From 5e1a2f56208a960185f86cdb646e0a8b0fdd2db6 Mon Sep 17 00:00:00 2001
From: aoshiguchen <1052045476@qq.com>
Date: Sat, 9 Dec 2023 23:40:02 +0800
Subject: [PATCH] =?UTF-8?q?tcp=E4=BB=A3=E7=90=86=EF=BC=8C=E9=92=88?=
 =?UTF-8?q?=E5=AF=B9=E5=AE=89=E5=85=A8=E7=BB=84=E8=8E=B7=E5=8F=96=E7=9C=9F?=
 =?UTF-8?q?=E5=AE=9Eip=E9=80=BB=E8=BE=91=E4=BC=98=E5=8C=96?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../server/proxy/core/TcpVisitorChannelHandler.java   | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java
index 5dcc535c..b859f868 100644
--- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java
+++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java
@@ -7,6 +7,7 @@ import io.netty.channel.ChannelHandlerContext;
 import io.netty.channel.ChannelOption;
 import io.netty.channel.SimpleChannelInboundHandler;
 import lombok.extern.slf4j.Slf4j;
+import org.apache.commons.lang3.StringUtils;
 import org.dromara.neutrinoproxy.core.Constants;
 import org.dromara.neutrinoproxy.core.ProxyMessage;
 import org.dromara.neutrinoproxy.core.util.IpUtil;
@@ -51,10 +52,16 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteBu
             ctx.channel().close();
             return;
         }
+        byte[] bytes = new byte[buf.readableBytes()];
+        buf.readBytes(bytes);
 
         // 判断IP是否在该端口绑定的安全组允许的规则内
+        String ip = IpUtil.getRealRemoteIp(new String(bytes));
+        if (StringUtils.isEmpty(ip)) {
+            ip = IpUtil.getRemoteIp(ctx);
+        }
         InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
-        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
+        if (!securityGroupService.judgeAllow(ip, portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
             // 不在安全组规则放行范围内
             ctx.channel().close();
             return;
@@ -64,8 +71,6 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteBu
         visitorChannel.config().setAutoRead(proxyChannel.isWritable());
 
         // 转发代理数据
-        byte[] bytes = new byte[buf.readableBytes()];
-        buf.readBytes(bytes);
         String visitorId = ProxyUtil.getVisitorIdByChannel(visitorChannel);
         proxyChannel.writeAndFlush(ProxyMessage.buildTransferMessage(visitorId, bytes));