- 

/*

 * Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 * 

 *      http://www.apache.org/licenses/LICENSE-2.0

 * 

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

package org.apache.catalina.valves;

import org.apache.catalina.connector.Request;

import org.apache.catalina.connector.Response;

import org.apache.catalina.util.NetMask;

import javax.servlet.ServletException;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.math.BigInteger;

import java.net.InetAddress;

import java.net.UnknownHostException;

import java.util.ArrayList;

import java.util.Arrays;

import java.util.Collections;

import java.util.List;

/**

 * Implementation of a Valve that performs IP filtering of a remote host

 * based on the remote's IP address. This valve replicates (some of) Apache's

 * "Order", "Allow from" and "Deny" directives with a few limitations:

 * <ul>

 *     <li>"Order" will always be "deny, allow";</li>

 *     <li>the netmasks in the "allow" and "deny" properties must be fully

 *     qualified CIDR netmasks, and the CIDR <b>must</b> be an integer

 *     (expressions like "10.", "13.0.0.0/255.255.192.0" or ".foo.bar" will

 *     not work);</li>

 *     <li>as a side effect of using @{link java.net.InetAddress},

 *     expressions like "my.host.com/27" <b>will</b> work,

 *     however their use is discouraged.</li>

 * </ul>

 * <p>Note that IPv6 is supported. Also note that invalid netmasks will be

 * ignored.</p>

 * <p>

 * This Valve may be attached to any Container, depending on the granularity

 * of the filtering you wish to perform.</p>

 *

 * @author Francis Galiegue

 */

public abstract class RequestNetmaskValve

    extends ValveBase {

    //------------------------------------------------------ Constructor

    public RequestNetmaskValve() {

        super(true);

    }

    // ----------------------------------------------------- Class Variables

    /**

     * The descriptive information related to this implementation.

     */

    private static final String info =

        "org.apache.catalina.valves.RequestNetmaskValve/1.0";

    // ----------------------------------------------------- Instance Variables

    /**

     * List of allowed netmasks, if any

     */

    protected final List<NetMask> allow = new ArrayList<NetMask>();

    /**

     * List of denied netmasks, if any

     */

    protected final List<NetMask> deny = new ArrayList<NetMask>();

    // ------------------------------------------------------------- Properties

    /**

     * Return the allowed netmask list as a string.

     */

    public String getAllow() {

        return allow.toString();

    }

    /**

     * Fills the allowed Netmask list.

     *

     * @param input The input expression

     */

    public void setAllow(final String input) {

        if (input == null || input.length() == 0)

            return;

        NetMask nm;

        for (final String s: input.split("\\s*,\\s*"))

            try {

                nm = new NetMask(s);

                this.allow.add(nm);

            } catch (IllegalArgumentException e) {

                // FIXME: log

            }

    }

    /**

     * Return the denied netmask list as a string.

     */

    public String getDeny() {

        return deny.toString();

    }

    /**

     * Set the regular expression used to test for denied requests for this

     * Valve, if any.

     *

     * @param input The new input expression

     */

    public void setDeny(final String input) {

       if (input == null || input.length() == 0)

           return;

        NetMask nm;

        for (final String s: input.split("\\s*,\\s*"))

            try {

                nm = new NetMask(s);

                this.deny.add(nm);

            } catch (IllegalArgumentException e) {

                // FIXME: log

            }

    }

    /**

     * Return descriptive information about this Valve implementation.

     */

    @Override

    public String getInfo() {

        return (info);

    }

    // --------------------------------------------------------- Public Methods

    /**

     * Extract the desired request property, and pass it (along with the

     * specified request and response objects) to the protected

     * <code>process()</code> method to perform the actual filtering.

     * This method must be implemented by a concrete subclass.

     *

     * @param request The servlet request to be processed

     * @param response The servlet response to be created

     *

     * @exception java.io.IOException if an input/output error occurs

     * @exception javax.servlet.ServletException if a servlet error occurs

     */

    @Override

    public abstract void invoke(Request request, Response response)

        throws IOException, ServletException;

    // ------------------------------------------------------ Protected Methods

    /**

     * Perform the filtering that has been configured for this Valve, matching

     * against the specified request property.

     *

     * @param property The request property on which to filter

     * @param request The servlet request to be processed

     * @param response The servlet response to be processed

     *

     * @exception java.io.IOException if an input/output error occurs

     * @exception javax.servlet.ServletException if a servlet error occurs

     */

    protected void process(String property, Request request, Response response)

        throws IOException, ServletException {

        final InetAddress addr = InetAddress.getByName(property);

        for (final NetMask nm: deny)

            if (nm.matches(addr)) {

                response.sendError(HttpServletResponse.SC_FORBIDDEN);

                return;

            }

        if (allow.isEmpty()) {

            getNext().invoke(request, response);

            return;

        }

        for (final NetMask nm: allow)

            if (nm.matches(addr)) {

                getNext().invoke(request, response);

                return;

            }

        response.sendError(HttpServletResponse.SC_FORBIDDEN);

    }

}