* The host/port combination is specified as followed *
*
* hostname[:[-]port[-[port]]] **
* The hostname portion can be either a hostname or IP address. If it is * a hostname, a wildcard is allowed in hostnames. This wildcard is a "*" * and matches one or more characters. Only one "*" may appear in the * host and it must be the leftmost character. For example, * "*.urbanophile.com" matches all hosts in the "urbanophile.com" domain. *
* The port portion can be either a single value, or a range of values * treated as inclusive. The first or the last port value in the range * can be omitted in which case either the minimum or maximum legal * value for a port (respectively) is used by default. Here are some * examples: *
* The permission list is a comma separated list of individual permissions. * These individual permissions are: *
*
* accept * connect * listen * resolve **
* The "listen" permission is only relevant if the host is localhost. If * any permission at all is specified, then resolve permission is implied to * exist. *
* Here are a variety of examples of how to create SocketPermission's *
* SocketPermission("www.urbanophile.com", "connect");
* Can connect to any port on www.urbanophile.com
* SocketPermission("www.urbanophile.com:80", "connect,accept");
* Can connect to or accept connections from www.urbanophile.com on port 80
* SocketPermission("localhost:1024-", "listen,accept,connect");
* Can connect to, accept from, an listen on any local port number 1024
* and up.
* SocketPermission("*.edu", "connect");
* Can connect to any host in the edu domain
* SocketPermission("197.197.20.1", "accept");
* Can accept connections from 197.197.20.1
*
*
* This class also supports IPv6 addresses. These should be specified
* in either RFC 2732 format or in full uncompressed form.
*
* @since 1.2
*
* @author Written by Aaron M. Renn (arenn@urbanophile.com)
* @author Extensively modified by Gary Benson (gbenson@redhat.com)
*/
public final class SocketPermission extends Permission implements Serializable
{
static final long serialVersionUID = -7204263841984476862L;
/**
* A hostname (possibly wildcarded) or IP address (IPv4 or IPv6).
*/
private transient String host;
/**
* A range of ports.
*/
private transient int minport;
private transient int maxport;
/**
* Values used for minimum and maximum ports when one or both bounds
* are omitted. This class is essentially independent of the
* networking code it describes, so we do not limit ports to the
* usual network limits of 1 and 65535.
*/
private static final int MIN_PORT = 0;
private static final int MAX_PORT = Integer.MAX_VALUE;
/**
* The actions for which we have permission. This field is present
* to make the serialized form correct and should not be used by
* anything other than writeObject: everything else should use
* actionmask.
*/
private String actions;
/**
* A bitmask representing the actions for which we have permission.
*/
private transient int actionmask;
/**
* The available actions, in the canonical order required for getActions().
*/
private static final String[] ACTIONS = new String[] {
"connect", "listen", "accept", "resolve"};
/**
* Initializes a new instance of SocketPermission with the
* specified host/port combination and actions string.
*
* @param hostport The hostname/port number combination
* @param actions The actions string
*/
public SocketPermission(String hostport, String actions)
{
super(hostport);
setHostPort(hostport);
setActions(actions);
}
/**
* Parse the hostport argument to the constructor.
*/
private void setHostPort(String hostport)
{
// Split into host and ports
String ports;
if (hostport.length() == 0)
{
host = ports = "";
}
else if (hostport.charAt(0) == '[')
{
// host is a bracketed IPv6 address
int end = hostport.indexOf("]");
if (end == -1)
throw new IllegalArgumentException("Unmatched '['");
host = hostport.substring(1, end);
if (end == hostport.length() - 1)
ports = "";
else if (hostport.charAt(end + 1) == ':')
ports = hostport.substring(end + 2);
else
throw new IllegalArgumentException("Bad character after ']'");
}
else
{
// host is a hostname or IPv4 address
int sep = hostport.indexOf(":");
if (sep == -1)
{
host = hostport;
ports = "";
}
else
{
host = hostport.substring(0, sep);
ports = hostport.substring(sep + 1);
}
}
if (ports.indexOf(":") != -1)
throw new IllegalArgumentException("Unexpected ':'");
// Parse and validate the ports
if (ports.length() == 0)
{
minport = MIN_PORT;
maxport = MAX_PORT;
}
else
{
int sep = ports.indexOf("-");
if (sep == -1)
{
// a single port
minport = maxport = Integer.parseInt(ports);
}
else
{
if (ports.indexOf("-", sep + 1) != -1)
throw new IllegalArgumentException("Unexpected '-'");
if (sep == 0)
{
// an upper bound
minport = MIN_PORT;
maxport = Integer.parseInt(ports.substring(1));
}
else if (sep == ports.length() - 1)
{
// a lower bound
minport =
Integer.parseInt(ports.substring(0, ports.length() - 1));
maxport = MAX_PORT;
}
else
{
// a range with two bounds
minport = Integer.parseInt(ports.substring(0, sep));
maxport = Integer.parseInt(ports.substring(sep + 1));
}
}
}
}
/**
* Parse the actions argument to the constructor.
*/
private void setActions(String actionstring)
{
actionmask = 0;
boolean resolve_needed = false;
boolean resolve_present = false;
StringTokenizer t = new StringTokenizer(actionstring, ",");
while (t.hasMoreTokens())
{
String action = t.nextToken();
action = action.trim().toLowerCase();
setAction(action);
if (action.equals("resolve"))
resolve_present = true;
else
resolve_needed = true;
}
if (resolve_needed && !resolve_present)
setAction("resolve");
}
/**
* Parse one element of the actions argument to the constructor.
*/
private void setAction(String action)
{
for (int i = 0; i < ACTIONS.length; i++)
{
if (action.equals(ACTIONS[i]))
{
actionmask |= 1 << i;
return;
}
}
throw new IllegalArgumentException("Unknown action " + action);
}
/**
* Tests this object for equality against another. This will be true if
* and only if the passed object is an instance of
* SocketPermission and both its hostname/port combination
* and permissions string are identical.
*
* @param obj The object to test against for equality
*
* @return true if object is equal to this object,
* false otherwise.
*/
public boolean equals(Object obj)
{
SocketPermission p;
if (obj instanceof SocketPermission)
p = (SocketPermission) obj;
else
return false;
return p.actionmask == actionmask &&
p.minport == minport &&
p.maxport == maxport &&
p.host.equals(host);
}
/**
* Returns a hash code value for this object. Overrides the
* Permission.hashCode().
*
* @return A hash code
*/
public int hashCode()
{
return actionmask + minport + maxport + host.hashCode();
}
/**
* Returns the list of permission actions in this object in canonical
* order. The canonical order is "connect,listen,accept,resolve"
*
* @return The permitted action string.
*/
public String getActions()
{
StringBuffer sb = new StringBuffer("");
for (int i = 0; i < ACTIONS.length; i++)
{
if ((actionmask & (1 << i)) != 0)
{
if (sb.length() != 0)
sb.append(",");
sb.append(ACTIONS[i]);
}
}
return sb.toString();
}
/**
* Returns a new PermissionCollection object that can hold
* SocketPermission's.
*
* @return A new PermissionCollection.
*/
public PermissionCollection newPermissionCollection()
{
// FIXME: Implement
return null;
}
/**
* Returns true if the permission object passed it is implied by the
* this permission. This will be true if:
*
*
SocketPermissionThe argument's hostname will be a subset of this object's hostname if:
* *Permission to check against
*
* @return true if the Permission is implied by
* this object, false otherwise.
*/
public boolean implies(Permission perm)
{
SocketPermission p;
// First make sure we are the right object type
if (perm instanceof SocketPermission)
p = (SocketPermission) perm;
else
return false;
// Next check the actions
if ((p.actionmask & actionmask) != p.actionmask)
return false;
// Then check the ports
if ((p.minport < minport) || (p.maxport > maxport))
return false;
// Finally check the hosts
if (host.equals(p.host))
return true;
// Try the canonical names
String ourcanonical = null;
String theircanonical = null;
try
{
ourcanonical = InetAddress.getByName(host).getHostName();
theircanonical = InetAddress.getByName(p.host).getHostName();
}
catch (UnknownHostException e)
{
// Who didn't resolve? Just assume current address is canonical enough
// Is this ok to do?
if (ourcanonical == null)
ourcanonical = host;
if (theircanonical == null)
theircanonical = p.host;
}
if (ourcanonical.equals(theircanonical))
return true;
// Well, last chance. Try for a wildcard
if (host.indexOf("*.") != -1)
{
String wild_domain =
host.substring(host.indexOf("*" + 1));
if (theircanonical.endsWith(wild_domain))
return true;
}
// Didn't make it
return false;
}
/**
* Deserializes a SocketPermission object from
* an input stream.
*
* @param input the input stream.
* @throws IOException if an I/O error occurs in the stream.
* @throws ClassNotFoundException if the class of the
* serialized object could not be found.
*/
private void readObject(ObjectInputStream input)
throws IOException, ClassNotFoundException
{
input.defaultReadObject();
setHostPort(getName());
setActions(actions);
}
/**
* Serializes a SocketPermission object to an
* output stream.
*
* @param output the output stream.
* @throws IOException if an I/O error occurs in the stream.
*/
private void writeObject(ObjectOutputStream output)
throws IOException
{
actions = getActions();
output.defaultWriteObject();
}
}