an IP + // we will try to disprove this :) + boolean ip = true; + short[] ipaddr = {-1, -1, -1, -1}; + int i = 0; + String s = ""; + // tokenize the expression on fullstops, so we can break + // up the quads of an IP (if it's an IP!) + StringTokenizer st = new StringTokenizer(expression, "."); + while(st.hasMoreTokens() && i++ < 4) { + s = st.nextToken(); + // if it's a wildcard, we'll skip to the next one + // as no more checks are required + if(s.equals("*")) { + continue; + } + // attempt to parse it into a short + try { + short n = Short.parseShort(s); + // if it's an int but outside of the + // valid range, it can't be an IP + if(n < 0 || n > 255) { + ip = false; + // give up checking further + break; + } + ipaddr[i-1] = n; + } + // if it didn't parse as an int it can't be an IP + catch (NumberFormatException e) { + ip = false; + // give up checking further + break; + } + } + // we've done 4 parts, so if there's any + // more this can't be an IP + if(st.hasMoreTokens()) { + ip = false; + } + // if we've done less than 4, see if the last one + // was a wildcard - if it isn't then it's not an IP + // -- this allows 129.12.* + if(i < 4 && !s.equals("*")) { + ip = false; + } + // if we had one or less entries it can't be an IP + // -- this disallows * matching as an IP due + // to the rule above + if(i <= 1) { + ip = false; + } + // finally print out what we've found. + System.out.println("IP("+ip+"): "+expression); + if(ip) { + for(int j=0; j < ipaddr.length; j++) { + System.out.print(ipaddr[j] + " "); + } + System.out.println(); + } + _acl.add(new ACLRule(allow, expression, ipaddr, ip)); } /** @@ -87,11 +148,10 @@ public class ACL { * @return whether the address was permitted by the ACL */ public boolean check(String address) { - Iterator i = _acl.iterator(); - while(i.hasNext()) { - ACLRule item = (ACLRule) i.next(); - if(StringUtils.wildcardCheck(address, item._expression)) { - return item._allow; + for(int i=0; i < _acl.size(); i++) { + ACLRule rule = (ACLRule) _acl.get(i); + if(StringUtils.wildcardCheck(address, rule._expression)) { + return rule._allow; } } return _defaultMode; @@ -109,57 +169,88 @@ public class ACL { * @return whether the InetAddress was permitted by the ACL */ public boolean check(InetAddress address) { - Iterator i = _acl.iterator(); - while(i.hasNext()) { - ACLRule item = (ACLRule) i.next(); - if(StringUtils.wildcardCheck(address.getHostName(), item._expression)) { - return item._allow; + String hostname = address.getHostName(); + String ip = address.getHostAddress(); + short[] ipaddr = ipStringToShort(ip); + for(int i=0; i < _acl.size(); i++) { + ACLRule rule = (ACLRule) _acl.get(i); + if(rule._iprule) { + System.out.println("checking ip rule "+rule._expression); + //if(StringUtils.wildcardCheck(ip, rule._expression)) { + if(compareShorts(ipaddr, rule._ipaddr)) { + return rule._allow; + } } - if(StringUtils.wildcardCheck(address.getHostAddress(), item._expression)) { - return item._allow; + else { + System.out.println("checking name rule: "+rule._expression); + if(StringUtils.wildcardCheck(hostname, rule._expression)) { + return rule._allow; + } } + } return _defaultMode; } /** - * Gets the ACL as a String for debugging. + * Gives a String representation of this ACL. * * @return A String representation of this ACL. */ - public String getStringACL() { - String acl = ""; - Iterator i = _acl.iterator(); - while(i.hasNext()) { - ACLRule item = (ACLRule) i.next(); - if(item._allow) { - acl += "ALLOW:" + item._expression + " "; + public String toString() { + StringBuffer acl = new StringBuffer(); + acl.append(FormatName.getName(_name, getClass().getName(), REVISION)); + acl.append("{"); + for(int i=0; i < _acl.size(); i++) { + acl.append((ACLRule) _acl.get(i)); + acl.append(","); + } + if(_defaultMode) { + acl.append("DEFAULT=ALLOW"); + } + else { + acl.append("DEFAULT=DENY"); + } + acl.append("}"); + return acl.toString(); + } + +//---PRIVATE METHODS--- + + private short[] ipStringToShort(String ip) { + short[] ipaddr = {-1, -1, -1, -1}; + StringTokenizer st = new StringTokenizer(ip, "."); + for(int i=0; i < 4 && st.hasMoreTokens(); i++) { + try { + ipaddr[i] = Short.parseShort(st.nextToken()); } - else { - acl += "DENY:" + item._expression + " "; + catch(NumberFormatException e) { + // do nothing? } } - return acl.substring(0, acl.length()-1); + return ipaddr; } - /** - * Overrides the {@link java.lang.Object#toString() Object.toString()} - * method to provide clean logging (every class should have this). - * - * This uses the uk.org.iscream.cms.server.util.FormatName class - * to format the toString() - * - * @return the name of this class and its CVS revision - */ - public String toString() { - return FormatName.getName( - _name, - getClass().getName(), - REVISION); + private boolean compareShorts(short[] first, short[] second) { + if(first.length != second.length) { + System.out.println("not equal length"); + return false; + } + for(int i=0; i < first.length; i++) { + // -- might want to consider specify which is the wildcard one? + System.out.println(i + ":" + first[i] + "," + second[i]); + if(first[i] == -1 || second[i] == -1) { + continue; + } + if(first[i] != second[i]) { + System.out.println("not equal"); + return false; + } + } + System.out.println("equal"); + return true; } -//---PRIVATE METHODS--- - //---ACCESSOR/MUTATOR METHODS--- //---ATTRIBUTES--- @@ -176,11 +267,9 @@ public class ACL { private String _name = null; /** - * The ACL is stored in this LinkedList. - * This is ideal as the list is always searched - * from beginning to end in an iterative fashion. + * The ACL is stored in this ArrayList. */ - private LinkedList _acl = new LinkedList(); + private ArrayList _acl = new ArrayList(); /** * The default mode of this ACL. @@ -194,20 +283,37 @@ public class ACL { /** * Wrapper class for an ACL rule. */ - private class ACLRule { + private class ACLRule implements Serializable { /** * Construct an ACL rule. * * @param allow whether this is an ALLOW or DENY rule * @param expression what this rule matches + * @param iprule whether this is an IP rule */ - private ACLRule(boolean allow, String expression) { + private ACLRule(boolean allow, String expression, short[] ipaddr, boolean iprule) { _allow = allow; _expression = expression; + _ipaddr = ipaddr; + _iprule = iprule; } /** + * Returns a String representation of this rule. + * + * @return A String representation of this rule. + */ + public String toString() { + if(_allow) { + return _expression + "=ALLOW"; + } + else { + return _expression + "=DENY"; + } + } + + /** * Whether this is an ALLOW or DENY rule. */ private boolean _allow; @@ -216,6 +322,13 @@ public class ACL { * What this rule matches. */ private String _expression; + + private short[] _ipaddr; + + /** + * Whether this is an IP rule. + */ + private boolean _iprule; }