de.yaacc.share.ProxyAccessPolicy Class Reference

Decides whether a request to the media proxy may be served, from the remote address alone. More...

Collaboration diagram for de.yaacc.share.ProxyAccessPolicy:

Static Public Member Functions
static boolean	isAllowed (boolean restrictToReceivers, Set< String > allowedAddresses, String remoteAddress)
static String	normalize (String address)
	Brings an IP literal into the one form used for comparing:
static Set< String >	normalizeAll (Collection< String > rawAddresses)
	Builds a ready-to-use allowed set from raw address texts (e.g.

Detailed Description

Decides whether a request to the media proxy may be served, from the remote address alone.

Plain Java so it can be unit tested on the JVM. The key and the expiry are checked elsewhere (ShareRegistry#lookup(String)); this is only the IP step.

With restrictToReceivers off every remote address passes this step (even a missing one). With it on, the remote address must equal one of the entry's allowed addresses after normalize(String); anything unclear is denied (fail closed). Loopback is not special: it passes only if the set contains it (the caller adds loopback and the own address when the receiver is the local device). Names are never resolved, networks and wildcards never match.

Both sides are normalized before comparing: the remote address AND every element of the allowed set, so the glue may add raw strings (mapped IPv6 vs IPv4, upper case, zone ids, whitespace); elements that do not normalize to an IP literal are ignored (they never match).

Member Function Documentation

isAllowed()

static boolean de.yaacc.share.ProxyAccessPolicy.isAllowed ( boolean restrictToReceivers, Set< String > allowedAddresses, String remoteAddress )

static

Parameters

restrictToReceivers	the "Restrict the media proxy to the chosen receivers" setting
allowedAddresses	the entry's allowed receiver addresses, may be null (denies when restricting)
remoteAddress	the request's remote address as text, may be null

Returns

true if the request may be served as far as the address is concerned

Here is the call graph for this function:

normalize()

static String de.yaacc.share.ProxyAccessPolicy.normalize ( String address )

static

Brings an IP literal into the one form used for comparing:

• surrounding whitespace and an IPv6 zone id (%wlan0) are removed;
• IPv4 stays dotted decimal (four parts 0-255, no leading zeros, no short forms);
• IPv6 becomes eight lowercase hex groups without leading zeros and without :: compression, e.g. ::1 becomes 0:0:0:0:0:0:0:1;
• an IPv4-mapped IPv6 address (::ffff:192.168.1.5 or ::ffff:c0a8:105) becomes the plain IPv4 text; the deprecated IPv4-compatible form (::192.168.1.5) is NOT mapped.

Returns

the normalized text, or null for null, empty, brackets, host names, a zone on an IPv4 address and every other text that is not an IP literal

Referenced by de.yaacc.share.ProxyAccessPolicy.isAllowed().

Here is the caller graph for this function:

normalizeAll()

static Set< String > de.yaacc.share.ProxyAccessPolicy.normalizeAll ( Collection< String > rawAddresses )

static

Builds a ready-to-use allowed set from raw address texts (e.g.

a URL host or InetAddress#getHostAddress()): for each element surrounding whitespace is removed, then ONE pair of surrounding brackets ([::1], as in a URL host) is stripped, then normalize(String) is applied. Elements that are null or do not normalize to an IP literal (host names, garbage, [[::1]], a bracket pair around an IPv4 address with a zone, ...) are dropped; duplicates collapse.

isAllowed(boolean, Set, String) itself does NOT strip brackets (it only normalizes, so a bracketed element of a raw set never matches): the glue passes its raw texts through this method first.

Parameters

rawAddresses

may be null

Returns

a new unmodifiable set, never null (null input gives an empty set)

Referenced by de.yaacc.share.ShareAddresses.build(), and de.yaacc.share.LinkTargetPolicy.isAllowedTarget().

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• /github/workspace/yaacc/src/main/java/de/yaacc/share/ProxyAccessPolicy.java