org.jumpmind.symmetric.security.inet.Inet4AddressAuthorizerCompiler Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of symmetric-ds Show documentation
Show all versions of symmetric-ds Show documentation
SymmetricDS is an open source database synchronization solution. It is platform-independent,
web-enabled, and database-agnostic. SymmetricDS was first built to replicate changes between 'retail store'
databases and ad centralized 'corporate' database.
The newest version!
/*
* Licensed to JumpMind Inc under one or more contributor
* license agreements. See the NOTICE file distributed
* with this work for additional information regarding
* copyright ownership. JumpMind Inc licenses this file
* to you under the GNU Lesser General Public License (the
* "License"); you may not use this file except in compliance
* with the License.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library; if not, see
* /0')
if (significantBits == 0) {
return true;
}
final int convertedAddress = bytesToCidrInt(addrBytes);
if ((convertedAddress & checkAddress) == convertedAddress) {
return true;
}
return false;
}
private int bytesToCidrInt(final byte[] address) {
if ((address == null) || (address.length != NUM_IPv4_OCTETS)) {
return 0;
}
int addressAsInt = 0;
addressAsInt = address[3] & 0xFF;
addressAsInt |= ((address[2] << 8) & 0xFF00);
addressAsInt |= ((address[1] << 16) & 0xFF0000);
addressAsInt |= ((address[0] << 24) & 0xFF000000);
return addressAsInt & cidrMask;
}
}
/**
* Used for comparison to a static IP address (which may be wildcarded to a
* broadcast). So, static IP addresses such as 10.5.5.32 and
* 10.5.5.* are handled by this authorizer.
*
*
*/
static class RawInet4AddressAuthorizer implements IRawInetAddressAuthorizer {
private final byte[] checkAddress;
RawInet4AddressAuthorizer(final byte[] address) {
super();
this.checkAddress = address;
}
public boolean isAuthorized(final byte[] addrBytes) {
for (int i = 0; i < addrBytes.length; i++) {
if ((checkAddress[i] != ANY) && (addrBytes[i] != checkAddress[i])) {
return false;
}
}
return true;
}
}
/**
* Compiles for IPv4 specific address filter strings.
*
* @param filter
* @return
* @throws UnknownHostException
*/
@Override
protected IRawInetAddressAuthorizer compileForIpVersion(String filter) throws UnknownHostException {
filter = filter.trim();
log.debug("FilterStringIPv4Compiling", filter);
filter = replaceSymbols(filter);
final String[] octets = filter.split('\\' + IPv4_OCTET_SEPARATOR);
if (octets.length != NUM_IPv4_OCTETS) {
throw new IllegalArgumentException(String.format(
"Invalid IPv4 filter. Must have 4 octects separated by: '%s'. Provided: %s Length: %s",
IPv4_OCTET_SEPARATOR, filter, octets.length));
}
log.debug("FilterRangeValuesChecking", filter);
if (filter.contains(CIDR_TOKEN)) {
return compileCidrAuthorizer(filter);
} else if (filter.contains(RANGE_TOKEN)) {
return compileRangeAuthorizer(octets);
} else {
// Both static and wild-carded addresses apply here
final Inet4Address addr = (Inet4Address) InetAddress.getByName(filter);
return new RawInet4AddressAuthorizer(addr.getAddress());
}
}
/**
*
*/
@Override
protected String getAddressSeparator() {
return IPv4_OCTET_SEPARATOR;
}
/**
*
*/
@Override
protected String getBroadcastString() {
return BROADCAST_OCTET;
}
/**
* Mechanism to pull a short from the provided textual octet.
* Use short values as we have to do comparisons and
* bytes are signed (and we'd have to add 254 prior to
* comparison, blah, blah, blah)
*
* @param octect
* @return
*/
protected short getOctetFromString(final String octect) {
final short octetVal = Short.parseShort(octect);
if ((octetVal > SHORT_MASK) || (octetVal < 0)) {
throw new IllegalArgumentException("Invalid IPv4 octect: " + octetVal);
}
return octetVal;
}
/**
* Utility method to convert between the actual byte[] address
* representation and a short[] used to perform the address and
* range comparison.
*
* @param bytes
* @return
*/
public static short[] convertAddressBytesToShort(final byte[] bytes) {
final short[] retVal = new short[bytes.length];
for (int i = 0; i < bytes.length; i++) {
retVal[i] = (short) ((SHORT_MASK) & (bytes[i]));
}
return retVal;
}
/**
* Utility method to convert between the short[] used for
* comparison and a byte[] for actual address representation.
*
* @param shorts
* @return
*/
public static byte[] convertShortToAddressBytes(final short[] shorts) {
final byte[] retVal = new byte[shorts.length];
for (int i = 0; i < shorts.length; i++) {
retVal[i] = (byte) shorts[i];
}
return retVal;
}
/**
* @param octets
* @return
* @throws UnknownHostException
*/
private RawInet4AddressRangeAuthorizer compileRangeAuthorizer(final String[] octets) throws UnknownHostException {
final short[] startRange = new short[NUM_IPv4_OCTETS];
final short[] endRange = new short[NUM_IPv4_OCTETS];
for (int i = 0; i < octets.length; i++) {
if (octets[i].contains(RANGE_TOKEN)) {
final String[] range = octets[i].split(RANGE_TOKEN);
if (range.length != 2) {
throw new IllegalArgumentException("Illegal range pattern for filter address octet. Provided: "
+ octets[i]);
}
final short upperBounds = getOctetFromString(range[0]);
final short lowerBounds = getOctetFromString(range[1]);
if (upperBounds < lowerBounds) {
throw new IllegalArgumentException("Byte Range must be specificed as '"
+ RANGE_TOKEN + "'. Provided: " + octets[i]);
}
startRange[i] = lowerBounds;
endRange[i] = upperBounds;
} else {
final short singleVal = getOctetFromString(octets[i]);
startRange[i] = singleVal;
endRange[i] = singleVal;
}
}
// Do a validation of the compiled short addr representations
InetAddress.getByAddress(convertShortToAddressBytes(startRange));
InetAddress.getByAddress(convertShortToAddressBytes(endRange));
return new RawInet4AddressRangeAuthorizer(startRange, endRange);
}
/**
* @param octets
* @return
* @throws UnknownHostException
*/
private RawInet4AddressCidrAuthorizer compileCidrAuthorizer(final String filter) throws UnknownHostException {
if (filter.contains(RANGE_TOKEN) || filter.contains(ANY_TOKEN)) {
throw new IllegalArgumentException("CIDR formatted filters cannot contain other tokens");
}
final String[] cidrNotation = filter.split(CIDR_TOKEN, 2);
if (cidrNotation.length != 2) {
throw new IllegalArgumentException("Expected format of CIDR string is '###.###.###.###/##'");
}
final InetAddress inetAddr = InetAddress.getByName(cidrNotation[0]);
final byte significantBits = Byte.parseByte(cidrNotation[1]);
return new RawInet4AddressCidrAuthorizer(inetAddr.getAddress(), significantBits);
}
}