Nav
You are viewing an older version of this section. Click here to navigate to the latest version.

Mule Filter Processor

Filter Unsecure Messages

Generally positioned immediately after an inbound endpoint in a Mule flow, the Mule Filter Processor evaluates two message properties, then rejects the message if the values fall outside of its configured parameters. The properties that are evaluated are:

  • IP address – If the IP address of a message falls outside the filter’s configured IP address range, Mule does not process the message (see image below).

  • Creation timestamps — Where the message’s creation date and time fall outside the filter’s configured acceptable lifespan (i.e. the message is older than expected), Mule does not process the message (see image below).

    filter3

When to Use a Filter

Use a Mule Filter Processor to protect a network, database, or system from unauthorized access by users outside the network. In other words, use a filter to exclude users from non-authorized IP addresses from accessing your system.

Further, use a security filter to protect your resource against a replay attack. By rejecting messages with a lifespan that exceeds a short timeframe — 30 seconds, for example — Mule protects your application from processing the same message a user maliciously sends multiple times. To be effective, a Mule flow should employ a digital signature, in addition to this type of security filter, to sign the creation time of the message.

Configuring the Mule Filter Processor

This topic introduces the idea of Global Elements; if you are unfamiliar with this functionality, access Understand Global Mule Elements to learn more before proceeding.

The following steps describe how to configure the Mule Filter Processor to filter by IP address range.

  1. Create a new project and drag an HTTP inbound endpoint onto the canvas.

  2. Add a Filter Global Element to the Mule application. To do so, complete the following steps:

    1. Click the Global Elements tab to display the Global Elements pane.

    2. Click Create. The Choose Global Type window pops up.

    3. In the Filter input box, type filter. The drop-down list should now only display the Filters component under Cloud Connectors.

      choose_global_filter

    4. Select the Filters component, then click OK.

    5. The Global Elements Properties window pops up. In the Name field, type a useful, descriptive name for the filter, then click OK.

    6. Click the Message Flow tab to go back to the Message Flow pane.

  3. Identify where, in the flow, to place the first security filter. In this case, we want Mule to process only those messages that originate from a specific range of IP addresses. In Mule Studio, drag a Filter building block onto the canvas, dropping it next to the HTTP inbound endpoint.

    Filter_Flow1

  4. Double-click the Filter icon to open its Pattern Properties window. 

  5. Enter a descriptive Display Name for this element.

  6. In the Config reference drop-down menu, select the Global Element that you defined for the IP Filter.

  7. In the Operation drop-down menu, select the filter strategy that you wish to apply.

Filter Strategies

The Mule Filter processor allows you to filter messages according to the following four filter strategies:

Operation Description Example

Filter by IP

Type an IP address or regular expression to define the address or range from which the Filter will accept connections.

Regex: 192.168.1.10192.168.1.* (to allow the range from 1.0 to 1.254)

Filter by IP range

Enter a net address and mask to determine the IP range. The IP addresses or ranges you enter will be considered valid, and allowed by the Filter.

Net: 192.168.1.0

Mask: 255.255.255.0

Filter by IP range CIDR

Enter the desired IP range in CIDR notation.

Cidr:192.168.1.0/24

Filter expired

This option allows you to define an expiration time for the message.

  • To define an expiration time based upon the time a message entered the flow, enter a Mule Expression to call a variable that provides this date and time in ISO 8601 format (yyyy-MM-dd’T’hh:mm:ssZ), and an expiration time in milliseconds. (Earlier in the flow, you will need to name and define this variable so that it extracts the date and time information from your message’s metadata.) The expiration time will be calculated based on the timestamp extracted from the message, and the filter will discard messages received after that expiration time.

  • To define an exact date and time after which messages should expire, enter a date and time in ISO 8601 format (yyyy-MM-dd’T’hh:mm:ssZ), and an expiration time in milliseconds. The expiration time is calculated from the precise date and time you enter, and the filter will discard messages received after that expiration time.

Date Time: #[variable:timestamp]

Expires in: 30000

Date Time:
#[payload.createdAt]

Expires in: 30000