Add IpFilter for restricting access IP ranges #57

rswheeldon · 2017-02-01T11:30:10Z

Add IpFilter for restricting access to resources from those coming from without (or outside) specific IP ranges.

Add IpAddressMatcher taken from Spring Security used for range tests

…om without (or outside) specific IP ranges. Add IpAddressMatcher taken from Spring Security used for range tests

bdemers · 2017-02-01T16:07:42Z

web/src/main/java/org/apache/shiro/web/filter/authz/IpAddressMatcher.java

+ * Both IPv6 and IPv4 addresses are supported, but a matcher which is configured with an
+ * IPv4 address will never match a request which returns an IPv6 address, and vice-versa.
+ *
+ * @author Luke Taylor originally written for Spring Security


@author tags should be removed, but a link to the original source would be great.

You can also update the NOTICE if needed. The current wording my be sufficient, but I'll leave this comment here, incase anyone else has thoughts on this.

bdemers · 2017-02-01T16:09:17Z

web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java

+ * address ranges and / or not from with a specific (denied) set.
+ * <p/>
+ * Example config:
+ * <pre>


Old Javadoc
The [filters] section is deprecated. but you can replace this with [main]

Also changing in PortFilter - which is where I cribbed it from.

bdemers · 2017-02-01T16:09:38Z

web/src/main/java/org/apache/shiro/web/filter/authz/IpFilter.java

+ * /another/path/** = localLan
+ * </pre>
+ *
+ * @since 1.0


Should be 1.4

bdemers · 2017-02-01T16:10:10Z

web/src/main/java/org/apache/shiro/web/filter/authz/IpSource.java

+
+import java.util.Collection;
+
+public interface IpSource {


Add @since tag

bdemers · 2017-02-01T16:10:38Z

web/src/test/java/org/apache/shiro/web/filter/authz/IpAddressMatcherTests.java

+import org.junit.Test;
+
+/**
+ * @author Modified by Richard Wheeldon from an original by Luke Taylor for Spring Security


See comment about @author above

bdemers · 2017-02-01T16:10:56Z

web/src/test/java/org/apache/shiro/web/filter/authz/IpAddressMatcherTests.java

+ * @author Modified by Richard Wheeldon from an original by Luke Taylor for Spring Security
+ * @since 1.4.0
+ */
+public class IpAddressMatcherTests {


Thanks for including the tests as well!!

bdemers · 2017-02-01T16:18:10Z

This should probably be added to DefaultFilter as well. Possibly using the name ipRange (not sure of that name though, ips seems too short, ipFilter doesn't match the current naming scheme, other ideas welcome)

bdemers · 2017-02-01T16:21:39Z

@rswheeldon Thanks for working on this! I added a few minor things, nothing major. You should also sign a Apache CLA.

rswheeldon · 2017-02-01T17:10:45Z

CLA was signed years ago when I pushed a load of stuff to Apache FOP. It should still be valid. If not, I'll sign a new one.

bdemers · 2017-02-01T17:14:08Z

Cool, I only took a quick look, I'll look again

rswheeldon · 2017-02-02T10:58:46Z

Updated with fixes for all the above.

bdemers · 2017-02-03T17:58:53Z

@rswheeldon
I found the CLA, I must have fat fingered the search last time.

Any thoughts on the DefaultFilter naming ?

rswheeldon · 2017-02-03T20:57:03Z

ip - it's only one character shorter than ssl. rest, port and user aren't exactly verbose either. If you agree, I'll add it.

bdemers · 2017-02-03T21:25:19Z

ip works for me

rswheeldon · 2017-02-03T21:58:24Z

Done. I don't really understand the Guice stuff though so I've done nothing more on that than make the unit tests pass.

rswheeldon · 2017-05-02T09:47:21Z

What else is needed to get this into trunk? There are no changes I'm intending on making unless there's something that's not been addressed.

bdemers · 2017-05-02T11:38:37Z

This looks good to me 👍

col-panic · 2018-03-16T11:21:51Z

Whats the status on this? Currently looking for this kind of functionality?!

bdemers · 2018-03-16T13:57:31Z

@col-panic give this PR a shot and let us know what you think!

mookkiah · 2020-04-30T12:19:40Z

Hello @col-panic @bdemers - We are looking towards to have this IP filter option in our application design. But seeing this PR left open concerns me. Is there any reason or alternative.
If it is just the merge conflict, I can contribute by resolving it. Please let me know

fpapon · 2020-04-30T12:24:14Z

@mookkiah feel free to resolve the conflict, we will merge it!

col-panic · 2020-04-30T12:27:11Z

I switched my implementation to be behind an nginx that acts as reverse proxy. This allows me to separate this concerns from the filter configuration which is now done in nginx. Due to this I did not further spend time on it. sry.

mookkiah · 2020-04-30T20:20:31Z

@fpapon Created new PR #219 after resolving merge conflict.
@col-panic I agree that we can block IP using infrastructure solution like nginx. That is an option in our design as well. Being an Apache Shiro user, I had expectation to have this solution (at least as a configurable option).
Hope this is useful for someone who wants to use simple option.

fpapon · 2020-04-30T20:28:46Z

@mookkiah thanks! I close this one.

Add IpFilter for restricting access to resources from those coming fr…

4b8e522

…om without (or outside) specific IP ranges. Add IpAddressMatcher taken from Spring Security used for range tests

bdemers reviewed Feb 1, 2017

View reviewed changes

IpFilter fixes based on code review comments

e2938cb

Add ip to DefaultFilter

988f41f

mookkiah added a commit to mookkiah/shiro that referenced this pull request Apr 30, 2020

Resolved merge conflict from PR apache#57

66695b7

mookkiah mentioned this pull request Apr 30, 2020

[SHIRO-764] Add IpFilter for restricting access IP ranges #219

Merged

fpapon closed this Apr 30, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add IpFilter for restricting access IP ranges #57

Add IpFilter for restricting access IP ranges #57

rswheeldon commented Feb 1, 2017

bdemers Feb 1, 2017

bdemers Feb 1, 2017

rswheeldon Feb 1, 2017

bdemers Feb 1, 2017

bdemers Feb 1, 2017

bdemers Feb 1, 2017

bdemers Feb 1, 2017

bdemers commented Feb 1, 2017

bdemers commented Feb 1, 2017

rswheeldon commented Feb 1, 2017

bdemers commented Feb 1, 2017

rswheeldon commented Feb 2, 2017 •

edited

Loading

bdemers commented Feb 3, 2017

rswheeldon commented Feb 3, 2017

bdemers commented Feb 3, 2017

rswheeldon commented Feb 3, 2017

rswheeldon commented May 2, 2017

bdemers commented May 2, 2017

col-panic commented Mar 16, 2018

bdemers commented Mar 16, 2018 •

edited

Loading

mookkiah commented Apr 30, 2020

fpapon commented Apr 30, 2020

col-panic commented Apr 30, 2020

mookkiah commented Apr 30, 2020

fpapon commented Apr 30, 2020

Add IpFilter for restricting access IP ranges #57

Add IpFilter for restricting access IP ranges #57

Conversation

rswheeldon commented Feb 1, 2017

bdemers Feb 1, 2017

Choose a reason for hiding this comment

bdemers Feb 1, 2017

Choose a reason for hiding this comment

rswheeldon Feb 1, 2017

Choose a reason for hiding this comment

bdemers Feb 1, 2017

Choose a reason for hiding this comment

bdemers Feb 1, 2017

Choose a reason for hiding this comment

bdemers Feb 1, 2017

Choose a reason for hiding this comment

bdemers Feb 1, 2017

Choose a reason for hiding this comment

bdemers commented Feb 1, 2017

bdemers commented Feb 1, 2017

rswheeldon commented Feb 1, 2017

bdemers commented Feb 1, 2017

rswheeldon commented Feb 2, 2017 • edited Loading

bdemers commented Feb 3, 2017

rswheeldon commented Feb 3, 2017

bdemers commented Feb 3, 2017

rswheeldon commented Feb 3, 2017

rswheeldon commented May 2, 2017

bdemers commented May 2, 2017

col-panic commented Mar 16, 2018

bdemers commented Mar 16, 2018 • edited Loading

mookkiah commented Apr 30, 2020

fpapon commented Apr 30, 2020

col-panic commented Apr 30, 2020

mookkiah commented Apr 30, 2020

fpapon commented Apr 30, 2020

rswheeldon commented Feb 2, 2017 •

edited

Loading

bdemers commented Mar 16, 2018 •

edited

Loading