root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 19 Packages Projects Releases Wiki Activity

Polish IpAddressMatcher

This commit is contained in:
Steve Riesenberg 2024-11-14 23:13:24 -06:00
parent 3a29819651
commit 83a79159b8
No known key found for this signature in database
GPG Key ID: 3D0169B18AB8F0A9
1 changed files with 33 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

55
web/src/main/java/org/springframework/security/web/util/matcher/IpAddressMatcher.java
View File

@ -18,6 +18,7 @@ package org.springframework.security.web.util.matcher;
import java.net.InetAddress; import java.net.InetAddress;
import java.net.UnknownHostException; import java.net.UnknownHostException;
import java.util.Objects;
import java.util.regex.Pattern; import java.util.regex.Pattern;
import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletRequest;
@ -33,16 +34,17 @@ import org.springframework.util.StringUtils;
* IPv4 address will never match a request which returns an IPv6 address, and vice-versa. * IPv4 address will never match a request which returns an IPv6 address, and vice-versa.
* *
* @author Luke Taylor * @author Luke Taylor
* @author Steve Riesenberg
* @since 3.0.2 * @since 3.0.2
*/ */
public final class IpAddressMatcher implements RequestMatcher { public final class IpAddressMatcher implements RequestMatcher {
private static Pattern IPV4 = Pattern.compile("\\d{0,3}.\\d{0,3}.\\d{0,3}.\\d{0,3}(/\\d{0,3})?"); private static Pattern IPV4 = Pattern.compile("\\d{0,3}.\\d{0,3}.\\d{0,3}.\\d{0,3}(/\\d{0,3})?");
private final int nMaskBits;
private final InetAddress requiredAddress; private final InetAddress requiredAddress;
private final int nMaskBits;
/** /**
* Takes a specific IP address or a range specified using the IP/Netmask (e.g. * Takes a specific IP address or a range specified using the IP/Netmask (e.g.
* 192.168.1.0/24 or 202.24.0.0/14). * 192.168.1.0/24 or 202.24.0.0/14).
@ -52,18 +54,22 @@ public final class IpAddressMatcher implements RequestMatcher {
public IpAddressMatcher(String ipAddress) { public IpAddressMatcher(String ipAddress) {
Assert.hasText(ipAddress, "ipAddress cannot be empty"); Assert.hasText(ipAddress, "ipAddress cannot be empty");
assertNotHostName(ipAddress); assertNotHostName(ipAddress);
String requiredAddress;
int nMaskBits;
if (ipAddress.indexOf('/') > 0) { if (ipAddress.indexOf('/') > 0) {
String[] addressAndMask = StringUtils.split(ipAddress, "/"); String[] parts = Objects.requireNonNull(StringUtils.split(ipAddress, "/"));
ipAddress = addressAndMask[0]; requiredAddress = parts[0];
this.nMaskBits = Integer.parseInt(addressAndMask[1]); nMaskBits = Integer.parseInt(parts[1]);
} }
else { else {
this.nMaskBits = -1; requiredAddress = ipAddress;
nMaskBits = -1;
} }
this.requiredAddress = parseAddress(ipAddress); this.requiredAddress = parseAddress(requiredAddress);
String finalIpAddress = ipAddress; this.nMaskBits = nMaskBits;
Assert.isTrue(this.requiredAddress.getAddress().length * 8 >= this.nMaskBits, () -> String Assert.isTrue(this.requiredAddress.getAddress().length * 8 >= this.nMaskBits, () -> String
.format("IP address %s is too short for bitmask of length %d", finalIpAddress, this.nMaskBits)); .format("IP address %s is too short for bitmask of length %d", requiredAddress, this.nMaskBits));
} }
@Override @Override
@ -71,14 +77,14 @@ public final class IpAddressMatcher implements RequestMatcher {
return matches(request.getRemoteAddr()); return matches(request.getRemoteAddr());
} }
public boolean matches(String address) { public boolean matches(String ipAddress) {
// Do not match null or blank address // Do not match null or blank address
if (!StringUtils.hasText(address)) { if (!StringUtils.hasText(ipAddress)) {
return false; return false;
} }
assertNotHostName(address); assertNotHostName(ipAddress);
InetAddress remoteAddress = parseAddress(address); InetAddress remoteAddress = parseAddress(ipAddress);
if (!this.requiredAddress.getClass().equals(remoteAddress.getClass())) { if (!this.requiredAddress.getClass().equals(remoteAddress.getClass())) {
return false; return false;
} }
@ -88,26 +94,31 @@ public final class IpAddressMatcher implements RequestMatcher {
byte[] remAddr = remoteAddress.getAddress(); byte[] remAddr = remoteAddress.getAddress();
byte[] reqAddr = this.requiredAddress.getAddress(); byte[] reqAddr = this.requiredAddress.getAddress();
int nMaskFullBytes = this.nMaskBits / 8; int nMaskFullBytes = this.nMaskBits / 8;
byte finalByte = (byte) (0xFF00 >> (this.nMaskBits & 0x07));
for (int i = 0; i < nMaskFullBytes; i++) { for (int i = 0; i < nMaskFullBytes; i++) {
if (remAddr[i] != reqAddr[i]) { if (remAddr[i] != reqAddr[i]) {
return false; return false;
} }
} }
byte finalByte = (byte) (0xFF00 >> (this.nMaskBits & 0x07));
if (finalByte != 0) { if (finalByte != 0) {
return (remAddr[nMaskFullBytes] & finalByte) == (reqAddr[nMaskFullBytes] & finalByte); return (remAddr[nMaskFullBytes] & finalByte) == (reqAddr[nMaskFullBytes] & finalByte);
} }
return true; return true;
} }
private void assertNotHostName(String ipAddress) { private static void assertNotHostName(String ipAddress) {
boolean isIpv4 = IPV4.matcher(ipAddress).matches(); Assert.isTrue(isIpAddress(ipAddress),
if (isIpv4) { () -> String.format("ipAddress %s doesn't look like an IP Address. Is it a host name?", ipAddress));
return; }
}
String error = "ipAddress " + ipAddress + " doesn't look like an IP Address. Is it a host name?"; private static boolean isIpAddress(String ipAddress) {
Assert.isTrue(ipAddress.charAt(0) == '[' || ipAddress.charAt(0) == ':' // @formatter:off
|| (Character.digit(ipAddress.charAt(0), 16) != -1 && ipAddress.contains(":")), error); return IPV4.matcher(ipAddress).matches()
|| ipAddress.charAt(0) == '['
|| ipAddress.charAt(0) == ':'
|| Character.digit(ipAddress.charAt(0), 16) != -1
&& ipAddress.indexOf(':') > 0;
// @formatter:on
} }
private InetAddress parseAddress(String address) { private InetAddress parseAddress(String address) {