public static RestrictionType allowedByHostRestrictions(String allowedHostsString,
            String deniedHostsString, String remoteAddress) {
        
        // If attributes do not exist or are empty then the action is allowed.
        if ((allowedHostsString == null || allowedHostsString.isEmpty()) 
                && (deniedHostsString == null || deniedHostsString.isEmpty()))
            return RestrictionType.IMPLICIT_ALLOW;
        
        // If the remote address cannot be determined, and restrictions are
        // in effect, log an error and deny the action.
        if (remoteAddress == null || remoteAddress.isEmpty()) {
            LOGGER.warn("Host-based restrictions are present, but the remote "
                    + "address is invalid or could not be resolved. "
                    + "The action will not be allowed.");
            return RestrictionType.IMPLICIT_DENY;
        }
        
        // Convert the string to a HostName
        HostName remoteHostName = new HostName(remoteAddress);
        
        // Split denied hosts attribute and process each entry, checking them
        // against the current remote address, and returning a deny restriction
        // if a match is found, or if an error occurs in processing a host in
        // the list.
        List<HostName> deniedHosts = HostRestrictionParser.parseHostList(deniedHostsString);
        for (HostName hostName : deniedHosts) {

            try {
                if (hostName.isAddress()
                        && hostName.toAddress().contains(remoteHostName.asAddress())) {
                    return RestrictionType.EXPLICIT_DENY;
                }

                else {
                    for (IPAddress currAddr : hostName.toAllAddresses())
                        if (currAddr.matches(remoteHostName.asAddressString()))
                            return RestrictionType.EXPLICIT_DENY;
                }
            }
            catch (UnknownHostException | HostNameException e) {
                LOGGER.warn("Unknown or invalid host in denied hosts list: \"{}\"", hostName);
                LOGGER.debug("Exception while trying to resolve host: \"{}\"", hostName, e);
                return RestrictionType.IMPLICIT_DENY;
            }
        }
        
        // If denied hosts have been checked and allowed hosts are empty, we're
        // good, and can allow the action.
        if (allowedHostsString == null || allowedHostsString.isEmpty())
            return RestrictionType.IMPLICIT_ALLOW;
        
        // Run through allowed hosts, if there are any, and return, allowing the
        // action if there are any matches.
        List<HostName> allowedHosts = HostRestrictionParser.parseHostList(allowedHostsString);
        for (HostName hostName : allowedHosts) {
            try {
                // If the entry is an IP or Subnet, check the remote address against it directly
                if (hostName.isAddress() && hostName.toAddress().contains(remoteHostName.asAddress()))
                    return RestrictionType.EXPLICIT_ALLOW;
                
                // Entry is a hostname, so resolve to IPs and check each one
                for (IPAddress currAddr : hostName.toAllAddresses())
                    if (currAddr.matches(remoteHostName.asAddressString()))
                        return RestrictionType.EXPLICIT_ALLOW;
                
            }
            // If an entry cannot be resolved we will log a warning.
            catch (UnknownHostException | HostNameException e) {
                LOGGER.warn("Unknown host encountered in allowed host string: {}", hostName);
                LOGGER.debug("Exception received trying to resolve host: {}", hostName, e);
            }
        }
        
        // If we've made it here, the allowed hosts do not contain the remote
        // address, and the action should not be allowed;
        return RestrictionType.IMPLICIT_DENY;
        
    }
Given the strings of allowed and denied hosts, verify that the login or
connection should be allowed from the given remote address, returning
the RestrictionType that matches the provided allowed and denied strings.

@param allowedHostsString
    The string containing a semicolon-separated list of hosts from
    which the login or connection should be allowed, or null or an empty
    string if no specific set of allowed hosts is defined.

@param deniedHostsString
    The string containing a semicolon-separated list of hosts from
    which the login or connection should be denied, or null or an empty
    string if no specific set of denied hosts is defined.

@param remoteAddress
    The IP address from which the user is logging in or has logged in
    and is attempting to connect from, if it is known. If it is unknown
    and restrictions are defined, the login or connection will be denied.

@return
    A RestrictionType that matches the provided allow and deny strings.
extensions/guacamole-auth-restrict/src/main/java/org/apache/guacamole/auth/restrict/RestrictionVerificationService.java