Package org.eclipse.jetty.server.handler

Class IPAccessHandler

  • All Implemented Interfaces:
    Handler, HandlerContainer, Container, Destroyable, Dumpable, Dumpable.DumpableContainer, LifeCycle
    @Deprecated
public class IPAccessHandler
extends HandlerWrapper
    Deprecated.
    Use @InetAccessHandler.
    IP Access Handler

    Controls access to the wrapped handler by the real remote IP. Control is provided by white/black lists that include both internet addresses and URIs. This handler uses the real internet address of the connection, not one reported in the forwarded for headers, as this cannot be as easily forged.

    Typically, the black/white lists will be used in one of three modes:

    • Blocking a few specific IPs/URLs by specifying several black list entries.
    • Allowing only some specific IPs/URLs by specifying several white lists entries.
    • Allowing a general range of IPs/URLs by specifying several general white list entries, that are then further refined by several specific black list exceptions

    By default an empty white list is treated as match all. If there is at least one entry in the white list, then a request must match a white list entry. Black list entries are always applied, so that even if an entry matches the white list, a black list entry will override it.

    You can change white list policy setting whiteListByPath to true. In this mode a request will be white listed IF it has a matching URL in the white list, otherwise the black list applies, e.g. in default mode when whiteListByPath = false and wl = "127.0.0.1|/foo", /bar request from 127.0.0.1 will be blacklisted, if whiteListByPath=true then not.

    Internet addresses may be specified as absolute address or as a combination of four octet wildcard specifications (a.b.c.d) that are defined as follows. 

     nnn - an absolute value (0-255)
 mmm-nnn - an inclusive range of absolute values,
           with following shorthand notations:
           nnn- => nnn-255
           -nnn => 0-nnn
           -    => 0-255
 a,b,... - a list of wildcard specifications

    Internet address specification is separated from the URI pattern using the "|" (pipe) character. URI patterns follow the servlet specification for simple * prefix and suffix wild cards (e.g. /, /foo, /foo/bar, /foo/bar/*, *.baz).

    Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.

    Examples of the entry specifications are:

    • 10.10.1.2 - all requests from IP 10.10.1.2
    • 10.10.1.2|/foo/bar - all requests from IP 10.10.1.2 to URI /foo/bar
    • 10.10.1.2|/foo/* - all requests from IP 10.10.1.2 to URIs starting with /foo/
    • 10.10.1.2|*.html - all requests from IP 10.10.1.2 to URIs ending with .html
    • 10.10.0-255.0-255 - all requests from IPs within 10.10.0.0/16 subnet
    • 10.10.0-.-255|/foo/bar - all requests from IPs within 10.10.0.0/16 subnet to URI /foo/bar
    • 10.10.0-3,1,3,7,15|/foo/* - all requests from IPs addresses with last octet equal to 1,3,7,15 in subnet 10.10.0.0/22 to URIs starting with /foo/

    Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.

    See Also:
    InetAccessHandler

    • Constructor Detail

      • IPAccessHandler

        public IPAccessHandler()
        Deprecated.
        Creates new handler object

      • IPAccessHandler

        public IPAccessHandler​(java.lang.String[] white,
                       java.lang.String[] black)
        Deprecated.
        Creates new handler object and initializes white- and black-list
        Parameters:
        white - array of whitelist entries
        black - array of blacklist entries

    • Method Detail

      • addWhite

        public void addWhite​(java.lang.String entry)
        Deprecated.
        Add a whitelist entry to an existing handler configuration
        Parameters:
        entry - new whitelist entry

      • addBlack

        public void addBlack​(java.lang.String entry)
        Deprecated.
        Add a blacklist entry to an existing handler configuration
        Parameters:
        entry - new blacklist entry

      • setWhite

        public void setWhite​(java.lang.String[] entries)
        Deprecated.
        Re-initialize the whitelist of existing handler object
        Parameters:
        entries - array of whitelist entries

      • setBlack

        public void setBlack​(java.lang.String[] entries)
        Deprecated.
        Re-initialize the blacklist of existing handler object
        Parameters:
        entries - array of blacklist entries

      • setWhiteListByPath

        public void setWhiteListByPath​(boolean whiteListByPath)
        Deprecated.
        Re-initialize the mode of path matching
        Parameters:
        whiteListByPath - matching mode

      • add

        protected void add​(java.lang.String entry,
                   PathMap<IPAddressMap<java.lang.Boolean>> patternMap)
        Deprecated.
        Helper method to parse the new entry and add it to the specified address pattern map.
        Parameters:
        entry - new entry
        patternMap - target address pattern map

      • set

        protected void set​(java.lang.String[] entries,
                   PathMap<IPAddressMap<java.lang.Boolean>> patternMap)
        Deprecated.
        Helper method to process a list of new entries and replace the content of the specified address pattern map
        Parameters:
        entries - new entries
        patternMap - target address pattern map

      • isAddrUriAllowed

        protected boolean isAddrUriAllowed​(java.lang.String addr,
                                   java.lang.String path)
        Deprecated.
        Check if specified request is allowed by current IPAccess rules.
        Parameters:
        addr - internet address
        path - request URI path
        Returns:
        true if request is allowed

      • dump

        public void dump​(java.lang.Appendable out,
                 java.lang.String indent)
          throws java.io.IOException
        Deprecated.
        Dump the handler configuration
        Specified by:
        dump in interface Dumpable
        Overrides:
        dump in class ContainerLifeCycle
        Parameters:
        out - The appendable to dump to
        indent - The indent to apply after any new lines.
        Throws:
        java.io.IOException - if unable to write to Appendable