1、安全组不允许修改默认放行类型

2、添加TCP协议和UDP协议的安全组判断在读取数据时判断是否放行

neutrino-proxy-admin/src/views/system/securityGroup.vue

@@ -81,7 +81,7 @@
 
         <el-form-item  :label="$t('table.defaultPassType')" prop="defaultPassType">
           <el-tooltip class="item" effect="dark" content="当IP地址不能匹配任何规则时，默认执行的放行类型" placement="bottom">
-            <el-select style="width: 380px" class="filter-item" v-model="temp.defaultPassType">
+            <el-select style="width: 380px" class="filter-item" v-model="temp.defaultPassType" :disabled="dialogStatus === 'update'">
               <el-option v-for="item in  passTypeList" :key="item.key" :label="item.key" :value="item.value">
               </el-option>
             </el-select>

neutrino-proxy-admin/src/views/system/securityRule.vue

@@ -106,9 +106,9 @@
          
         </el-form-item>
 
-        <el-form-item :label="$t('table.priority')" prop="priority">
+        <!-- <el-form-item :label="$t('table.priority')" prop="priority">
           <el-input-number v-model="temp.priority" :min="1" :max="1000" :placeholder="$t('table.priority')"></el-input-number>
-        </el-form-item>
+        </el-form-item> -->
 
       </el-form>
       <div slot="footer" class="dialog-footer">
@@ -175,7 +175,7 @@ import LinkPopover from '../../components/Link/linkPopover'
           name: [{ required: true, message: '安全组名称必填', trigger: 'blur' }],
           rule: [{ required: true, message: '规则内容必填', trigger: 'blur' }],
           // passType: [{ required: true, message: '放行类型必选', trigger: 'blur' }],
-          priority: [{ required: true, message: '优先级必填', trigger: 'blur' }]
+          // priority: [{ required: true, message: '优先级必填', trigger: 'blur' }]
         },
         downloadLoading: false,
         checkBoxData:[], //表单勾选的行

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java

@@ -18,8 +18,4 @@ public class SecurityGroupUpdateReq {
      */
     private String description;
 
-    /**
-     * 通过类型
-     */
-    private SecurityRulePassTypeEnum defaultPassType;
 }

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java

@@ -52,6 +52,6 @@ public class SecurityRuleCreateReq {
     /**
      * 优先级，数字越小，优先级越高
      */
-    private Integer priority;
+    private Integer priority = 1;
 
 }

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java

@@ -60,7 +60,7 @@ public class SecurityRuleDO {
     /**
      * 优先级，数字越小，优先级越高
      */
-    private Integer priority;
+    private Integer priority = 1;
 
     /**
      * 用户id

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java

@@ -52,6 +52,14 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteBu
             return;
         }
 
+        // 判断IP是否在该端口绑定的安全组允许的规则内
+        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
+        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
+            // 不在安全组规则放行范围内
+            ctx.channel().close();
+            return;
+        }
+
         // 代理通道可写，则设置访问通道可读。代理通道不可写，则设置访问通道不可读
         visitorChannel.config().setAutoRead(proxyChannel.isWritable());
 

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java

@@ -38,6 +38,16 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler<Datagr
     @Override
     protected void channelRead0(ChannelHandlerContext ctx, DatagramPacket datagramPacket) throws Exception {
         log.debug("chid>>>{}", ctx.channel().id().asLongText());
+        Channel visitorChannel = ctx.channel();
+        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
+
+        // 判断IP是否在该端口绑定的安全组允许的规则内
+        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
+            // 不在安全组规则放行范围内
+            ctx.channel().close();
+            return;
+        }
+
         byte[] bytes = new byte[datagramPacket.content().readableBytes()];
         datagramPacket.content().readBytes(bytes);
         datagramPacket.content().resetReaderIndex();
@@ -86,8 +96,6 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler<Datagr
             return;
         }
 
-        Channel visitorChannel = ctx.channel();
-        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
         Channel cmdChannel = ProxyUtil.getCmdChannelByServerPort(sa.getPort());
 
         // 没有指令通道，直接结束

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java

@@ -76,9 +76,13 @@ public class SecurityGroupService {
         init();
     }
 
+    /**
+     * 更新时不允许更新默认放行类型
+     * @param req 安全组更新参数
+     */
     public void updateGroup(SecurityGroupUpdateReq req) {
         SecurityGroupDO groupDO = securityGroupMapper.selectById(req.getId());
-        BeanUtil.copyProperties(req, groupDO);
+        BeanUtil.copyProperties(req, groupDO, "defaultPassType");
         securityGroupMapper.updateById(groupDO);
         init();
     }