java.lang.Object
org.eclipse.jetty.util.component.AbstractLifeCycle
org.eclipse.jetty.util.component.ContainerLifeCycle
org.eclipse.jetty.server.handler.AbstractHandler
org.klomp.snark.standalone.HostCheckHandler
All Implemented Interfaces:
Handler, Container, Destroyable, Dumpable, LifeCycle
public class HostCheckHandlerextends AbstractHandler
Block certain Host headers to prevent DNS rebinding attacks.

Unlike in the console, this is an AbstractHandler, not a HandlerWrapper.

  • Field Details

    • _context

      private final I2PAppContext _context
      Supplies the configuration and the log.

    • _listenHosts

      private final Set<String> _listenHosts
      Host names the service will answer for.

    • PROP_ALLOWED_HOSTS

      private static final String PROP_ALLOWED_HOSTS
      Property listing the hosts that may use the service.
      See Also:

  • Constructor Details

    • HostCheckHandler

      public HostCheckHandler()
      Creates a new HostCheckHandler using the global I2P application context.

    • HostCheckHandler

      public HostCheckHandler(I2PAppContext ctx)
      Creates a new HostCheckHandler with the specified application context.
      Parameters:
      ctx - the I2P application context

  • Method Details

    • setListenHosts

      public void setListenHosts(Set<String> hosts)
      Unused, we can't get here from RunStandalone.
      Parameters:
      hosts - contains hostnames or IPs. But we allow all IPs anyway.

    • handle

      public void handle(String pathInContext, Request baseRequest, HttpServletRequest httpRequest, HttpServletResponse httpResponse) throws IOException, ServletException
      Block by Host header, redirect HTTP to HTTPS, pass everything else to the delegate.
      Throws:
      IOException
      ServletException

    • allowHost

      private boolean allowHost(String host)
      Should we allow a request with this Host header?

      ref: https://en.wikipedia.org/wiki/DNS_rebinding

      Parameters:
      host - the HTTP Host header, null ok
      Returns:
      true if OK

    • getHost

      private static String getHost(String host)
      Strip [] and port from a host header.
      Parameters:
      host - the HTTP Host header non-null
      Returns:
      the host with IPv6 brackets and any port removed