public static RestrictionType allowedByHostRestrictions()

in extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/RestrictionVerificationService.java [196:273]
49 lines of code
21 McCabe index (conditional complexity)

    public static RestrictionType allowedByHostRestrictions(String allowedHostsString,
            String deniedHostsString, String remoteAddress) {
        
        // If attributes do not exist or are empty then the action is allowed.
        if ((allowedHostsString == null || allowedHostsString.isEmpty()) 
                && (deniedHostsString == null || deniedHostsString.isEmpty()))
            return RestrictionType.IMPLICIT_ALLOW;
        
        // If the remote address cannot be determined, and restrictions are
        // in effect, log an error and deny the action.
        if (remoteAddress == null || remoteAddress.isEmpty()) {
            LOGGER.warn("Host-based restrictions are present, but the remote "
                    + "address is invalid or could not be resolved. "
                    + "The action will not be allowed.");
            return RestrictionType.IMPLICIT_DENY;
        }
        
        // Convert the string to a HostName
        HostName remoteHostName = new HostName(remoteAddress);
        
        // Split denied hosts attribute and process each entry, checking them
        // against the current remote address, and returning a deny restriction
        // if a match is found, or if an error occurs in processing a host in
        // the list.
        List<HostName> deniedHosts = HostRestrictionParser.parseHostList(deniedHostsString);
        for (HostName hostName : deniedHosts) {

            try {
                if (hostName.isAddress()
                        && hostName.toAddress().contains(remoteHostName.asAddress())) {
                    return RestrictionType.EXPLICIT_DENY;
                }

                else {
                    for (IPAddress currAddr : hostName.toAllAddresses())
                        if (currAddr.matches(remoteHostName.asAddressString()))
                            return RestrictionType.EXPLICIT_DENY;
                }
            }
            catch (UnknownHostException | HostNameException e) {
                LOGGER.warn("Unknown or invalid host in denied hosts list: \"{}\"", hostName);
                LOGGER.debug("Exception while trying to resolve host: \"{}\"", hostName, e);
                return RestrictionType.IMPLICIT_DENY;
            }
        }
        
        // If denied hosts have been checked and allowed hosts are empty, we're
        // good, and can allow the action.
        if (allowedHostsString == null || allowedHostsString.isEmpty())
            return RestrictionType.IMPLICIT_ALLOW;
        
        // Run through allowed hosts, if there are any, and return, allowing the
        // action if there are any matches.
        List<HostName> allowedHosts = HostRestrictionParser.parseHostList(allowedHostsString);
        for (HostName hostName : allowedHosts) {
            try {
                // If the entry is an IP or Subnet, check the remote address against it directly
                if (hostName.isAddress() && hostName.toAddress().contains(remoteHostName.asAddress()))
                    return RestrictionType.EXPLICIT_ALLOW;
                
                // Entry is a hostname, so resolve to IPs and check each one
                for (IPAddress currAddr : hostName.toAllAddresses())
                    if (currAddr.matches(remoteHostName.asAddressString()))
                        return RestrictionType.EXPLICIT_ALLOW;
                
            }
            // If an entry cannot be resolved we will log a warning.
            catch (UnknownHostException | HostNameException e) {
                LOGGER.warn("Unknown host encountered in allowed host string: {}", hostName);
                LOGGER.debug("Exception received trying to resolve host: {}", hostName, e);
            }
        }
        
        // If we've made it here, the allowed hosts do not contain the remote
        // address, and the action should not be allowed;
        return RestrictionType.IMPLICIT_DENY;
        
    }