1、安全组不允许修改默认放行类型

2、添加TCP协议和UDP协议的安全组判断在读取数据时判断是否放行

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java

@@ -18,8 +18,4 @@ public class SecurityGroupUpdateReq {
      */
     private String description;
 
-    /**
-     * 通过类型
-     */
-    private SecurityRulePassTypeEnum defaultPassType;
 }

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java

@@ -52,6 +52,6 @@ public class SecurityRuleCreateReq {
     /**
      * 优先级，数字越小，优先级越高
      */
-    private Integer priority;
+    private Integer priority = 1;
 
 }

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java

@@ -60,7 +60,7 @@ public class SecurityRuleDO {
     /**
      * 优先级，数字越小，优先级越高
      */
-    private Integer priority;
+    private Integer priority = 1;
 
     /**
      * 用户id

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java

@@ -52,6 +52,14 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteBu
             return;
         }
 
+        // 判断IP是否在该端口绑定的安全组允许的规则内
+        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
+        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
+            // 不在安全组规则放行范围内
+            ctx.channel().close();
+            return;
+        }
+
         // 代理通道可写，则设置访问通道可读。代理通道不可写，则设置访问通道不可读
         visitorChannel.config().setAutoRead(proxyChannel.isWritable());
 

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java

@@ -38,6 +38,16 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler<Datagr
     @Override
     protected void channelRead0(ChannelHandlerContext ctx, DatagramPacket datagramPacket) throws Exception {
         log.debug("chid>>>{}", ctx.channel().id().asLongText());
+        Channel visitorChannel = ctx.channel();
+        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
+
+        // 判断IP是否在该端口绑定的安全组允许的规则内
+        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(sa.getPort()))) {
+            // 不在安全组规则放行范围内
+            ctx.channel().close();
+            return;
+        }
+
         byte[] bytes = new byte[datagramPacket.content().readableBytes()];
         datagramPacket.content().readBytes(bytes);
         datagramPacket.content().resetReaderIndex();
@@ -86,8 +96,6 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler<Datagr
             return;
         }
 
-        Channel visitorChannel = ctx.channel();
-        InetSocketAddress sa = (InetSocketAddress) visitorChannel.localAddress();
         Channel cmdChannel = ProxyUtil.getCmdChannelByServerPort(sa.getPort());
 
         // 没有指令通道，直接结束

neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java

@@ -76,9 +76,13 @@ public class SecurityGroupService {
         init();
     }
 
+    /**
+     * 更新时不允许更新默认放行类型
+     * @param req 安全组更新参数
+     */
     public void updateGroup(SecurityGroupUpdateReq req) {
         SecurityGroupDO groupDO = securityGroupMapper.selectById(req.getId());
-        BeanUtil.copyProperties(req, groupDO);
+        BeanUtil.copyProperties(req, groupDO, "defaultPassType");
         securityGroupMapper.updateById(groupDO);
         init();
     }