All Examples  Security Examples

Class examples.security.net.SimpleConnectionFilter

java.lang.Object
    |
    +----examples.security.net.SimpleConnectionFilter

public class SimpleConnectionFilter

extends java.lang.Object

implements weblogic.security.net.ConnectionFilter

Syntax of the rule file is as follows: each rule is written on a single line. Tokens in a rule are separated by whitespace. "#" is the comment character; everything after it on a line is ignored. Whitespace before or after a rule is ignored. Lines consisting solely of whitespace or comments are skipped.

All rules follow this form:

target	action	protocols

This example recognizes two kinds of rule:

• A "fast" rule applies to a hostname or IP address, with an optional netmask. If a hostname corresponds to multiple IP addresses, multiple rules are generated (in no particular order). Netmasks can be specified either in numeric or dotted-quad form. Examples:

  dialup-650-555-1212.pa.example.net  deny   t3 t3s     # http and https OK
  192.168.81.0/255.255.254.0          allow             # 23-bit netmask
  192.168.0.0/16                      deny              # like /255.255.0.0
  

  Hostnames for fast rules are looked up once, at server startup time. While this greatly reduces connect-time overhead, it can result in the filter having an out-of-date idea of what addresses correspond to a hostname. For maximal comfort of mind, use numeric IP addresses instead.

• A "slow" rule applies to part of a domain name. Since it requires a connect-time DNS lookup on a client in order to perform a match, it may be much slower than the "fast" rule, and it may also be subject to DNS spoofing. Slow rules are specified as follows:

  .script-kiddiez.org	deny
  

  The "*" only matches at the head of a pattern. If you specify one anywhere else, it will be treated as part of the pattern (and so that pattern will never match anything, since "*" is not a legal part of a domain name).

If you want to "lock down" your server and only allow connections from certain addresses, you can specify 0.0.0.0/0 deny as your last rule.

This example does not take full advantage of the information provided by the connection filter. This this example assumes IPv4 addresses, but it should be easy to convert it to use IPv6 addresses, if necessary.

Author:

Copyright (c) 1999-2000 by BEA Systems, Inc. All Rights Reserved.

FILTER_FILE

The name of the filter rule file.

SimpleConnectionFilter()

Construct a new connection filter.

SimpleConnectionFilter(InputStream)

Construct a new connection filter.

accept(ConnectionEvent)

Filter a client connection event.

main(String[])

Simple test harness.

parseAction(String)

Parse an action and return its meaning.

parseAddresses(String)

Given a string, return an array of IPv4 addresses corresponding to that string as a host.

parseLine(String, Vector)

Parse an individual line of the rule file.

parseNetmask(String)

Return an IPv4 netmask, as derived from a spec string.

parseProtocols(StringTokenizer)

Parse a list of protocols and return a bitmask that will let us match a protocol quickly at connect time.

public static final java.lang.String FILTER_FILE

          The name of the filter rule file.

public SimpleConnectionFilter() throws java.io.IOException

          Construct a new connection filter. This constructor attempts to find the rule file in either the current directory or as a resource in the server's classpath.

Throws:

java.io.IOException - a problem occurred while reading the rule file

See Also:

FILTER_FILE

public SimpleConnectionFilter(java.io.InputStream is) throws java.io.IOException

          Construct a new connection filter. Rules are read from the given stream.

Parameters:

is - stream to read from

Throws:

java.io.IOException - a problem occurred while reading the rule file

protected void parseLine(java.lang.String line,
                         java.util.Vector entries) throws java.io.IOException, java.lang.IllegalArgumentException

          Parse an individual line of the rule file. Any resulting rules are added to the given entries vector.

Parameters:

line - the line to parse (guaranteed not to contain comments, surrounding whitespace, or be empty)

entries - the running list of rules

public void accept(weblogic.security.net.ConnectionEvent evt) throws weblogic.security.net.FilterException

          Filter a client connection event. If the connection should be allowed, this method returns normally.

Parameters:

evt - the connection event

Throws:

weblogic.security.net.FilterException - the connection should be rejected by the server

protected static final int parseProtocols(java.util.StringTokenizer toks) throws weblogic.security.net.FilterException

          Parse a list of protocols and return a bitmask that will let us match a protocol quickly at connect time.

protected static final int[] parseAddresses(java.lang.String str) throws java.io.IOException

          Given a string, return an array of IPv4 addresses corresponding to that string as a host.

Parameters:

str - hostname or IPv4 address in string form

protected static final int parseNetmask(java.lang.String maskStr) throws java.io.IOException

          Return an IPv4 netmask, as derived from a spec string. The string can either be a number, for a mask length, or a dotted-quad mask.

Parameters:

maskStr - mask spec string

protected static final boolean parseAction(java.lang.String whatever) throws java.io.IOException

          Parse an action and return its meaning. True to allow, false to deny.

Parameters:

whatever - the action string

public static void main(java.lang.String args[]) throws java.lang.Exception

          Simple test harness. You can use this to write rules by hand, and then check them.

All Examples  Security Examples