1 /*
2 * Copyright 2014 The Netty Project
3 *
4 * The Netty Project licenses this file to you under the Apache License,
5 * version 2.0 (the "License"); you may not use this file except in compliance
6 * with the License. You may obtain a copy of the License at:
7 *
8 * https://www.apache.org/licenses/LICENSE-2.0
9 *
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
12 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
13 * License for the specific language governing permissions and limitations
14 * under the License.
15 */
16 package io.netty.handler.ipfilter;
17
18 import io.netty.channel.Channel;
19 import io.netty.channel.ChannelHandler.Sharable;
20 import io.netty.channel.ChannelHandlerContext;
21 import io.netty.util.internal.ObjectUtil;
22
23 import java.net.InetSocketAddress;
24 import java.net.SocketAddress;
25 import java.util.ArrayList;
26 import java.util.List;
27
28 /**
29 * <p>
30 * This class allows one to filter new {@link Channel}s based on the
31 * {@link IpFilterRule}s passed to its constructor. If no rules are provided, all connections
32 * will be accepted.
33 * </p>
34 *
35 * <p>
36 * If you would like to explicitly take action on rejected {@link Channel}s, you should override
37 * {@link AbstractRemoteAddressFilter#channelRejected(ChannelHandlerContext, SocketAddress)}.
38 * </p>
39 *
40 * <p> Consider using {@link IpSubnetFilter} for better performance while not as
41 * general purpose as this filter. </p>
42 */
43 @Sharable
44 public class RuleBasedIpFilter extends AbstractRemoteAddressFilter<InetSocketAddress> {
45
46 private final boolean acceptIfNotFound;
47 private final List<IpFilterRule> rules;
48
49 /**
50 * <p> Create new Instance of {@link RuleBasedIpFilter} and filter incoming connections
51 * based on their IP address and {@code rules} applied. </p>
52 *
53 * <p> {@code acceptIfNotFound} is set to {@code true}. </p>
54 *
55 * @param rules An array of {@link IpFilterRule} containing all rules.
56 * @deprecated Use {@link RuleBasedIpFilter#RuleBasedIpFilter(boolean, IpFilterRule...)}
57 */
58 @Deprecated
59 public RuleBasedIpFilter(IpFilterRule... rules) {
60 this(true, rules);
61 }
62
63 /**
64 * Create new Instance of {@link RuleBasedIpFilter} and filter incoming connections
65 * based on their IP address and {@code rules} applied.
66 *
67 * @param acceptIfNotFound If {@code true} then accept connection from IP Address if it
68 * doesn't match any rule.
69 * @param rules An array of {@link IpFilterRule} containing all rules.
70 */
71 public RuleBasedIpFilter(boolean acceptIfNotFound, IpFilterRule... rules) {
72 ObjectUtil.checkNotNull(rules, "rules");
73
74 this.acceptIfNotFound = acceptIfNotFound;
75 this.rules = new ArrayList<IpFilterRule>(rules.length);
76
77 for (IpFilterRule rule : rules) {
78 if (rule != null) {
79 this.rules.add(rule);
80 }
81 }
82 }
83
84 @Override
85 protected boolean accept(ChannelHandlerContext ctx, InetSocketAddress remoteAddress) throws Exception {
86 for (IpFilterRule rule : rules) {
87 if (rule.matches(remoteAddress)) {
88 return rule.ruleType() == IpFilterRuleType.ACCEPT;
89 }
90 }
91
92 return acceptIfNotFound;
93 }
94 }