package org.apache.catalina.filters;

import java.math.BigInteger;

import java.net.InetAddress;

import java.net.UnknownHostException;

import org.apache.catalina.comet.CometEvent;

import org.apache.catalina.comet.CometFilter;

import org.apache.catalina.comet.CometFilterChain;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletResponse;

import java.io.IOException;

import java.net.InetAddress;

import java.net.UnknownHostException;

import java.util.ArrayList;

import java.util.List;

import org.apache.juli.logging.Log;

import org.apache.juli.logging.LogFactory;

/**

 * Implementation of a Filter that performs filtering based on comparing the

 * appropriate request property (selected based on which subclass you choose

 * to configure into your Container's pipeline) against the regular expressions

 * configured for this Filter.

 * <p>

 * This filter is configured by setting the <code>allow</code> and/or

 * <code>deny</code> properties to a regular expressions (in the syntax

 * supported by {@link java.util.regex.Pattern}) to which the appropriate request property will

 * be compared.  Evaluation proceeds as follows:

 * <ul>

 * <li>The subclass extracts the request property to be filtered, and

 *     calls the common <code>process()</code> method.

 * <li>If there is a deny expression configured, the property will be compared

 *     to the expression. If a match is found, this request will be rejected

 *     with a "Forbidden" HTTP response.</li>

 * <li>If there is a allow expression configured, the property will be compared

 *     to the expression. If a match is found, this request will be allowed to

 *     pass through to the next filter in the current pipeline.</li>

 * <li>If a deny expression was specified but no allow expression, allow this

 *     request to pass through (because none of the deny expressions matched

 *     it).

 * <li>The request will be rejected with a "Forbidden" HTTP response.</li>

 * </ul>

 */

public class RemoteAddrNetmaskFilter

    extends RequestFilter

{

    // ----------------------------------------------------- Instance Variables

    private static final Log log = LogFactory.getLog(RemoteAddrFilter.class);

    /**

     * The matchers used to test for allowed requests.

     */

    protected final List<IPMatcher> allow = new ArrayList<IPMatcher>();

    /**

     * The matchers used to test for denied requests.

     */

    protected final List<IPMatcher> deny = new ArrayList<IPMatcher>();

    // ------------------------------------------------------------- Properties

    // --------------------------------------------------------- Public Methods

    @Override

    public void init(FilterConfig filterConfig) throws ServletException {

        super.init(filterConfig);

        final String denies = super.getDeny();

        for(final String s: denies.split("\\s*,\\s*"))

        {

            try {

                if(s.contains("/"))

                    deny.add(new NetMaskIPMatcher(s));

                else

                    deny.add(new StringIPMatcher(s));

            } catch (IllegalArgumentException e) {

                // FIXME: log

            }

        }

        final String allows = super.getDeny();

        for(final String s: allows.split("\\s*,\\s*"))

        {

            try {

                if(s.contains("/"))

                    allow.add(new NetMaskIPMatcher(s));

                else

                    allow.add(new StringIPMatcher(s));

            } catch (IllegalArgumentException e) {

                // FIXME: log

            }

        }

    }

    public void doFilter(ServletRequest request,

                         ServletResponse response,

                         FilterChain chain)

        throws ServletException, IOException

    {

        process(request.getRemoteAddr(), request, response, chain);

    }                         

    /**

     * Extract the desired request property, and pass it (along with the comet

     * event and filter chain) to the protected <code>process()</code> method

     * to perform the actual filtering.

     *

     * @param event The comet event to be processed

     * @param chain The filter chain for this event

     *

     * @exception IOException if an input/output error occurs

     * @exception ServletException if a servlet error occurs

     */

    @Override

    public void doFilterEvent(CometEvent event, CometFilterChain chain)

            throws IOException, ServletException {

        processCometEvent(event.getHttpServletRequest().getRemoteAddr(),

                event, chain);        

    }

    // ------------------------------------------------------ Protected Methods

    @Override

    protected boolean isAllowed(String property) {

        final InetAddress addr;

        try {

            addr = InetAddress.getByName(property);

        } catch (UnknownHostException e) {

            // FIXME: log

            return false;

        }

        for (final IPMatcher m: deny)

            if (m.matches(addr))

                return false;

        for (final IPMatcher m: allow)

            if (m.matches(addr))

                return true;

        // Allow if denies specified but not allows

        if (!deny.isEmpty() && allow.isEmpty())

            return true;

        // Deny this request

        return false;

    }

    @Override

    protected Log getLogger() {

        return log;

    }

    private interface IPMatcher

    {

        boolean matches(InetAddress address);

    }

    static class StringIPMatcher

        implements IPMatcher

    {

        private String address;

        public StringIPMatcher(final String address)

        {

            this.address = address;

        }

        public boolean matches(final InetAddress address)

        {

            return address.getHostAddress().equals(this.address);

        }

    }

    /**

     * A class representing a netmask, which is at the core of this valve.

     *

     * <p>The constructor takes a {@link java.lang.String} representing a

     * CIDR netmask as an argument and extracts two informations from it: the

     * network address and the CIDR. It then turns the address into a

     * {@link java.math.BigInteger}, calculates the right shift and shifts that

     * BigInteger by it.</p>

     * <p>The process to verify whether an IP address falls within the mask

     * is to also convert it to a BigInteger, shifting it right and comparing

     * it to the stored BigInteger.

     * </p>

     */

    static class NetMaskIPMatcher

        implements IPMatcher

    {

        /**

         * The argument to the constructor, used for .toString()

         */

        private final String expression;

        /**

         * The number of bits a matching candidate needs to be shifted right

         * in order to see if it matches

         */

        private final int shift;

        /**

         * The network address, already shifted right

         */

        private final BigInteger mask;

        /**

         * Constructor.

         *

         * @param expression the CIDR netmask

         * @throws IllegalArgumentException if the netmask is not correct

         * (invalid address specification, malformed CIDR prefix, etc)

         */

        public NetMaskIPMatcher(final String expression) {

            final int idx = expression.indexOf("/");

            final int cidr, addrlen;

            final String addressPart;

            final InetAddress addr;

            final byte[] bytes;

            if (idx == -1) {

                cidr = -1;

                addressPart = expression;

            } else {

                final String substring = expression.substring(idx + 1);

                try {

                    cidr = Integer.parseInt(substring);

                    if (cidr < 0)

                        throw new NumberFormatException("CIDR is negative");

                } catch (NumberFormatException ignored) {

                    throw new IllegalArgumentException("provided CIDR mask ("

                                                       + substring + ") is invalid");

                }

                addressPart = expression.substring(0, idx);

            }

            try {

                addr = InetAddress.getByName(addressPart);

            } catch (UnknownHostException e) {

                throw new IllegalArgumentException("provided address ("

                                                   + addressPart + ") is invalid");

            }

            bytes = addr.getAddress();

            addrlen = bytes.length * 8;

            shift = cidr == -1 ? 0 : addrlen - cidr;

            if (shift < 0)

                throw new IllegalArgumentException("CIDR prefix (" + cidr

                                                   + ") is greater than address length (" + addrlen + ")");

            mask = new BigInteger(bytes).shiftRight(shift);

            this.expression = expression;

        }

        /**

         * Test if a given address matches this netmask

         *

         * @param addr The {@link java.net.InetAddress} to test

         * @return true on match, false otherwise

         */

        public boolean matches (final InetAddress addr) {

            final BigInteger provided = new BigInteger(addr.getAddress())

                .shiftRight(shift);

            return mask.equals(provided);

        }

        @Override

            public String toString() {

            return expression;

        }

    }

}