Class IPAccessHandler
- All Implemented Interfaces:
Handler
,HandlerContainer
,Container
,Destroyable
,Dumpable
,Dumpable.DumpableContainer
,LifeCycle
Controls access to the wrapped handler by the real remote IP. Control is provided by white/black lists that include both internet addresses and URIs. This handler uses the real internet address of the connection, not one reported in the forwarded for headers, as this cannot be as easily forged.
Typically, the black/white lists will be used in one of three modes:
- Blocking a few specific IPs/URLs by specifying several black list entries.
- Allowing only some specific IPs/URLs by specifying several white lists entries.
- Allowing a general range of IPs/URLs by specifying several general white list entries, that are then further refined by several specific black list exceptions
By default an empty white list is treated as match all. If there is at least one entry in the white list, then a request must match a white list entry. Black list entries are always applied, so that even if an entry matches the white list, a black list entry will override it.
You can change white list policy setting whiteListByPath to true. In this mode a request will be white listed IF it has a matching URL in the white list, otherwise the black list applies, e.g. in default mode when whiteListByPath = false and wl = "127.0.0.1|/foo", /bar request from 127.0.0.1 will be blacklisted, if whiteListByPath=true then not.
Internet addresses may be specified as absolute address or as a combination of four octet wildcard specifications (a.b.c.d) that are defined as follows.
nnn - an absolute value (0-255) mmm-nnn - an inclusive range of absolute values, with following shorthand notations: nnn- => nnn-255 -nnn => 0-nnn - => 0-255 a,b,... - a list of wildcard specifications
Internet address specification is separated from the URI pattern using the "|" (pipe) character. URI patterns follow the servlet specification for simple * prefix and suffix wild cards (e.g. /, /foo, /foo/bar, /foo/bar/*, *.baz).
Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.
Examples of the entry specifications are:
- 10.10.1.2 - all requests from IP 10.10.1.2
- 10.10.1.2|/foo/bar - all requests from IP 10.10.1.2 to URI /foo/bar
- 10.10.1.2|/foo/* - all requests from IP 10.10.1.2 to URIs starting with /foo/
- 10.10.1.2|*.html - all requests from IP 10.10.1.2 to URIs ending with .html
- 10.10.0-255.0-255 - all requests from IPs within 10.10.0.0/16 subnet
- 10.10.0-.-255|/foo/bar - all requests from IPs within 10.10.0.0/16 subnet to URI /foo/bar
- 10.10.0-3,1,3,7,15|/foo/* - all requests from IPs addresses with last octet equal to 1,3,7,15 in subnet 10.10.0.0/22 to URIs starting with /foo/
Earlier versions of the handler used internet address prefix wildcard specification to define a range of the internet addresses (e.g. 127., 10.10., 172.16.1.). They also used the first "/" character of the URI pattern to separate it from the internet address. Both of these features have been deprecated in the current version.
- See Also:
-
Nested Class Summary
Nested classes/interfaces inherited from class org.eclipse.jetty.server.handler.AbstractHandler
AbstractHandler.ErrorDispatchHandler
Nested classes/interfaces inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
AbstractLifeCycle.AbstractLifeCycleListener
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Container
Container.InheritedListener, Container.Listener
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.Dumpable
Dumpable.DumpableContainer
Nested classes/interfaces inherited from interface org.eclipse.jetty.util.component.LifeCycle
LifeCycle.Listener
-
Field Summary
FieldsModifier and TypeFieldDescription(package private) PathMap<IPAddressMap<Boolean>>
Deprecated.(package private) PathMap<IPAddressMap<Boolean>>
Deprecated.(package private) boolean
Deprecated.private static final Logger
Deprecated.Fields inherited from class org.eclipse.jetty.server.handler.HandlerWrapper
_handler
-
Constructor Summary
ConstructorsConstructorDescriptionDeprecated.Creates new handler objectIPAccessHandler
(String[] white, String[] black) Deprecated.Creates new handler object and initializes white- and black-list -
Method Summary
Modifier and TypeMethodDescriptionprotected void
add
(String entry, PathMap<IPAddressMap<Boolean>> patternMap) Deprecated.Helper method to parse the new entry and add it to the specified address pattern map.void
Deprecated.Add a blacklist entry to an existing handler configurationvoid
Deprecated.Add a whitelist entry to an existing handler configurationvoid
dump
(Appendable out, String indent) Deprecated.Dump the handler configurationvoid
handle
(String target, Request baseRequest, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Deprecated.Checks the incoming request against the whitelist and blacklistprotected boolean
isAddrUriAllowed
(String addr, String path) Deprecated.Check if specified request is allowed by current IPAccess rules.protected void
set
(String[] entries, PathMap<IPAddressMap<Boolean>> patternMap) Deprecated.Helper method to process a list of new entries and replace the content of the specified address pattern mapvoid
Deprecated.Re-initialize the blacklist of existing handler objectvoid
Deprecated.Re-initialize the whitelist of existing handler objectvoid
setWhiteListByPath
(boolean whiteListByPath) Deprecated.Re-initialize the mode of path matchingMethods inherited from class org.eclipse.jetty.server.handler.HandlerWrapper
destroy, expandChildren, getHandler, getHandlers, insertHandler, setHandler
Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandlerContainer
doShutdown, expandHandler, findContainerOf, getChildHandlerByClass, getChildHandlers, getChildHandlersByClass, setServer
Methods inherited from class org.eclipse.jetty.server.handler.AbstractHandler
doError, doStart, doStop, getServer
Methods inherited from class org.eclipse.jetty.util.component.ContainerLifeCycle
addBean, addBean, addEventListener, addManaged, contains, dump, dump, dump, dump, dumpBeans, dumpObject, dumpObjects, dumpStdErr, dumpThis, getBean, getBeans, getBeans, getContainedBeans, getContainedBeans, isAuto, isManaged, isUnmanaged, manage, removeBean, removeBeans, removeEventListener, setBeans, setStopTimeout, start, stop, unmanage, updateBean, updateBean, updateBeans
Methods inherited from class org.eclipse.jetty.util.component.AbstractLifeCycle
addLifeCycleListener, getState, getState, getStopTimeout, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop, toString
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait
Methods inherited from interface org.eclipse.jetty.util.component.Dumpable.DumpableContainer
isDumpable
Methods inherited from interface org.eclipse.jetty.util.component.LifeCycle
addLifeCycleListener, isFailed, isRunning, isStarted, isStarting, isStopped, isStopping, removeLifeCycleListener, start, stop
-
Field Details
-
LOG
Deprecated. -
_white
PathMap<IPAddressMap<Boolean>> _whiteDeprecated. -
_black
PathMap<IPAddressMap<Boolean>> _blackDeprecated. -
_whiteListByPath
boolean _whiteListByPathDeprecated.
-
-
Constructor Details
-
IPAccessHandler
public IPAccessHandler()Deprecated.Creates new handler object -
IPAccessHandler
Deprecated.Creates new handler object and initializes white- and black-list- Parameters:
white
- array of whitelist entriesblack
- array of blacklist entries
-
-
Method Details
-
addWhite
Deprecated.Add a whitelist entry to an existing handler configuration- Parameters:
entry
- new whitelist entry
-
addBlack
Deprecated.Add a blacklist entry to an existing handler configuration- Parameters:
entry
- new blacklist entry
-
setWhite
Deprecated.Re-initialize the whitelist of existing handler object- Parameters:
entries
- array of whitelist entries
-
setBlack
Deprecated.Re-initialize the blacklist of existing handler object- Parameters:
entries
- array of blacklist entries
-
setWhiteListByPath
public void setWhiteListByPath(boolean whiteListByPath) Deprecated.Re-initialize the mode of path matching- Parameters:
whiteListByPath
- matching mode
-
handle
public void handle(String target, Request baseRequest, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) throws IOException, javax.servlet.ServletException Deprecated.Checks the incoming request against the whitelist and blacklist- Specified by:
handle
in interfaceHandler
- Overrides:
handle
in classHandlerWrapper
- Parameters:
target
- The target of the request - either a URI or a name.baseRequest
- The original unwrapped request object.request
- The request either as theRequest
object or a wrapper of that request. The
method can be used access the Request object if required.HttpConnection.getCurrentConnection()
.getHttpChannel()
.getRequest()
response
- The response as theResponse
object or a wrapper of that request. The
method can be used access the Response object if required.HttpConnection.getCurrentConnection()
.getHttpChannel()
.getResponse()
- Throws:
IOException
- if unable to handle the request or response processingjavax.servlet.ServletException
- if unable to handle the request or response due to underlying servlet issue- See Also:
-
add
Deprecated.Helper method to parse the new entry and add it to the specified address pattern map.- Parameters:
entry
- new entrypatternMap
- target address pattern map
-
set
Deprecated.Helper method to process a list of new entries and replace the content of the specified address pattern map- Parameters:
entries
- new entriespatternMap
- target address pattern map
-
isAddrUriAllowed
Deprecated.Check if specified request is allowed by current IPAccess rules.- Parameters:
addr
- internet addresspath
- request URI path- Returns:
- true if request is allowed
-
dump
Deprecated.Dump the handler configuration- Specified by:
dump
in interfaceDumpable
- Overrides:
dump
in classContainerLifeCycle
- Parameters:
out
- The appendable to dump toindent
- The indent to apply after any new lines.- Throws:
IOException
- if unable to write to Appendable
-
InetAccessHandler
.