public class IPAccessHandler extends HandlerWrapper
Controls access to the wrapped handler by the real remote IP. Control is provided by white/black lists that include both internet addresses and URIs. This handler uses the real internet address of the connection, not one reported in the forwarded for headers, as this cannot be as easily forged.
Typically, the black/white lists will be used in one of three modes:
By default an empty white list is treated as match all. If there is at least one entry in the white list, then a request must match a white list entry. Black list entries are always applied, so that even if an entry matches the white list, a black list entry will override it.
You can change white list policy setting whiteListByPath to true. In this mode a request will be white listed IF it has a matching URL in the white list, otherwise the black list applies, e.g. in default mode when whiteListByPath = false and wl = "127.0.0.1|/foo", /bar request from 127.0.0.1 will be blacklisted, if whiteListByPath=true then not.
Internet addresses may be specified as absolute address or as a combination of four octet wildcard specifications (a.b.c.d) that are defined as follows.
nnn - an absolute value (0-255)
mmm-nnn - an inclusive range of absolute values,
with following shorthand notations:
nnn- => nnn-255
-nnn => 0-nnn
- => 0-255
a,b,... - a list of wildcard specifications
Internet address specification is separated from the URI pattern using the "|" (pipe) character. URI patterns follow the servlet specification for simple * prefix and suffix wild cards (e.g. /, /foo, /foo/bar, /foo/bar/*, *.baz).
Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.
Examples of the entry specifications are:
Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.
AbstractLifeCycle.AbstractLifeCycleListenerLifeCycle.ListenerContainer.InheritedListener, Container.Listener_handler| Constructor and Description |
|---|
IPAccessHandler()
Creates new handler object
|
IPAccessHandler(String[] white,
String[] black)
Creates new handler object and initializes white- and black-list
|
| Modifier and Type | Method and Description |
|---|---|
protected void |
add(String entry,
PathMap<IPAddressMap<Boolean>> patternMap)
Helper method to parse the new entry and add it to
the specified address pattern map.
|
void |
addBlack(String entry)
Add a blacklist entry to an existing handler configuration
|
void |
addWhite(String entry)
Add a whitelist entry to an existing handler configuration
|
String |
dump()
Dump the handler configuration
|
protected void |
dump(StringBuilder buf,
PathMap<IPAddressMap<Boolean>> patternMap)
Dump a pattern map into a StringBuilder buffer
|
void |
handle(String target,
Request baseRequest,
HttpServletRequest request,
HttpServletResponse response)
Checks the incoming request against the whitelist and blacklist
|
protected boolean |
isAddrUriAllowed(String addr,
String path)
Check if specified request is allowed by current IPAccess rules.
|
protected void |
set(String[] entries,
PathMap<IPAddressMap<Boolean>> patternMap)
Helper method to process a list of new entries and replace
the content of the specified address pattern map
|
void |
setBlack(String[] entries)
Re-initialize the blacklist of existing handler object
|
void |
setWhite(String[] entries)
Re-initialize the whitelist of existing handler object
|
void |
setWhiteListByPath(boolean whiteListByPath)
Re-initialize the mode of path matching
|
destroy, expandChildren, getHandler, getHandlers, setHandler, setServerexpandHandler, findContainerOf, getChildHandlerByClass, getChildHandlers, getChildHandlersByClassdoStart, doStop, dumpThis, getServeraddBean, addBean, addBean, addEventListener, addManaged, contains, dump, dump, dump, dump, dumpBeans, dumpObject, dumpStdErr, getBean, getBeans, getBeans, isManaged, manage, removeBean, removeBeans, removeEventListener, setBeans, setStopTimeout, start, stop, unmanage, updateBean, updateBeansaddLifeCycleListener, getState, getState, getStopTimeout, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stopclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitaddLifeCycleListener, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stoppublic void addWhite(String entry)
entry - new whitelist entrypublic void addBlack(String entry)
entry - new blacklist entrypublic void setWhite(String[] entries)
entries - array of whitelist entriespublic void setBlack(String[] entries)
entries - array of blacklist entriespublic void setWhiteListByPath(boolean whiteListByPath)
whiteListByPath - matching modepublic void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response) throws IOException, ServletException
handle in interface Handlerhandle in class HandlerWrappertarget - The target of the request - either a URI or a name.baseRequest - The original unwrapped request object.request - The request either as the Request
object or a wrapper of that request. The HttpChannel.getCurrentHttpChannel()
method can be used access the Request object if required.response - The response as the Response
object or a wrapper of that request. The HttpChannel.getCurrentHttpChannel()
method can be used access the Response object if required.IOExceptionServletExceptionHandlerWrapper.handle(java.lang.String, org.eclipse.jetty.server.Request, javax.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)protected void add(String entry, PathMap<IPAddressMap<Boolean>> patternMap)
entry - new entrypatternMap - target address pattern mapprotected void set(String[] entries, PathMap<IPAddressMap<Boolean>> patternMap)
entries - new entriespatternMap - target address pattern mapprotected boolean isAddrUriAllowed(String addr, String path)
addr - internet addresspath - context pathpublic String dump()
dump in interface Dumpabledump in class ContainerLifeCycleprotected void dump(StringBuilder buf, PathMap<IPAddressMap<Boolean>> patternMap)
buf - bufferpatternMap - pattern map to dumpCopyright © 1995-2015 Webtide. All Rights Reserved.