From d072c05d314b9eb6738e740677c51d8e9ceb115b Mon Sep 17 00:00:00 2001
From: az <lttzhu@163.com>
Date: Sat, 9 Dec 2023 22:30:31 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E6=94=B9TcpVisitorHandler=E8=8E=B7?=
 =?UTF-8?q?=E5=8F=96=E7=9C=9F=E5=AE=9EIP=E5=9C=B0=E5=9D=80=E7=9A=84?=
 =?UTF-8?q?=E6=96=B9=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../proxy/enhance/HttpVisitorChannelHandler.java     | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
index a7640a11..42e0f747 100644
--- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
+++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/enhance/HttpVisitorChannelHandler.java
@@ -77,7 +77,8 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         // 用户连接到代理服务器时，设置用户连接不可读，等待代理后端服务器连接成功后再改变为可读状态
         ctx.channel().config().setOption(ChannelOption.AUTO_READ, false);
 
-        String host = getHost(bytes);
+        String httpContent = new String(bytes);
+        String host = getHost(httpContent);
         log.debug("HttpProxy host: {}", host);
         if (StringUtils.isBlank(host)) {
             ctx.channel().close();
@@ -98,7 +99,11 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         }
 
         // 判断IP是否在该端口绑定的安全组允许的规则内
-        if (!securityGroupService.judgeAllow(IpUtil.getRemoteIp(ctx), portMappingService.getSecurityGroupIdByMappingPort(serverPort))) {
+        String ip = IpUtil.getRealRemoteIp(httpContent);
+        if (ip == null) {
+            ip = IpUtil.getRemoteIp(ctx);
+        }
+        if (!securityGroupService.judgeAllow(ip, portMappingService.getSecurityGroupIdByMappingPort(serverPort))) {
             // 不在安全组规则放行范围内
             ctx.channel().close();
             return;
@@ -167,8 +172,7 @@ public class HttpVisitorChannelHandler extends SimpleChannelInboundHandler<ByteB
         ctx.close();
     }
 
-    private String getHost(byte[] buf) {
-        String req = new String(buf);
+    private String getHost(String req) {
         String[] lines = req.split("\r\n");
         String firstLine = lines[0];
         if (!(firstLine.endsWith("HTTP/1.1") || firstLine.endsWith("HTTP/1.0"))) {