[WebLogic] Connection Filter Rules Syntax 联接过虑规则语法

Connection Filter Rules Syntax

The syntax of connection filter rules is as follows:

• Each rule must be written on a single line.

• Tokens in a rule are separated by white space.

• A pound sign (#) is the comment character. Everything after a pound sign on a line is ignored.

• Whitespace before or after a rule is ignored.

• Lines consisting only of whitespace or comments are skipped.

The format of filter rules differ depending on whether you are using a filter file to enter the filter rules or you enter the filter rules on the Administration Console.

• When entering the filter rules on the Administration Console, enter them in the following format:

  targetAddress localAddress localPort action protocols
  

• When specifying rules in the filter file, enter them in the following format:

  targetAddress action protocols 
  

  • targetAddress specifies one or more systems to filter.

  • localAddress defines the host address of the WebLogic Server instance. (If you specify an asterisk (*), the match returns all local IP addresses.)

  • localPort defines the port on which the WebLogic Server instance is listening. (If you specify an asterisk (*), the match returns all available ports on the server).

  • action specifies the action to perform. This value must be allow or deny.

  • protocols is the list of protocol names to match. The following protocols may be specified: http, https, t3, t3s, ldap, ldaps, iiop, iiops, and com. (Although the giop, giops, and dcom protocol names are still supported, their use is deprecated as of release 9.0; you should use the equivalent iiop, iiops, and com protocol names.)

    Note:

    The SecurityConfigurationMBean provides a CompatibilityConnectionFiltersEnabled attribute for enabling compatibility with previous connection filters.

  • If no protocol is defined, all protocols will match a rule.

Two types of filter rules are recognized:

• Fast rules

  A fast rule applies to a hostname or IP address with an optional netmask. If a hostname corresponds to multiple IP addresses, multiple rules are generated (in no particular order). Netmasks can be specified either in numeric or dotted-quad form. For example:

  dialup-555-1212.pa.example.net 127.0.0.1 7001 deny t3 t3s #http(s) OK
  192.168.81.0/255.255.254.0   127.0.0.1 8001 allow   #23-bit netmask
  192.168.0.0/16   127.0.0.1 8002 deny   #like /255.255.0.0 
  

  Hostnames for fast rules are looked up once at startup of the WebLogic Server instance. While this design greatly reduces overhead at connect time, it can result in the filter obtaining out of date information about what addresses correspond to a hostname. Oracle recommends using numeric IP addresses instead.

• Slow rules

  A slow rule applies to part of a domain name. Because a slow rule requires a connect-time DNS lookup on the client-side in order to perform a match, it may take much longer to run than a fast rule. Slow rules are also subject to DNS spoofing. Slow rules are specified as follows:

  *.script-kiddiez.org 127.0.0.1 7001 deny 
  

  An asterisk only matches at the head of a pattern. If you specify an asterisk anywhere else in a rule, it is treated as part of the pattern. Note that the pattern will never match a domain name since an asterisk is not a legal part of a domain name.

How Connection Filter Rules are Evaluated

When a client connects to WebLogic Server, the rules are evaluated in the order in which they were written. The first rule to match determines how the connection is treated. If no rules match, the connection is permitted.

To further protect your server and only allow connections from certain addresses, specify the last rule as:

0.0.0.0/0  *  *  deny

With this as the last rule, only connections that are allowed by preceding rules are allowed, all others are denied. For example, if you specify the following rules:

<Remote IP Address> * * allow https
0.0.0.0/0  *  *  deny

Only machines with the Remote IP Address are allowed to access the instance of WebLogic Server running connection filter. All other systems are denied access.