From a21a786884d65bdba2509122d65c30a7f5642059 Mon Sep 17 00:00:00 2001
From: az <lttzhu@163.com>
Date: Sat, 9 Dec 2023 22:30:07 +0800
Subject: [PATCH 1/2] =?UTF-8?q?=E4=BF=AE=E6=94=B9TcpVisitorHandler?=
 =?UTF-8?q?=E8=8E=B7=E5=8F=96=E7=9C=9F=E5=AE=9EIP=E5=9C=B0=E5=9D=80?=
 =?UTF-8?q?=E7=9A=84=E6=96=B9=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../neutrinoproxy/core/util/IpUtil.java       | 30 +++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java b/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java
index 74ec5859..571a7d63 100644
--- a/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java
+++ b/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java
@@ -1,5 +1,6 @@
 package org.dromara.neutrinoproxy.core.util;
 
+import cn.hutool.core.net.Ipv4Util;
 import io.netty.channel.ChannelHandlerContext;
 
 import java.net.InetSocketAddress;
@@ -15,4 +16,33 @@ public class IpUtil extends org.noear.solon.core.util.IpUtil {
         return remoteAddress;
     }
 
+    /**
+     * 工作原理为从http协议的header中找公网地址，此主要用于处理nginx转发时塞进去的真实IP的header，找不到返回null
+     * @param httpContent http协议文档内容
+     * @return 返回找到的第一个公网地址
+     */
+    public static String getRealRemoteIp(String httpContent) {
+        String headerContent = httpContent.split("\r\n\r\n")[0];
+        String[] lines = headerContent.split("\r\n");
+        String firstLine = lines[0];
+        if (!(firstLine.endsWith("HTTP/1.1") || firstLine.endsWith("HTTP/1.0"))) {
+            return null;
+        }
+        for (int i = 1; i < lines.length; i++) {
+            String line = lines[i];
+            // 匹配有ipv4地址格式的header
+            if (!line.matches(".*(\\d+\\.){3}\\d+")) {
+                continue;
+            }
+            // 截取IP地址
+            String ip = line.substring(line.charAt(':'));
+            if (!Ipv4Util.isInnerIP(ip)) {
+                return ip;
+            }
+        }
+        return null;
+    }
+
+
+
 }

From d072c05d314b9eb6738e740677c51d8e9ceb115b Mon Sep 17 00:00:00 2001
From: az <lttzhu@163.com>
Date: Sat, 9 Dec 2023 22:30:31 +0800
Subject: [PATCH 2/2] =?UTF-8?q?=E4=BF=AE=E6=94=B9TcpVisitorHandler?=
 =?UTF-8?q?=E8=8E=B7=E5=8F=96=E7=9C=9F=E5=AE=9EIP=E5=9C=B0=E5=9D=80?=
 =?UTF-8?q?=E7=9A=84=E6=96=B9=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../proxy/enhance/HttpVisitorChannelHandler.java     | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
index a7640a11..42e0f747 100644
--- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
+++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
@@ -77,7 +77,8 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         // 用户连接到代理服务器时，设置用户连接不可读，等待代理后端服务器连接成功后再改变为可读状态
         ctx.channel().config().setOption(ChannelOption.AUTO_READ, false);
 
-        String host = getHost(bytes);
+        String httpContent = new String(bytes);
+        String host = getHost(httpContent);
         log.debug("HttpProxy host: {}", host);
         if (StringUtils.isBlank(host)) {
             ctx.channel().close();
@@ -98,7 +99,11 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         }
 
         // 判断IP是否在该端口绑定的安全组允许的规则内
-        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(serverPort))) {
+        String ip = IpUtil.getRealRemoteIp(httpContent);
+        if (ip == null) {
+            ip = IpUtil.getRemoteIp(ctx);
+        }
+        if (!securityGroupService.judgeAllow(ip, portMappingService.getSecurityGroupIdByMappingPort(serverPort))) {
             // 不在安全组规则放行范围内
             ctx.channel().close();
             return;
@@ -167,8 +172,7 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         ctx.close();
     }
 
-    private String getHost(byte[] buf) {
-        String req = new String(buf);
+    private String getHost(String req) {
         String[] lines = req.split("\r\n");
         String firstLine = lines[0];
         if (!(firstLine.endsWith("HTTP/1.1") || firstLine.endsWith("HTTP/1.0"))) {