java.lang.Object
net.i2p.i2ptunnel.access.AccessFilter
All Implemented Interfaces:
IncomingConnectionFilter, StatefulConnectionFilter
class AccessFilterextends Object implements StatefulConnectionFilter
Incoming connection filter configurable through access list rules.

Tracks known destinations (defined in access lists) and unknown destinations (recently attempted connections). Reloads access lists from disk when modified to allow user edits. Writes recorder data to disk at intervals when new threshold breaches occur.

  • Field Details

    • PURGE_INTERVAL

      private static final long PURGE_INTERVAL
      Interval between the expired entry purges.
      See Also:

    • SYNC_INTERVAL

      private static final long SYNC_INTERVAL
      Interval between the writes to disk.
      See Also:

    • MAX_STORED_DESTS

      private static final int MAX_STORED_DESTS
      Destinations remembered between the writes.
      See Also:

    • DISK_WRITER

      private static final ExecutorService DISK_WRITER
      All disk i/o from all instances of this filter happen on this thread (apart from initial load).

    • definition

      private final FilterDefinition definition
      The definition the filter was built from.

    • context

      private final I2PAppContext context
      The app context.

    • timersRunning

      private final AtomicBoolean timersRunning
      True while the purge and sync timers run.

    • recorderFiles

      private final Map<File, AccessFilter.RecorderFileState> recorderFiles
      Per-recorder file read cache; keyed by the persisted breach file and only touched on the single DISK_WRITER thread inside record(), so no locking is required.

    • knownDests

      private final Map<Hash, DestTracker> knownDests
      Trackers for known destinations defined in access lists.

    • unknownDests

      private final Map<Hash, DestTracker> unknownDests
      Trackers for unknown destinations not defined in access lists.

    • syncer

      private volatile AccessFilter.Syncer syncer
      The timer writing the filter to disk.

  • Constructor Details

    • AccessFilter

      AccessFilter(I2PAppContext context, FilterDefinition definition) throws IOException
      Create a new access filter.
      Parameters:
      context - the context, used for scheduling and timer purposes
      definition - definition of this filter
      Throws:
      IOException - if an I/O error occurs

  • Method Details

    • shutdownDiskWriter

      private static void shutdownDiskWriter()
      Stops the timer writing the filter to disk.

    • start

      public void start()
      Starts the filter's background tasks.

      Initializes the purger and syncer timers to begin tracking connection attempts and periodically saving state to disk.

      Specified by:
      start in interface StatefulConnectionFilter

    • stop

      public void stop()
      Stops the filter's background tasks.

      Halts the purger and syncer timers. Existing connection data is retained until the next purge cycle.

      Specified by:
      stop in interface StatefulConnectionFilter

    • allowDestination

      public boolean allowDestination(Destination d)
      Determines if a connection to the given destination should be allowed.

      Checks the destination against known and unknown destination trackers. If the destination has exceeded its threshold for the current time window, the connection is denied. Unknown destinations start with the default threshold.

      Specified by:
      allowDestination in interface IncomingConnectionFilter
      Parameters:
      d - the destination to check
      Returns:
      true if the connection should be allowed, false if denied

    • reload

      private void reload() throws IOException
      Re-reads the filter definitions from disk.
      Throws:
      IOException - if the definitions cannot be read

    • record

      private void record() throws IOException
      Writes the recorded connections to disk.
      Throws:
      IOException - if the records cannot be written

    • readRecorderFile

      static AccessFilter.RecorderFileState readRecorderFile(File file) throws IOException
      Read the persisted breached-b32 set for a recorder file, capturing its (lastModified, length) signature at read time.

      The set is the plain set of lines in the file (raw b32 strings); no parsing is done, matching the historic reader. A missing or non-file yields an empty set with valid == false so a later appearance of the file is detected as a change.

      Parameters:
      file - the breach recorder file
      Returns:
      the read set plus its signature
      Throws:
      IOException - on an error reading the file

    • recorderFileUnchanged

      static boolean recorderFileUnchanged(AccessFilter.RecorderFileState cached, File file)
      Whether a recorder file's on-disk signature still matches the one captured when cached was read, i.e. whether the cached breached set can be reused without opening the file again.

      The recorder file is almost always written only by this filter, so on the 5-second sync cycle the file is unchanged and the set is reused. External edits (recreating the file) change the signature and force a re-read, so user changes are still picked up. Misses on a missing file are reported as unchanged so an absent file does not re-read either.

      Parameters:
      cached - the previous AccessFilter.RecorderFileState, or null on first use
      file - the breach recorder file
      Returns:
      true if cached.breached is still current

    • purge

      private void purge()
      Drops the expired entries from the filter.