Chapter 7

IP Address Checking
This chapter explains how UPLOADit checks IP addresses against the Allow and Deny IP lists you can define for your Realms.

Checking Procedure

When a user connects to your UPLOADit server to upload a file, the plug-in checks to make sure that user can connect to your UPLOADit server by comparing the user's IP address against the Denied and Allowed IP addresses that you have defined for your realms. Below is the process in which UPLOADit decides if it needs to block a user's IP addresses: (You may wish to refer to the example realm in Figure 7.1 below when you are reading through this process.)

  1. The plug-in first assumes that the IP Address is not blocked. This is the default.

  2. The plug-in then checks to see if it should be denying all IP addresses. It checks that using this method:

    1. The plug-in looks to see if you have denied all IP addresses for the realm the user is uploading files to. (It looks to see if you have <denyip>all</denyip> in the realm.)
    2. If the realm does not have all IP Addresses denied, it looks to see if the default realm has denied all IP addresses. (It looks to see if you have <defaultdenyip>all</defaultdenyip>.)
    3. If the default realm does deny all IP Addresses, it looks back into the realm the user is uploading files to and checks to see if all IP Addresses have been re-allowed. (It looks to see if you have <allowip>all</allowip> in the realm.)

  3. The plug-in now knows if it should consider all IP addresses to be denied or allowed, so it takes one of two courses:

    1. If all IP addresses are being denied, the plug-in uses this method to see if it should re-allow this IP address:

      1. The plug-in looks to see if the IP address has been allowed by the realm the user is trying to upload files to. (It looks to see if there is an <allowip>X.X.X.X</allowip> in the realm where the IP address is X.X.X.X, or if there is an <allowip>Y.Y.Y.Y-Z.Z.Z.Z</allowip> in the realm where the IP address is in the range Y.Y.Y.Y-Z.Z.Z.Z.)
      2. If the plug-in does not find the IP address in the list of allowed IP addresses in the realm, it looks to see if the IP address has been allowed by the default realm. (It looks to see if there is a <defaultallowip>X.X.X.X</defaultallowip> where the IP address is X.X.X.X, or if there is a <defaultallowip>Y.Y.Y.Y-Z.Z.Z.Z</defaultallowip> where the IP address is in the range Y.Y.Y.Y-Z.Z.Z.Z.)
      3. If the plug-in does not find the IP Address in either of the list of allowed IP addresses, it checks to see if the IP address is the loopback address (127.0.0.1), and if so, it allows the connection. (The plug-in does this so that when testing your UPLOADit server on your own machine, it will always allow you to connect.)
      4. If the plug-in could not find the IP address in any of the above allowed IP address lists, it blocks the IP address and the user receives an error web page telling them their IP address has been blocked.

    2. If all IP addresses are being allowed, the plug-in uses this method to see if it should deny this IP address:

      1. The plug-in looks to see if the IP address has been denied by the realm the user is trying to upload files to. (It looks to see if there is a <denyip>X.X.X.X</denyip> in the realm where the IP address is X.X.X.X, or if there is a <denyip>Y.Y.Y.Y-Z.Z.Z.Z</denyip> in the realm where the IP address is in the range Y.Y.Y.Y-Z.Z.Z.Z.)
      2. If the plug-in does not find the IP address in the list of denied IP addresses in the realm, it looks to see if the IP address has been denied by the default realm. (It looks to see if there is a <defaultdenyip>X.X.X.X</defaultdenyip> where the IP address is X.X.X.X, or if there is a <defaultdenyip>Y.Y.Y.Y-Z.Z.Z.Z</defaultdenyip> where the IP address is in the range Y.Y.Y.Y-Z.Z.Z.Z.)
      3. If the plug-in could not find the IP address in any of the above denied IP address lists, it allows the user to upload the file.

Here is an example UPLOADit_Realms.xml file with example allowed and denied IP lists:

  1. <UPLOADit>
  2. <defaultpath>/UPLOADit/</defaultpath>
  3. <defaultresulturl>http://www.mydomain.com/thankyou.htm</defaultresulturl>
  4. <defaultdenyip>all</defaultdenyip>
  5. <defaultallowip>192.168.0.1-192.168.0.10</defaultallowip>
  6. <realm name="test1">
  7. <path>/UPLOADit/test1/</path>
  8. <allowip>172.16.0.25</allowip>
  9. <allowip>192.168.0.11-192.168.0.20</allowip>
  10. </realm>
  11. <realm name="test2">
  12. <path>/UPLOADit/test2/</path>
  13. <allowip>all</allowip>
  14. <denyip>172.16.0.25</denyip>
  15. </realm>
  16. </UPLOADit>
Figure 7.1 Example UPLOADit_Realms.xml file

Here are some example users that are trying to upload files to the UPLOADit server, and the reasons why they would be denied or allowed to connect to the UPLOADit server (based on the above UPLOADit_Realms.xml file):

  1. User A has the IP Address 192.168.0.14.
    • If this user tried to upload files to the default realm, his IP address would be blocked because all IP addresses have been denied in the default realm, and only the IP addresses in the range 192.168.0.1 to 192.168.0.10 have been allowed.
    • If this user tried to upload files to the "test1" realm, his IP address would be allowed to connect because even though the default realm has denied all IP addresses, his IP address is in the range 192.168.0.11 to 192.168.0.20, which has been allowed by the "test1" realm.
    • If this user tried to upload files to the "test2" realm, his IP address would be allowed to connect because even though the default realm has denied all IP addresses, the "test2" realm has re-allowed all IP addresses.

  2. User B has the IP Address 172.16.0.25.
    • If this user tried to upload files to the default realm, her IP address would be blocked because all IP addresses have been denied in the default realm, and her IP address is not in the range 192.168.0.1 to 192.168.0.10.
    • If this user tried to upload files to the "test1" realm, her IP address would be allowed to connect because even though the default realm has denied all IP address, her IP address is 172.16.0.25, which has been specifically allowed.
    • If this user tried to upload files to the "test2" realm, her IP address would be blocked because her IP address is 172.16.0.25, which has been specifically denied.

  3. User C has the IP Address 192.168.0.7.
    • If this user tried to upload files to the default realm, his IP address would be allowed to connect because even though the default realm has denied all IP addresses, his IP address is in the range 192.168.0.1 to 192.168.0.10, which has been re-allowed by the default realm.
    • If this user tried to upload files to the "test1" realm, his IP address would be allowed to connect because even though the default realm has denied all IP addresses, his IP address is in the range 192.168.0.1 to 192.168.0.10, which has been re-allowed by the default realm.
    • If this user tried to upload files to the "test2" realm, his IP address would be allowed to connect because even though the default realm has denied all IP addresses, the "test2" realm has re-allowed all IP addresses.