From 644102996b1de23469a290d491ec84402a540a69 Mon Sep 17 00:00:00 2001
From: az <lttzhu@163.com>
Date: Sat, 9 Dec 2023 20:33:01 +0800
Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8=E7=BB=84?=
 =?UTF-8?q?=E5=AF=B9http(s)=E7=9A=84=E6=8E=A7=E5=88=B6=EF=BC=8C=E5=B9=B6?=
 =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8=E8=A7=84=E5=88=99=E7=9A=84?=
 =?UTF-8?q?=E9=BB=98=E8=AE=A4=E9=85=8D=E7=BD=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 neutrino-proxy-admin/src/lang/zh.js           |  2 +-
 .../src/views/system/securityGroup.vue        | 12 +++++-----
 .../src/views/system/securityRule.vue         | 22 ++++++++++++++-----
 .../enhance/HttpVisitorChannelHandler.java    | 17 ++++++++++++++
 4 files changed, 41 insertions(+), 12 deletions(-)

diff --git a/neutrino-proxy-admin/src/lang/zh.js b/neutrino-proxy-admin/src/lang/zh.js
index a9c3b139..998795df 100644
--- a/neutrino-proxy-admin/src/lang/zh.js
+++ b/neutrino-proxy-admin/src/lang/zh.js
@@ -179,7 +179,7 @@ export default {
     rule: '规则内容',
     passType: '放行类型',
     priority: '优先级',
-    ruleConfig: '规则配置',
+    ruleConfig: '配置规则',
     portMappingBindSecurityGroup: '绑定安全组',
     securityGroupBindPortMapping: '端口映射绑定',
     bind: '绑定',
diff --git a/neutrino-proxy-admin/src/views/system/securityGroup.vue b/neutrino-proxy-admin/src/views/system/securityGroup.vue
index 3c40a67c..7bf3413f 100644
--- a/neutrino-proxy-admin/src/views/system/securityGroup.vue
+++ b/neutrino-proxy-admin/src/views/system/securityGroup.vue
@@ -47,10 +47,10 @@
       <el-table-column align="center" :label="$t('table.actions')"  class-name="small-padding fixed-width" style="display:flex;justify-content:center">
         <template slot-scope="scope">
           <div >
+            <el-link :underline="false" type="primary" size="mini" @click="handleGoRulePage(scope.row)" style="font-size: 12px">{{$t('table.ruleConfig')}}</el-link>
             <el-link :underline="false" type="primary" size="mini" @click="handleUpdate(scope.row)" style="font-size: 12px">{{$t('table.edit')}}</el-link>
             <el-link :underline="false" v-if="scope.row.enable =='启用'" size="mini" type="warning" @click="handleDisableStatus(scope.row)" style="font-size: 12px">{{$t('table.disable')}}</el-link>
             <el-link :underline="false" v-if="scope.row.enable =='禁用'" size="mini" type="success" @click="handleEnableStatus(scope.row)" style="font-size: 12px">{{$t('table.enable')}}</el-link>
-            <el-link :underline="false" type="primary" size="mini" @click="handleGoRulePage(scope.row)" style="font-size: 12px">{{$t('table.ruleConfig')}}</el-link>
           </div>
           <el-dropdown>
             <span class="el-dropdown-link" style="font-size: 12px">
@@ -80,10 +80,12 @@
         </el-form-item>
 
         <el-form-item  :label="$t('table.defaultPassType')" prop="defaultPassType">
-          <el-select style="width: 380px" class="filter-item" v-model="temp.defaultPassType">
-            <el-option v-for="item in  passTypeList" :key="item.key" :label="item.key" :value="item.value">
-            </el-option>
-          </el-select>
+          <el-tooltip class="item" effect="dark" content="当IP地址不能匹配任何规则时，默认执行的放行类型" placement="bottom">
+            <el-select style="width: 380px" class="filter-item" v-model="temp.defaultPassType">
+              <el-option v-for="item in  passTypeList" :key="item.key" :label="item.key" :value="item.value">
+              </el-option>
+            </el-select>
+          </el-tooltip>
         </el-form-item>
 
       </el-form>
diff --git a/neutrino-proxy-admin/src/views/system/securityRule.vue b/neutrino-proxy-admin/src/views/system/securityRule.vue
index d103e6e6..e85a7d37 100644
--- a/neutrino-proxy-admin/src/views/system/securityRule.vue
+++ b/neutrino-proxy-admin/src/views/system/securityRule.vue
@@ -96,10 +96,14 @@
         
 
         <el-form-item  :label="$t('table.passType')" prop="passType">
-          <el-select class="filter-item" v-model="temp.passType">
-            <el-option v-for="item in  passTypeList" :key="item.key" :label="item.key" :value="item.value">
-            </el-option>
-          </el-select>
+          <el-tooltip class="item" effect="dark" :content="temp.passTypeTooltip" placement="right">
+            <!-- <el-button>右边</el-button> -->
+            <el-select class="filter-item" v-model="temp.passType" disabled>
+              <el-option v-for="item in  passTypeList" :key="item.key" :label="item.key" :value="item.value">
+              </el-option>
+            </el-select>
+          </el-tooltip>
+         
         </el-form-item>
 
         <el-form-item :label="$t('table.priority')" prop="priority">
@@ -155,6 +159,7 @@ import LinkPopover from '../../components/Link/linkPopover'
           description: '',
           rule: '',
           passType: undefined,
+          passTypeTooltip: '',
           priority: 1
         },
         dialogFormVisible: false,
@@ -169,7 +174,7 @@ import LinkPopover from '../../components/Link/linkPopover'
         rules: {
           name: [{ required: true, message: '安全组名称必填', trigger: 'blur' }],
           rule: [{ required: true, message: '规则内容必填', trigger: 'blur' }],
-          passType: [{ required: true, message: '放行类型必选', trigger: 'blur' }],
+          // passType: [{ required: true, message: '放行类型必选', trigger: 'blur' }],
           priority: [{ required: true, message: '优先级必填', trigger: 'blur' }]
         },
         downloadLoading: false,
@@ -269,9 +274,13 @@ import LinkPopover from '../../components/Link/linkPopover'
       resetTemp() {
         this.temp = {
           id: undefined,
+          groupId: this.groupId,
           name: '',
           description: '',
-          defaultPassType: undefined
+          rule: '',
+          passType: this.group.defaultPassType == 'allow' ? 0 : 1,
+          passTypeTooltip: `安全组已设置默认${(this.group.defaultPassType == 'allow' ? '允许' : '拒绝')}`,
+          priority: 1
         }
       },
       handleCreate() {
@@ -304,6 +313,7 @@ import LinkPopover from '../../components/Link/linkPopover'
       handleUpdate(row) {
         this.temp = Object.assign({}, row) // copy obj
         this.temp.passType = row.passType == 'allow' ? 1 : 0
+        this.temp.passTypeTooltip = `安全组已设置默认${(this.group.defaultPassType == 'allow' ? '允许' : '拒绝')}`,
         this.temp.timestamp = new Date(this.temp.timestamp)
         this.dialogStatus = 'update'
         this.dialogFormVisible = true
diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
index 1df82afa..a7640a11 100644
--- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
+++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
@@ -10,12 +10,16 @@ import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.StringUtils;
 import org.dromara.neutrinoproxy.core.Constants;
 import org.dromara.neutrinoproxy.core.ProxyMessage;
+import org.dromara.neutrinoproxy.core.util.IpUtil;
 import org.dromara.neutrinoproxy.server.constant.NetworkProtocolEnum;
 import org.dromara.neutrinoproxy.server.proxy.domain.ProxyAttachment;
 import org.dromara.neutrinoproxy.server.proxy.domain.VisitorChannelAttachInfo;
 import org.dromara.neutrinoproxy.server.service.FlowReportService;
+import org.dromara.neutrinoproxy.server.service.PortMappingService;
+import org.dromara.neutrinoproxy.server.service.SecurityGroupService;
 import org.dromara.neutrinoproxy.server.util.ProxyUtil;
 import org.noear.solon.Solon;
+import org.noear.solon.annotation.Inject;
 
 import java.net.InetSocketAddress;
 
@@ -25,6 +29,11 @@ import java.net.InetSocketAddress;
  */
 @Slf4j
 public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteBuf> {
+
+    private final SecurityGroupService securityGroupService = Solon.context().getBean(SecurityGroupService.class);
+
+    private final PortMappingService portMappingService = Solon.context().getBean(PortMappingService.class);
+
     /**
      * 域名
      */
@@ -87,6 +96,14 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
             ctx.channel().close();
             return;
         }
+
+        // 判断IP是否在该端口绑定的安全组允许的规则内
+        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(serverPort))) {
+            // 不在安全组规则放行范围内
+            ctx.channel().close();
+            return;
+        }
+
         Channel cmdChannel = ProxyUtil.getCmdChannelByServerPort(serverPort);
         if (null == cmdChannel) {
             ctx.channel().close();