From 836252f85b8bff0072ff8017d84055b89e1d9d05 Mon Sep 17 00:00:00 2001 From: az Date: Mon, 4 Dec 2023 21:04:14 +0800 Subject: [PATCH 01/11] =?UTF-8?q?=E5=AE=89=E5=85=A8=E7=BB=84=E5=92=8C?= =?UTF-8?q?=E5=AE=89=E5=85=A8=E8=A7=84=E5=88=99=E5=AE=9A=E4=B9=89?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../constant/SecurityRulePassTypeEnum.java | 15 ++++ .../server/dal/SecurityGroupMapper.java | 7 ++ .../server/dal/SecurityRuleMapper.java | 7 ++ .../server/dal/entity/SecurityGroupDO.java | 52 +++++++++++++ .../server/dal/entity/SecurityRule.java | 78 +++++++++++++++++++ 5 files changed, 159 insertions(+) create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityGroupMapper.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java new file mode 100644 index 00000000..32d96759 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java @@ -0,0 +1,15 @@ +package org.dromara.neutrinoproxy.server.constant; + +import lombok.AllArgsConstructor; +import lombok.Getter; + +@AllArgsConstructor +@Getter +public enum SecurityRulePassTypeEnum { + REJECT(0, "reject"), + ALLOW(1, "allow") + ; + + private final Integer code; + private final String desc; +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityGroupMapper.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityGroupMapper.java new file mode 100644 index 00000000..10dbe111 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityGroupMapper.java @@ -0,0 +1,7 @@ +package org.dromara.neutrinoproxy.server.dal; + +import com.baomidou.mybatisplus.core.mapper.BaseMapper; +import org.dromara.neutrinoproxy.server.dal.entity.SecurityGroupDO; + +public interface SecurityGroupMapper extends BaseMapper { +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java new file mode 100644 index 00000000..03f9f1b4 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java @@ -0,0 +1,7 @@ +package org.dromara.neutrinoproxy.server.dal; + +import com.baomidou.mybatisplus.core.mapper.BaseMapper; +import org.dromara.neutrinoproxy.server.dal.entity.SecurityRule; + +public interface SecurityRuleMapper extends BaseMapper { +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java new file mode 100644 index 00000000..9c07ff87 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java @@ -0,0 +1,52 @@ +package org.dromara.neutrinoproxy.server.dal.entity; + +import com.baomidou.mybatisplus.annotation.IdType; +import com.baomidou.mybatisplus.annotation.TableId; +import com.baomidou.mybatisplus.annotation.TableName; +import lombok.Data; +import lombok.ToString; +import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; + +import java.util.Date; + +@Data +@ToString +@Accessors(chain = true) +@TableName("security_group") +public class SecurityGroupDO { + + @TableId(type = IdType.AUTO) + private Integer id; + + /** + * 组名 + */ + private String name; + + /** + * 描述 + */ + private String description; + + /** + * 用户id + */ + private Integer userId; + + /** + * 启用状态 + * {@link EnableStatusEnum} + */ + private Integer enable; + /** + * 创建时间 + */ + private Date createTime; + /** + * 更新时间 + */ + private Date updateTime; + + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java new file mode 100644 index 00000000..5ad62760 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java @@ -0,0 +1,78 @@ +package org.dromara.neutrinoproxy.server.dal.entity; + +import com.baomidou.mybatisplus.annotation.IdType; +import com.baomidou.mybatisplus.annotation.TableId; +import com.baomidou.mybatisplus.annotation.TableName; +import lombok.Data; +import lombok.ToString; +import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; + +import java.util.Date; + +@Data +@ToString +@Accessors(chain = true) +@TableName("security_rule") +public class SecurityRule { + + @TableId(type = IdType.AUTO) + private Integer id; + + /** + * 所属安全组 + */ + private Integer groupId; + + /** + * 规则名 + */ + private String name; + + /** + * 规则描述 + */ + private String description; + + /** + * 规则 + * 范围类型：192.168.1.0-192.168.1.255 + * 掩码类型：192.168.1.0/24 + * 泛型：0.0.0.0 + * 单个ip：192.168.1.1 + * 每个类型中间以英文逗号分隔 + */ + private String rule; + + /** + * 放行类型，reject 或 allow + * {@link SecurityRulePassTypeEnum} + */ + private Integer passType; + + /** + * 优先级，数字越小，优先级越高 + */ + private Integer priority; + + /** + * 用户id + */ + private Integer userId; + + /** + * 启用状态 + * {@link EnableStatusEnum} + */ + private Integer enable; + /** + * 创建时间 + */ + private Date createTime; + /** + * 更新时间 + */ + private Date updateTime; + +} From a9fc8f4cb4f5806d4069c37aa47730233fca5773 Mon Sep 17 00:00:00 2001 From: = <=> Date: Tue, 5 Dec 2023 09:14:57 +0800 Subject: [PATCH 02/11] =?UTF-8?q?=E5=AE=89=E5=85=A8=E8=A7=84=E5=88=99?= =?UTF-8?q?=E5=88=A4=E6=96=AD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../server/dal/entity/SecurityRule.java | 71 +++++++++++++++++-- 1 file changed, 67 insertions(+), 4 deletions(-) diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java index 5ad62760..f72b895e 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java @@ -1,5 +1,7 @@ package org.dromara.neutrinoproxy.server.dal.entity; +import cn.hutool.core.net.Ipv4Util; +import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.annotation.IdType; import com.baomidou.mybatisplus.annotation.TableId; import com.baomidou.mybatisplus.annotation.TableName; @@ -8,6 +10,7 @@ import lombok.ToString; import lombok.experimental.Accessors; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; +import org.noear.solon.core.util.IpUtil; import java.util.Date; @@ -36,11 +39,11 @@ public class SecurityRule { private String description; /** - * 规则 + * 规则,ipv6只支持单个ip判断 + * 单个ip：192.168.1.1,0:0:0:0:0:0:10.0.0.1 * 范围类型：192.168.1.0-192.168.1.255 * 掩码类型：192.168.1.0/24 - * 泛型：0.0.0.0 - * 单个ip：192.168.1.1 + * 泛型：0.0.0.0/ALL * 每个类型中间以英文逗号分隔 */ private String rule; @@ -49,7 +52,7 @@ public class SecurityRule { * 放行类型，reject 或 allow * {@link SecurityRulePassTypeEnum} */ - private Integer passType; + private SecurityRulePassTypeEnum passType; /** * 优先级，数字越小，优先级越高 @@ -75,4 +78,64 @@ public class SecurityRule { */ private Date updateTime; + /** + * 判断当前规则是否允许指定ip同行 + * @param ip + * @return + */ + public boolean allow(String ip) { + + // 被判断的IP地址为空，不允许访问 + if (StrUtil.isEmpty(ip)) { + return false; + } + + // 没有规则，默认允许访问 + if (StrUtil.isEmpty(rule)) { + return true; + } + + // ipv6只适配单ip形式 + boolean isIpv6 = ip.contains(":"); + long ipLong = -1L; + if (!isIpv6) { + ipLong = Ipv4Util.ipv4ToLong(ip); + } + + String[] rules = this.rule.split(","); + for (String rule : rules) { + + // 单个ip,ipv6在此步已处理，后面不需要额外判断ipv6的情况 + if (rule.matches("(\\d+\\.){3}\\d+") || isIpv6) { + return passType == SecurityRulePassTypeEnum.ALLOW && rule.equals(ip); + } + + // 范围类型 + if (rule.matches("(\\d+\\.){3}\\d+-(\\d+\\.){3}\\d+")) { + String[] ipRange = rule.split("-"); + if (ipRange[0].compareTo(ip) <= 0 && ip.compareTo(ipRange[1]) <= 0) { + return passType == SecurityRulePassTypeEnum.ALLOW; + } + } + + // 掩码类型 + if (rule.matches("(\\d+\\.){3}\\d+/\\d+")) { + String[] netIp = rule.split("/"); + Long beginIp = Ipv4Util.getBeginIpLong(netIp[0], Integer.valueOf(netIp[1])); + Long endIp = Ipv4Util.getEndIpLong(netIp[0], Integer.valueOf(netIp[1])); + if (beginIp <= ipLong && ipLong <= endIp) { + return passType == SecurityRulePassTypeEnum.ALLOW; + } + } + + if (rule.equalsIgnoreCase("ALL") || rule.equals("0.0.0.0") || rule.equals("0..0.0.0/0")) { + return passType == SecurityRulePassTypeEnum.ALLOW; + } + + } + + // 都没有匹配到，默认放行 + return true; + } + } From 306f2ed4d393ed7d78be47b6c3aef462d23baa8a Mon Sep 17 00:00:00 2001 From: = <=> Date: Tue, 5 Dec 2023 16:16:06 +0800 Subject: [PATCH 03/11] =?UTF-8?q?=E8=A7=84=E5=88=99=E5=88=A4=E6=96=AD?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- neutrino-proxy-core/pom.xml | 5 ++ .../constant/SecurityRulePassTypeEnum.java | 5 +- .../server/dal/SecurityRuleMapper.java | 4 +- .../server/dal/entity/SecurityGroupDO.java | 2 +- ...{SecurityRule.java => SecurityRuleDO.java} | 27 +++---- .../proxy/core/TcpVisitorChannelHandler.java | 15 ++-- .../server/service/SecurityGroupService.java | 76 +++++++++++++++++++ .../src/main/resources/app.yml | 10 ++- .../resources/sql/mysql/init-structure.sql | 30 ++++++++ 9 files changed, 146 insertions(+), 28 deletions(-) rename neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/{SecurityRule.java => SecurityRuleDO.java} (81%) create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java diff --git a/neutrino-proxy-core/pom.xml b/neutrino-proxy-core/pom.xml index fc566dbf..f29d6890 100644 --- a/neutrino-proxy-core/pom.xml +++ b/neutrino-proxy-core/pom.xml @@ -30,6 +30,11 @@ hutool-core ${hutool.version} + + cn.hutool + hutool-cache + ${hutool.version} + diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java index 32d96759..60991e30 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java @@ -6,8 +6,9 @@ import lombok.Getter; @AllArgsConstructor @Getter public enum SecurityRulePassTypeEnum { - REJECT(0, "reject"), - ALLOW(1, "allow") + DENY(-1, "DENY"), + ALLOW(1, "allow"), + NONE(0, "none") ; private final Integer code; diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java index 03f9f1b4..9ded6d66 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/SecurityRuleMapper.java @@ -1,7 +1,7 @@ package org.dromara.neutrinoproxy.server.dal; import com.baomidou.mybatisplus.core.mapper.BaseMapper; -import org.dromara.neutrinoproxy.server.dal.entity.SecurityRule; +import org.dromara.neutrinoproxy.server.dal.entity.SecurityRuleDO; -public interface SecurityRuleMapper extends BaseMapper { +public interface SecurityRuleMapper extends BaseMapper { } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java index 9c07ff87..b1129c7b 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java @@ -38,7 +38,7 @@ public class SecurityGroupDO { * 启用状态 * {@link EnableStatusEnum} */ - private Integer enable; + private EnableStatusEnum enable; /** * 创建时间 */ diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java similarity index 81% rename from neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java rename to neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java index f72b895e..128940d4 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRule.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java @@ -10,7 +10,6 @@ import lombok.ToString; import lombok.experimental.Accessors; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; -import org.noear.solon.core.util.IpUtil; import java.util.Date; @@ -18,7 +17,7 @@ import java.util.Date; @ToString @Accessors(chain = true) @TableName("security_rule") -public class SecurityRule { +public class SecurityRuleDO { @TableId(type = IdType.AUTO) private Integer id; @@ -68,7 +67,7 @@ public class SecurityRule { * 启用状态 * {@link EnableStatusEnum} */ - private Integer enable; + private EnableStatusEnum enable; /** * 创建时间 */ @@ -83,16 +82,16 @@ public class SecurityRule { * @param ip * @return */ - public boolean allow(String ip) { + public SecurityRulePassTypeEnum allow(String ip) { - // 被判断的IP地址为空，不允许访问 + // 被判断的IP地址为空，不做判断 if (StrUtil.isEmpty(ip)) { - return false; + return SecurityRulePassTypeEnum.NONE; } // 没有规则，默认允许访问 if (StrUtil.isEmpty(rule)) { - return true; + return SecurityRulePassTypeEnum.ALLOW; } // ipv6只适配单ip形式 @@ -107,14 +106,16 @@ public class SecurityRule { // 单个ip,ipv6在此步已处理，后面不需要额外判断ipv6的情况 if (rule.matches("(\\d+\\.){3}\\d+") || isIpv6) { - return passType == SecurityRulePassTypeEnum.ALLOW && rule.equals(ip); + if (rule.equals(ip)) { + return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; + } } // 范围类型 if (rule.matches("(\\d+\\.){3}\\d+-(\\d+\\.){3}\\d+")) { String[] ipRange = rule.split("-"); if (ipRange[0].compareTo(ip) <= 0 && ip.compareTo(ipRange[1]) <= 0) { - return passType == SecurityRulePassTypeEnum.ALLOW; + return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; } } @@ -124,18 +125,18 @@ public class SecurityRule { Long beginIp = Ipv4Util.getBeginIpLong(netIp[0], Integer.valueOf(netIp[1])); Long endIp = Ipv4Util.getEndIpLong(netIp[0], Integer.valueOf(netIp[1])); if (beginIp <= ipLong && ipLong <= endIp) { - return passType == SecurityRulePassTypeEnum.ALLOW; + return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; } } if (rule.equalsIgnoreCase("ALL") || rule.equals("0.0.0.0") || rule.equals("0..0.0.0/0")) { - return passType == SecurityRulePassTypeEnum.ALLOW; + return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; } } - // 都没有匹配到，默认放行 - return true; + // 都没有匹配到 + return SecurityRulePassTypeEnum.NONE; } } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java index 8f723802..3110dec7 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java @@ -1,6 +1,11 @@ package org.dromara.neutrinoproxy.server.proxy.core; import cn.hutool.core.util.StrUtil; +import io.netty.buffer.ByteBuf; +import io.netty.channel.Channel; +import io.netty.channel.ChannelHandlerContext; +import io.netty.channel.ChannelOption; +import io.netty.channel.SimpleChannelInboundHandler; import lombok.extern.slf4j.Slf4j; import org.dromara.neutrinoproxy.core.Constants; import org.dromara.neutrinoproxy.core.ProxyMessage; @@ -8,11 +13,6 @@ import org.dromara.neutrinoproxy.server.constant.NetworkProtocolEnum; import org.dromara.neutrinoproxy.server.proxy.domain.VisitorChannelAttachInfo; import org.dromara.neutrinoproxy.server.service.FlowReportService; import org.dromara.neutrinoproxy.server.util.ProxyUtil; -import io.netty.buffer.ByteBuf; -import io.netty.channel.Channel; -import io.netty.channel.ChannelHandlerContext; -import io.netty.channel.ChannelOption; -import io.netty.channel.SimpleChannelInboundHandler; import org.noear.solon.Solon; import java.net.InetSocketAddress; @@ -62,8 +62,11 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler securityGroupMap = new ConcurrentHashMap<>(); + + // 允许通过控制的缓存，缓存类型最近最久未使用缓存，容量100，超时时间5分钟 + private Cache ipAllowControlCache = CacheUtil.newLRUCache(100, 1000 * 60 * 5); + + public void init() { + List groupDOList = securityGroupMapper.selectList(Wrappers.lambdaQuery(SecurityGroupDO.class)); + groupDOList.forEach(securityGroupDO -> securityGroupMap.put(securityGroupDO.getId(), securityGroupDO)); + } + + public boolean judgeAllow(String ip, Integer groupId) { + + SecurityGroupDO groupDO = securityGroupMap.get(groupId); + if (groupDO == null || groupDO.getEnable() == EnableStatusEnum.DISABLE) { + return true; + } + + String judgeAllowMapKey = ip + groupId; + if (ipAllowControlCache.containsKey(judgeAllowMapKey)) { + return ipAllowControlCache.get(judgeAllowMapKey); + } + + List ruleDOList = securityRuleMapper.selectList(Wrappers.lambdaQuery(SecurityRuleDO.class) + .eq(SecurityRuleDO::getGroupId, groupId) + .orderByAsc(SecurityRuleDO::getPriority) + ); + Boolean allow = null; + for (SecurityRuleDO ruleDO : ruleDOList) { + SecurityRulePassTypeEnum passType = ruleDO.allow(ip); + if (passType == SecurityRulePassTypeEnum.ALLOW) { + allow = true; + break; + } + if (passType == SecurityRulePassTypeEnum.DENY) { + allow = false; + break; + } + } + + if (allow == null) { + allow = true; + } + + // 当前IP没有匹配到任何一条规则，则放行 + ipAllowControlCache.put(judgeAllowMapKey, allow); + + return allow; + } +} diff --git a/neutrino-proxy-server/src/main/resources/app.yml b/neutrino-proxy-server/src/main/resources/app.yml index 665cfc83..cb798520 100644 --- a/neutrino-proxy-server/src/main/resources/app.yml +++ b/neutrino-proxy-server/src/main/resources/app.yml @@ -74,13 +74,15 @@ neutrino: data: db: # 数据库类型，目前支持h2、mysql、mariadb - type: ${DB_TYPE:h2} + # type: ${DB_TYPE:h2} + type: ${DB_TYPE:mysql} # 数据库连接URL - url: ${DB_URL:jdbc:h2:file:./data/db;MODE=MySQL;AUTO_SERVER=TRUE} + # url: ${DB_URL:jdbc:h2:file:./data/db;MODE=MySQL;AUTO_SERVER=TRUE} + url: ${DB_URL:jdbc:mysql://okfly.vip:37889/neutrino-proxy?useUnicode=true&characterEncoding=utf-8&allowMultiQueries=true&useSSL=false&serverTimezone=UTC&allowPublicKeyRetrieval=true} # 数据库用户名 - username: ${DB_USER:} + username: ${DB_USER:root} # 数据库密码 - password: ${DB_PASSWORD:} + password: ${DB_PASSWORD:Root1234@} #添加MIME印射（如果有需要？） #是否启用静态文件服务。（可不配，默认为启用） diff --git a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql index c6c0037b..f763edd0 100644 --- a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql +++ b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql @@ -50,6 +50,35 @@ CREATE TABLE IF NOT EXISTS `port_group` ( PRIMARY KEY (`id`) ) ENGINE=InnoDB AUTO_INCREMENT=4 DEFAULT CHARSET=utf8mb4; +#安全组 +CREATE TABLE IF NOT EXISTS `security_group` ( + `id` int NOT NULL AUTO_INCREMENT COMMENT '主键ID', + `name` varchar(20) NOT NULL COMMENT '安全组名称', + `description` varchar(255) COMMENT '安全组描述', + `user_id` int NOT NULL COMMENT '用户ID', + `enable` int(1) NOT NULL COMMENT '启用状态', + `create_time` datetime(3) NOT NULL COMMENT '创建时间', + `update_time` datetime(3) NOT NULL COMMENT '更新时间', + PRIMARY KEY (`id`) +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; + +#安全组规则 +CREATE TABLE IF NOT EXISTS `security_rule` ( + `id` int NOT NULL AUTO_INCREMENT COMMENT '主键ID', + `group_id` int NOT NULL COMMENT '关联安全组', + `name` varchar(20) NOT NULL COMMENT '规则名称', + `description` varchar(255) NOT NULL COMMENT '规则描述', + `rule` text NOT NULL COMMENT '规则内容', + `pass_type` int(1) NOT NULL COMMENT '放行类型', + `priority` int(1) NOT NULL COMMENT '优先级', + `user_id` int NOT NULL COMMENT '用户ID', + `enable` int(1) NOT NULL COMMENT '启用状态', + `create_time` datetime(3) NOT NULL COMMENT '创建时间', + `update_time` datetime(3) NOT NULL COMMENT '更新时间', + PRIMARY KEY (`id`), + KEY `I_group_id_priority` (`group_id`, `priority`) USING BTREE +) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; + #############################代理配置相关表############################# #license表 CREATE TABLE IF NOT EXISTS `license` ( @@ -207,3 +236,4 @@ CREATE TABLE IF NOT EXISTS `flow_report_month` ( KEY `I_flow_report_month_user_id` (`user_id`), KEY `I_flow_report_month_license_id` (`license_id`) ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; + From 00308c0f5c57815bc7c722000a716c2ee3c1eb21 Mon Sep 17 00:00:00 2001 From: = <=> Date: Tue, 5 Dec 2023 17:00:30 +0800 Subject: [PATCH 04/11] =?UTF-8?q?=E7=AB=AF=E5=8F=A3=E6=98=A0=E5=B0=84?= =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8=E7=BB=84id=E5=AD=97?= =?UTF-8?q?=E6=AE=B5?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../neutrinoproxy/server/dal/entity/PortMappingDO.java | 6 ++++++ .../src/main/resources/sql/mysql/init-structure.sql | 1 + 2 files changed, 7 insertions(+) diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java index 5e010d59..bcd88ea0 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java @@ -92,6 +92,12 @@ public class PortMappingDO { * {@link EnableStatusEnum} */ private Integer enable; + + /** + * 安全组Id + */ + private Integer securityGroupId; + /** * 创建时间 */ diff --git a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql index f763edd0..e6ea837f 100644 --- a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql +++ b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql @@ -108,6 +108,7 @@ CREATE TABLE IF NOT EXISTS `port_mapping` ( `proxy_responses` int NOT NULL DEFAULT 0 COMMENT '代理响应数据包数量', `proxy_timeout_ms` int NOT NULL DEFAULT 0 COMMENT '代理超时毫秒数', `enable` int NOT NULL COMMENT '是否启用(1、启用 2、禁用)', + `security_group_id` int DEFAULT NULL COMMENT '安全组Id', `create_time` datetime(3) NOT NULL COMMENT '创建时间', `update_time` datetime(3) NOT NULL COMMENT '更新时间', PRIMARY KEY (`id`), From 169551445caf30b2ab1ecb772dc65b7c37d0ce31 Mon Sep 17 00:00:00 2001 From: az Date: Tue, 5 Dec 2023 21:33:21 +0800 Subject: [PATCH 05/11] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8?= =?UTF-8?q?=E7=BB=84=E6=8E=A5=E5=8F=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- neutrino-proxy-admin/config/dev.env.js | 2 +- neutrino-proxy-admin/config/prod.env.js | 2 +- neutrino-proxy-admin/package.json | 2 +- .../server/controller/SecurityController.java | 108 ++++++++++++++++++ .../req/system/SecurityGroupCreateReq.java | 16 +++ .../req/system/SecurityGroupUpdateReq.java | 19 +++ .../req/system/SecurityRuleCreateReq.java | 57 +++++++++ .../req/system/SecurityRuleUpdateReq.java | 51 +++++++++ .../res/system/SecurityGroupListReq.java | 19 +++ .../res/system/SecurityRuleListRes.java | 51 +++++++++ 10 files changed, 324 insertions(+), 3 deletions(-) create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleUpdateReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java diff --git a/neutrino-proxy-admin/config/dev.env.js b/neutrino-proxy-admin/config/dev.env.js index 03fd65b0..6bb64a3f 100644 --- a/neutrino-proxy-admin/config/dev.env.js +++ b/neutrino-proxy-admin/config/dev.env.js @@ -1,7 +1,7 @@ module.exports = { NODE_ENV: '"development"', ENV_CONFIG: '"dev"', - BASE_API: '"https://neutrino-proxy.asgc.fun/neutrino-proxy-server"', + BASE_API: '"http://localhost:8888/neutrino-proxy-server"', USER_NAME: '"visitor"', USER_PWD: '"123456"' } diff --git a/neutrino-proxy-admin/config/prod.env.js b/neutrino-proxy-admin/config/prod.env.js index 0c43ea73..c388e184 100644 --- a/neutrino-proxy-admin/config/prod.env.js +++ b/neutrino-proxy-admin/config/prod.env.js @@ -1,5 +1,5 @@ module.exports = { NODE_ENV: '"production"', ENV_CONFIG: '"prod"', - BASE_API: '"https://api-prod"' + BASE_API: '""' } diff --git a/neutrino-proxy-admin/package.json b/neutrino-proxy-admin/package.json index 943c7d6b..9073308a 100644 --- a/neutrino-proxy-admin/package.json +++ b/neutrino-proxy-admin/package.json @@ -70,7 +70,7 @@ "friendly-errors-webpack-plugin": "1.6.1", "html-webpack-plugin": "2.30.1", "node-notifier": "5.1.2", - "node-sass": "^4.7.2", + "node-sass": "^9.0.0", "optimize-css-assets-webpack-plugin": "3.2.0", "ora": "1.3.0", "portfinder": "1.0.13", diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java new file mode 100644 index 00000000..d3514afe --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java @@ -0,0 +1,108 @@ +package org.dromara.neutrinoproxy.server.controller; + +import org.dromara.neutrinoproxy.server.base.page.PageInfo; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupCreateReq; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupUpdateReq; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityGroupListReq; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityRuleListRes; +import org.noear.solon.annotation.Controller; +import org.noear.solon.annotation.Get; +import org.noear.solon.annotation.Mapping; +import org.noear.solon.annotation.Post; + +import java.util.List; + +@Controller +@Mapping("/security") +public class SecurityController { + + + /** + * 获取当前用户权限下的安全组 + */ + @Get + @Mapping("/group/s") + public List getGroups() { + + return null; + } + + @Post + @Mapping("/group/create") + public void createGroup(SecurityGroupCreateReq req) { + + } + + @Post + @Mapping("/group/update") + public void updateGroup(SecurityGroupUpdateReq req) { + + } + + /** + * 将级联删除对应规则 + * @param groupId + */ + @Post + @Mapping("/group/delete") + public void updateGroup(Integer groupId) { + + } + + @Post + @Mapping("/group/enable") + public void enableGroup(Integer groupId) { + + } + + @Post + @Mapping("/group/disable") + public void disableGroup(Integer groupId) { + + } + + @Post + @Mapping("/port/bind/group") + public void portBindGroup(Integer portId, Integer groupId) { + + } + + @Get + @Mapping("/rule/s") + public List getRulesByGroupId(Integer groupId) { + + return null; + } + + @Post + @Mapping("/rule/create") + public void createRule() { + + } + + @Post + @Mapping("/rule/update") + public void updateRule() { + + } + + @Post + @Mapping("/rule/delete") + public void deleteRule(Integer ruleId) { + + } + + + @Post + @Mapping("/rule/enable") + public void enableRule(Integer ruleId) { + + } + + @Post + @Mapping("/rule/disable") + public void disableRule(Integer ruleId) { + + } + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java new file mode 100644 index 00000000..9a13ea57 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java @@ -0,0 +1,16 @@ +package org.dromara.neutrinoproxy.server.controller.req.system; + +import lombok.Data; + +@Data +public class SecurityGroupCreateReq { + /** + * 组名 + */ + private String name; + + /** + * 描述 + */ + private String description; +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java new file mode 100644 index 00000000..af3fc7e2 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java @@ -0,0 +1,19 @@ +package org.dromara.neutrinoproxy.server.controller.req.system; + +import lombok.Data; + +@Data +public class SecurityGroupUpdateReq { + + private Integer id; + + /** + * 组名 + */ + private String name; + + /** + * 描述 + */ + private String description; +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java new file mode 100644 index 00000000..95285858 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleCreateReq.java @@ -0,0 +1,57 @@ +package org.dromara.neutrinoproxy.server.controller.req.system; + +import cn.hutool.core.net.Ipv4Util; +import cn.hutool.core.util.StrUtil; +import com.baomidou.mybatisplus.annotation.IdType; +import com.baomidou.mybatisplus.annotation.TableId; +import com.baomidou.mybatisplus.annotation.TableName; +import lombok.Data; +import lombok.ToString; +import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; + +import java.util.Date; + +@Data +@ToString +@Accessors(chain = true) +public class SecurityRuleCreateReq { + + /** + * 所属安全组 + */ + private Integer groupId; + + /** + * 规则名 + */ + private String name; + + /** + * 规则描述 + */ + private String description; + + /** + * 规则,ipv6只支持单个ip判断 + * 单个ip：192.168.1.1,0:0:0:0:0:0:10.0.0.1 + * 范围类型：192.168.1.0-192.168.1.255 + * 掩码类型：192.168.1.0/24 + * 泛型：0.0.0.0/ALL + * 每个类型中间以英文逗号分隔 + */ + private String rule; + + /** + * 放行类型，reject 或 allow + * {@link SecurityRulePassTypeEnum} + */ + private SecurityRulePassTypeEnum passType; + + /** + * 优先级，数字越小，优先级越高 + */ + private Integer priority; + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleUpdateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleUpdateReq.java new file mode 100644 index 00000000..47c7e2fb --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityRuleUpdateReq.java @@ -0,0 +1,51 @@ +package org.dromara.neutrinoproxy.server.controller.req.system; + +import lombok.Data; +import lombok.ToString; +import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; + +@Data +@ToString +@Accessors(chain = true) +public class SecurityRuleUpdateReq { + + private Integer id; + + /** + * 所属安全组 + */ + private Integer groupId; + + /** + * 规则名 + */ + private String name; + + /** + * 规则描述 + */ + private String description; + + /** + * 规则,ipv6只支持单个ip判断 + * 单个ip：192.168.1.1,0:0:0:0:0:0:10.0.0.1 + * 范围类型：192.168.1.0-192.168.1.255 + * 掩码类型：192.168.1.0/24 + * 泛型：0.0.0.0/ALL + * 每个类型中间以英文逗号分隔 + */ + private String rule; + + /** + * 放行类型，reject 或 allow + * {@link SecurityRulePassTypeEnum} + */ + private SecurityRulePassTypeEnum passType; + + /** + * 优先级，数字越小，优先级越高 + */ + private Integer priority; + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java new file mode 100644 index 00000000..8d39485b --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java @@ -0,0 +1,19 @@ +package org.dromara.neutrinoproxy.server.controller.res.system; + +import lombok.Data; + +@Data +public class SecurityGroupListReq { + + private Integer id; + + /** + * 组名 + */ + private String name; + + /** + * 描述 + */ + private String description; +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java new file mode 100644 index 00000000..a71fbae0 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java @@ -0,0 +1,51 @@ +package org.dromara.neutrinoproxy.server.controller.res.system; + +import lombok.Data; +import lombok.ToString; +import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; + +@Data +@ToString +@Accessors(chain = true) +public class SecurityRuleListRes { + + private Integer id; + + /** + * 所属安全组 + */ + private Integer groupId; + + /** + * 规则名 + */ + private String name; + + /** + * 规则描述 + */ + private String description; + + /** + * 规则,ipv6只支持单个ip判断 + * 单个ip：192.168.1.1,0:0:0:0:0:0:10.0.0.1 + * 范围类型：192.168.1.0-192.168.1.255 + * 掩码类型：192.168.1.0/24 + * 泛型：0.0.0.0/ALL + * 每个类型中间以英文逗号分隔 + */ + private String rule; + + /** + * 放行类型，reject 或 allow + * {@link SecurityRulePassTypeEnum} + */ + private SecurityRulePassTypeEnum passType; + + /** + * 优先级，数字越小，优先级越高 + */ + private Integer priority; + +} From aab26f5b9da0e1bc28a1a2c28793a386757ea27f Mon Sep 17 00:00:00 2001 From: = <=> Date: Wed, 6 Dec 2023 09:58:07 +0800 Subject: [PATCH 06/11] =?UTF-8?q?=E5=AE=89=E5=85=A8=E7=BB=84=E7=9B=B8?= =?UTF-8?q?=E5=85=B3=E6=8E=A5=E5=8F=A3?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../neutrinoproxy/core/util/IpUtil.java | 18 +++ .../controller/PortMappingController.java | 25 ++++ .../server/controller/SecurityController.java | 65 +++++---- .../res/system/SecurityGroupListReq.java | 19 --- .../res/system/SecurityGroupRes.java | 47 +++++++ ...yRuleListRes.java => SecurityRuleRes.java} | 4 +- .../server/dal/entity/SecurityGroupDO.java | 18 +++ .../server/dal/entity/SecurityRuleDO.java | 9 ++ .../proxy/core/TcpVisitorChannelHandler.java | 16 ++- .../server/service/PortMappingService.java | 34 +++++ .../server/service/SecurityGroupService.java | 126 +++++++++++++++++- .../resources/sql/mysql/init-structure.sql | 1 + 12 files changed, 325 insertions(+), 57 deletions(-) create mode 100644 neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java delete mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java rename neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/{SecurityRuleListRes.java => SecurityRuleRes.java} (92%) diff --git a/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java b/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java new file mode 100644 index 00000000..74ec5859 --- /dev/null +++ b/neutrino-proxy-core/src/main/java/org/dromara/neutrinoproxy/core/util/IpUtil.java @@ -0,0 +1,18 @@ +package org.dromara.neutrinoproxy.core.util; + +import io.netty.channel.ChannelHandlerContext; + +import java.net.InetSocketAddress; + +public class IpUtil extends org.noear.solon.core.util.IpUtil { + + public static String getRemoteIp(ChannelHandlerContext ctx) { + String remoteAddress = ""; + InetSocketAddress socketAddress = (InetSocketAddress) ctx.channel().remoteAddress(); + if (socketAddress != null) { + remoteAddress = socketAddress.getAddress().getHostAddress(); + } + return remoteAddress; + } + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/PortMappingController.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/PortMappingController.java index e9f536e0..5cde88c9 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/PortMappingController.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/PortMappingController.java @@ -13,6 +13,8 @@ import org.dromara.neutrinoproxy.server.util.ParamCheckUtil; import org.apache.commons.lang3.StringUtils; import org.noear.solon.annotation.*; +import java.util.List; + /** * 端口映射 * @author: aoshiguchen @@ -119,4 +121,27 @@ public class PortMappingController { portMappingService.delete(req.getId()); } + + /** + * 绑定安全组 + * @param portMappingId 端口映射Id + * @param securityGroupId 安全组Id + */ + @Post + @Mapping("/bind/security-group") + public void bindSecurityGroup(Integer portMappingId, Integer securityGroupId) { + portMappingService.portBindSecurityGroup(portMappingId, securityGroupId); + } + + /** + * 安全组解绑 + * @param portMappingId 端口映射Id + */ + @Post + @Mapping("/unbind/security-group") + public void unbindSecurityGroup(Integer portMappingId) { + portMappingService.portUnbindSecurityGroup(portMappingId); + } + + } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java index d3514afe..443965aa 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java @@ -1,108 +1,117 @@ package org.dromara.neutrinoproxy.server.controller; -import org.dromara.neutrinoproxy.server.base.page.PageInfo; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupCreateReq; import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupUpdateReq; -import org.dromara.neutrinoproxy.server.controller.res.system.SecurityGroupListReq; -import org.dromara.neutrinoproxy.server.controller.res.system.SecurityRuleListRes; -import org.noear.solon.annotation.Controller; -import org.noear.solon.annotation.Get; -import org.noear.solon.annotation.Mapping; -import org.noear.solon.annotation.Post; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityRuleCreateReq; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityRuleUpdateReq; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityGroupRes; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityRuleRes; +import org.dromara.neutrinoproxy.server.dal.entity.SecurityGroupDO; +import org.dromara.neutrinoproxy.server.dal.entity.SecurityRuleDO; +import org.dromara.neutrinoproxy.server.service.PortMappingService; +import org.dromara.neutrinoproxy.server.service.SecurityGroupService; +import org.noear.solon.annotation.*; import java.util.List; +import java.util.stream.Collectors; @Controller @Mapping("/security") public class SecurityController { + @Inject + private SecurityGroupService groupService; + + @Inject + private PortMappingService portMappingService; /** * 获取当前用户权限下的安全组 */ @Get @Mapping("/group/s") - public List getGroups() { - - return null; + public List getGroups() { + List groupDOList = groupService.queryGroupList(); + return groupDOList.stream().map(SecurityGroupDO::toRes).collect(Collectors.toList()); } @Post @Mapping("/group/create") public void createGroup(SecurityGroupCreateReq req) { - + groupService.createGroup(req); } @Post @Mapping("/group/update") public void updateGroup(SecurityGroupUpdateReq req) { - + groupService.updateGroup(req); } /** - * 将级联删除对应规则 + * 将级联删除对应规则,并更新缓存 * @param groupId */ @Post @Mapping("/group/delete") - public void updateGroup(Integer groupId) { - + public void deleteGroup(Integer groupId) { + groupService.deleteGroup(groupId); } @Post @Mapping("/group/enable") public void enableGroup(Integer groupId) { - + groupService.setGroupStatus(groupId, EnableStatusEnum.ENABLE); } @Post @Mapping("/group/disable") public void disableGroup(Integer groupId) { - + groupService.setGroupStatus(groupId, EnableStatusEnum.DISABLE); } @Post @Mapping("/port/bind/group") public void portBindGroup(Integer portId, Integer groupId) { - + portMappingService.portBindGroup(portId, groupId); } @Get @Mapping("/rule/s") - public List getRulesByGroupId(Integer groupId) { - - return null; + public List getRulesByGroupId(Integer groupId) { + List ruleDOList = groupService.queryRuleListByGroupId(groupId); + return ruleDOList.stream().map(SecurityRuleDO::toRes).collect(Collectors.toList()); } @Post @Mapping("/rule/create") - public void createRule() { - + public void createRule(SecurityRuleCreateReq req) { + groupService.createRule(req); } @Post @Mapping("/rule/update") - public void updateRule() { - + public void updateRule(SecurityRuleUpdateReq req) { + groupService.updateRule(req); } @Post @Mapping("/rule/delete") public void deleteRule(Integer ruleId) { - + groupService.deleteRule(ruleId); } @Post @Mapping("/rule/enable") public void enableRule(Integer ruleId) { - + groupService.setRuleStatus(ruleId, EnableStatusEnum.ENABLE); } @Post @Mapping("/rule/disable") public void disableRule(Integer ruleId) { - + groupService.setRuleStatus(ruleId, EnableStatusEnum.DISABLE); } } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java deleted file mode 100644 index 8d39485b..00000000 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupListReq.java +++ /dev/null @@ -1,19 +0,0 @@ -package org.dromara.neutrinoproxy.server.controller.res.system; - -import lombok.Data; - -@Data -public class SecurityGroupListReq { - - private Integer id; - - /** - * 组名 - */ - private String name; - - /** - * 描述 - */ - private String description; -} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java new file mode 100644 index 00000000..656154b8 --- /dev/null +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java @@ -0,0 +1,47 @@ +package org.dromara.neutrinoproxy.server.controller.res.system; + +import lombok.Data; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; + +import java.util.Date; + +@Data +public class SecurityGroupRes { + + private Integer id; + + /** + * 组名 + */ + private String name; + + /** + * 描述 + */ + private String description; + + /** + * 启用状态 + * {@link EnableStatusEnum} + */ + private String enable; + + /** + * 默认放行类型 + * {@link SecurityRulePassTypeEnum} + */ + private String defaultPassType; + + /** + * 创建时间 + */ + private Date createTime; + /** + * 更新时间 + */ + private Date updateTime; + + + +} diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java similarity index 92% rename from neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java rename to neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java index a71fbae0..31b94869 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleListRes.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java @@ -8,7 +8,7 @@ import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; @Data @ToString @Accessors(chain = true) -public class SecurityRuleListRes { +public class SecurityRuleRes { private Integer id; @@ -41,7 +41,7 @@ public class SecurityRuleListRes { * 放行类型，reject 或 allow * {@link SecurityRulePassTypeEnum} */ - private SecurityRulePassTypeEnum passType; + private String passType; /** * 优先级，数字越小，优先级越高 diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java index b1129c7b..b98a1072 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java @@ -1,5 +1,6 @@ package org.dromara.neutrinoproxy.server.dal.entity; +import cn.hutool.core.bean.BeanUtil; import com.baomidou.mybatisplus.annotation.IdType; import com.baomidou.mybatisplus.annotation.TableId; import com.baomidou.mybatisplus.annotation.TableName; @@ -7,6 +8,8 @@ import lombok.Data; import lombok.ToString; import lombok.experimental.Accessors; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityGroupRes; import java.util.Date; @@ -39,6 +42,13 @@ public class SecurityGroupDO { * {@link EnableStatusEnum} */ private EnableStatusEnum enable; + + /** + * 默认放行类型 + * {@link SecurityRulePassTypeEnum} + */ + private SecurityRulePassTypeEnum defaultPassType; + /** * 创建时间 */ @@ -48,5 +58,13 @@ public class SecurityGroupDO { */ private Date updateTime; + public SecurityGroupRes toRes() { + SecurityGroupRes res = new SecurityGroupRes(); + BeanUtil.copyProperties(this, res); + res.setEnable(enable.getDesc()); + res.setDefaultPassType(defaultPassType.getDesc()); + return res; + } + } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java index 128940d4..2b0c8525 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java @@ -1,5 +1,6 @@ package org.dromara.neutrinoproxy.server.dal.entity; +import cn.hutool.core.bean.BeanUtil; import cn.hutool.core.net.Ipv4Util; import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.annotation.IdType; @@ -10,6 +11,7 @@ import lombok.ToString; import lombok.experimental.Accessors; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; +import org.dromara.neutrinoproxy.server.controller.res.system.SecurityRuleRes; import java.util.Date; @@ -139,4 +141,11 @@ public class SecurityRuleDO { return SecurityRulePassTypeEnum.NONE; } + public SecurityRuleRes toRes() { + SecurityRuleRes res = new SecurityRuleRes(); + BeanUtil.copyProperties(this, res); + res.setPassType(this.passType.getDesc()); + return res; + } + } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java index 3110dec7..8dcb9bda 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java @@ -9,11 +9,15 @@ import io.netty.channel.SimpleChannelInboundHandler; import lombok.extern.slf4j.Slf4j; import org.dromara.neutrinoproxy.core.Constants; import org.dromara.neutrinoproxy.core.ProxyMessage; +import org.dromara.neutrinoproxy.core.util.IpUtil; import org.dromara.neutrinoproxy.server.constant.NetworkProtocolEnum; import org.dromara.neutrinoproxy.server.proxy.domain.VisitorChannelAttachInfo; import org.dromara.neutrinoproxy.server.service.FlowReportService; +import org.dromara.neutrinoproxy.server.service.PortMappingService; +import org.dromara.neutrinoproxy.server.service.SecurityGroupService; import org.dromara.neutrinoproxy.server.util.ProxyUtil; import org.noear.solon.Solon; +import org.noear.solon.annotation.Inject; import java.net.InetSocketAddress; @@ -25,6 +29,12 @@ import java.net.InetSocketAddress; @Slf4j public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler { + @Inject + private SecurityGroupService securityGroupService; + + @Inject + private PortMappingService portMappingService; + @Override public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) { // 当出现异常就关闭连接 @@ -64,7 +74,11 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler portToSecurityGroupMap = new ConcurrentHashMap<>(); + public PageInfo page(PageQuery pageQuery, PortMappingListReq req) { if (StringUtils.isNotEmpty(req.getDescription())) { //描述字段为模糊查询，在应用层处理，否则sqlite不支持 @@ -281,6 +285,28 @@ public class PortMappingService implements LifecycleBean { } } + public void portBindSecurityGroup(Integer portMappingId, Integer groupId) { + PortMappingDO mappingDO = portMappingMapper.findById(portMappingId); + if (mappingDO == null) { + throw new RuntimeException("指定的端口映射不存在"); + } + mappingDO.setSecurityGroupId(groupId); + mappingDO.setUpdateTime(new Date()); + portMappingMapper.updateById(mappingDO); + portToSecurityGroupMap.put(mappingDO.getServerPort(), groupId); + } + + public void portUnbindSecurityGroup(Integer portMappingId) { + PortMappingDO mappingDO = portMappingMapper.findById(portMappingId); + if (mappingDO == null) { + throw new RuntimeException("指定的端口映射不存在"); + } + mappingDO.setSecurityGroupId(null); + mappingDO.setUpdateTime(new Date()); + portMappingMapper.updateById(mappingDO); + portToSecurityGroupMap.remove(mappingDO.getServerPort()); + } + /** * 根据license查询可用的端口映射列表 * @@ -291,6 +317,11 @@ public class PortMappingService implements LifecycleBean { return portMappingMapper.findEnableListByLicenseId(licenseId); } + public Integer getSecurityGroupIdByMappingPor(Integer port) { + return portToSecurityGroupMap.get(port); + } + + /** * 服务端项目停止、启动时，更新在线状态为离线 */ @@ -315,6 +346,9 @@ public class PortMappingService implements LifecycleBean { return; } ProxyUtil.setSubdomainToServerPort(item.getSubdomain(), item.getServerPort()); + if (item.getSecurityGroupId() != null) { + portToSecurityGroupMap.put(item.getServerPort(), item.getSecurityGroupId()); + } }); } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java index cea9c78c..29398c02 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java @@ -2,21 +2,33 @@ package org.dromara.neutrinoproxy.server.service; import cn.hutool.cache.Cache; import cn.hutool.cache.CacheUtil; +import cn.hutool.core.bean.BeanUtil; +import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.core.toolkit.Wrappers; +import jdk.jshell.Snippet; +import lombok.extern.slf4j.Slf4j; import org.apache.ibatis.solon.annotation.Db; +import org.dromara.neutrinoproxy.server.base.rest.SystemContextHolder; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupCreateReq; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityGroupUpdateReq; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityRuleCreateReq; +import org.dromara.neutrinoproxy.server.controller.req.system.SecurityRuleUpdateReq; import org.dromara.neutrinoproxy.server.dal.SecurityGroupMapper; import org.dromara.neutrinoproxy.server.dal.SecurityRuleMapper; import org.dromara.neutrinoproxy.server.dal.entity.SecurityGroupDO; import org.dromara.neutrinoproxy.server.dal.entity.SecurityRuleDO; import org.noear.solon.annotation.Component; +import org.noear.solon.annotation.Init; +import java.util.Date; import java.util.List; import java.util.Map; import java.util.concurrent.ConcurrentHashMap; @Component +@Slf4j public class SecurityGroupService { @Db @@ -25,20 +37,119 @@ public class SecurityGroupService { @Db private SecurityRuleMapper securityRuleMapper; - private Map securityGroupMap = new ConcurrentHashMap<>(); + private final Map securityGroupMap = new ConcurrentHashMap<>(); // 允许通过控制的缓存，缓存类型最近最久未使用缓存，容量100，超时时间5分钟 - private Cache ipAllowControlCache = CacheUtil.newLRUCache(100, 1000 * 60 * 5); + private final Cache ipAllowControlCache = CacheUtil.newLRUCache(100, 1000 * 60 * 5); - public void init() { - List groupDOList = securityGroupMapper.selectList(Wrappers.lambdaQuery(SecurityGroupDO.class)); + @Init + public synchronized void init() { + securityGroupMap.clear(); + List groupDOList = securityGroupMapper.selectList(Wrappers.lambdaQuery(SecurityGroupDO.class) + .eq(SecurityGroupDO::getEnable, EnableStatusEnum.ENABLE)); groupDOList.forEach(securityGroupDO -> securityGroupMap.put(securityGroupDO.getId(), securityGroupDO)); + ipAllowControlCache.clear(); } - public boolean judgeAllow(String ip, Integer groupId) { + public void clearCache() { + ipAllowControlCache.clear(); + } + public List queryGroupList() { + return securityGroupMapper.selectList(Wrappers.lambdaQuery(SecurityGroupDO.class) + .eq(SecurityGroupDO::getUserId, SystemContextHolder.getUserId())); + } + + public void createGroup(SecurityGroupCreateReq req) { + SecurityGroupDO groupDO = new SecurityGroupDO(); + BeanUtil.copyProperties(req, groupDO); + groupDO.setUserId(SystemContextHolder.getUserId()); + securityGroupMapper.insert(groupDO); + init(); + } + + public void updateGroup(SecurityGroupUpdateReq req) { + SecurityGroupDO groupDO = securityGroupMapper.selectById(req.getId()); + BeanUtil.copyProperties(req, groupDO); + securityGroupMapper.updateById(groupDO); + init(); + } + + public void setGroupStatus(Integer groupId, EnableStatusEnum statusEnum) { SecurityGroupDO groupDO = securityGroupMap.get(groupId); if (groupDO == null || groupDO.getEnable() == EnableStatusEnum.DISABLE) { + throw new RuntimeException("指定的安全组不存在"); + } + groupDO.setEnable(statusEnum); + securityGroupMapper.updateById(groupDO); + init(); + } + + /** + * 删除安全组，并级联删除安全组下的规则，删除后，需缓存 + * @param groupId + */ + public void deleteGroup(Integer groupId) { + securityGroupMapper.deleteById(groupId); + securityRuleMapper.delete(Wrappers.lambdaQuery(SecurityRuleDO.class) + .eq(SecurityRuleDO::getGroupId, groupId)); + init(); + } + + public List queryRuleListByGroupId(Integer groupId) { + return securityRuleMapper.selectList(Wrappers.lambdaQuery(SecurityRuleDO.class) + .eq(SecurityRuleDO::getGroupId, groupId) + .orderByAsc(SecurityRuleDO::getPriority) + ); + } + + public void createRule(SecurityRuleCreateReq req) { + SecurityRuleDO ruleDO = new SecurityRuleDO(); + BeanUtil.copyProperties(req, ruleDO); + ruleDO.setUserId(SystemContextHolder.getUserId()); + securityRuleMapper.insert(ruleDO); + clearCache(); + } + + public void updateRule(SecurityRuleUpdateReq req) { + SecurityRuleDO ruleDO = securityRuleMapper.selectById(req.getId()); + BeanUtil.copyProperties(req, ruleDO); + securityRuleMapper.updateById(ruleDO); + clearCache(); + } + + public void deleteRule(Integer ruleId) { + securityRuleMapper.deleteById(ruleId); + clearCache(); + } + + public void setRuleStatus(Integer ruleId, EnableStatusEnum statusEnum) { + SecurityRuleDO ruleDO = securityRuleMapper.selectById(ruleId); + ruleDO.setEnable(statusEnum); + ruleDO.setUpdateTime(new Date()); + securityRuleMapper.updateById(ruleDO); + clearCache(); + } + + /** + * 判断ip在该安全组下是否允许,如果安全组没有创建，则放行，默认黑名单规则 + * @param ip 被判断的IP地址 + * @param groupId 安全组Id + * @return 是否放行 + */ + public boolean judgeAllow(String ip, Integer groupId) { + + // 不能判断当前连接的IP，保守处理，拒绝放行 + if (StrUtil.isEmpty(ip)) { + return false; + } + + // 黑名单规则，没有该安全组，则放行 + if (groupId == null) { + return true; + } + SecurityGroupDO groupDO = securityGroupMap.get(groupId); + if (groupDO == null) { return true; } @@ -49,6 +160,7 @@ public class SecurityGroupService { List ruleDOList = securityRuleMapper.selectList(Wrappers.lambdaQuery(SecurityRuleDO.class) .eq(SecurityRuleDO::getGroupId, groupId) + .eq(SecurityRuleDO::getEnable, EnableStatusEnum.ENABLE) .orderByAsc(SecurityRuleDO::getPriority) ); Boolean allow = null; @@ -64,11 +176,11 @@ public class SecurityGroupService { } } + // 当前IP没有匹配到任何一条规则，则使用安全组默认规则 if (allow == null) { - allow = true; + allow = groupDO.getDefaultPassType() == SecurityRulePassTypeEnum.ALLOW; } - // 当前IP没有匹配到任何一条规则，则放行 ipAllowControlCache.put(judgeAllowMapKey, allow); return allow; diff --git a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql index e6ea837f..aa422022 100644 --- a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql +++ b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql @@ -57,6 +57,7 @@ CREATE TABLE IF NOT EXISTS `security_group` ( `description` varchar(255) COMMENT '安全组描述', `user_id` int NOT NULL COMMENT '用户ID', `enable` int(1) NOT NULL COMMENT '启用状态', + `default_pass_type` int(1) NOT NULL COMMENT '默认放行类型', `create_time` datetime(3) NOT NULL COMMENT '创建时间', `update_time` datetime(3) NOT NULL COMMENT '更新时间', PRIMARY KEY (`id`) From 90623b9146cb06f50b9c80cb86e595ccb8b78004 Mon Sep 17 00:00:00 2001 From: = <=> Date: Wed, 6 Dec 2023 11:06:10 +0800 Subject: [PATCH 07/11] =?UTF-8?q?=E5=AE=89=E5=85=A8=E7=BB=84=E8=BF=94?= =?UTF-8?q?=E5=9B=9E=E6=95=B0=E6=8D=AE=E4=BF=AE=E6=94=B9?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../server/controller/SecurityController.java | 6 ------ .../req/system/SecurityGroupCreateReq.java | 7 +++++++ .../req/system/SecurityGroupUpdateReq.java | 6 ++++++ .../res/system/SecurityGroupRes.java | 6 ++++-- .../controller/res/system/SecurityRuleRes.java | 17 +++++++++++++++++ .../server/dal/entity/SecurityGroupDO.java | 8 ++++++-- .../server/dal/entity/SecurityRuleDO.java | 18 ++++++++++++------ .../proxy/core/UdpVisitorChannelHandler.java | 17 +++++++++++++++++ .../server/service/SecurityGroupService.java | 15 +++++++++++---- .../resources/sql/mysql/init-structure.sql | 8 ++++---- 10 files changed, 84 insertions(+), 24 deletions(-) diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java index 443965aa..0fb1b157 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java @@ -70,12 +70,6 @@ public class SecurityController { groupService.setGroupStatus(groupId, EnableStatusEnum.DISABLE); } - @Post - @Mapping("/port/bind/group") - public void portBindGroup(Integer portId, Integer groupId) { - portMappingService.portBindGroup(portId, groupId); - } - @Get @Mapping("/rule/s") public List getRulesByGroupId(Integer groupId) { diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java index 9a13ea57..e96590f8 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupCreateReq.java @@ -1,6 +1,7 @@ package org.dromara.neutrinoproxy.server.controller.req.system; import lombok.Data; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; @Data public class SecurityGroupCreateReq { @@ -13,4 +14,10 @@ public class SecurityGroupCreateReq { * 描述 */ private String description; + + /** + * 通过类型 + */ + private SecurityRulePassTypeEnum defaultPassType; + } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java index af3fc7e2..6dc8ffe1 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/system/SecurityGroupUpdateReq.java @@ -1,6 +1,7 @@ package org.dromara.neutrinoproxy.server.controller.req.system; import lombok.Data; +import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; @Data public class SecurityGroupUpdateReq { @@ -16,4 +17,9 @@ public class SecurityGroupUpdateReq { * 描述 */ private String description; + + /** + * 通过类型 + */ + private SecurityRulePassTypeEnum defaultPassType; } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java index 656154b8..23bbde2b 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityGroupRes.java @@ -1,12 +1,14 @@ package org.dromara.neutrinoproxy.server.controller.res.system; import lombok.Data; +import lombok.experimental.Accessors; import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; import java.util.Date; @Data +@Accessors(chain = true) public class SecurityGroupRes { private Integer id; @@ -36,11 +38,11 @@ public class SecurityGroupRes { /** * 创建时间 */ - private Date createTime; + private String createTime; /** * 更新时间 */ - private Date updateTime; + private String updateTime; diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java index 31b94869..10ce5043 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/res/system/SecurityRuleRes.java @@ -3,8 +3,11 @@ package org.dromara.neutrinoproxy.server.controller.res.system; import lombok.Data; import lombok.ToString; import lombok.experimental.Accessors; +import org.dromara.neutrinoproxy.server.constant.EnableStatusEnum; import org.dromara.neutrinoproxy.server.constant.SecurityRulePassTypeEnum; +import java.util.Date; + @Data @ToString @Accessors(chain = true) @@ -48,4 +51,18 @@ public class SecurityRuleRes { */ private Integer priority; + /** + * 启用状态 + */ + private String enable; + + /** + * 创建时间 + */ + private String createTime; + /** + * 更新时间 + */ + private String updateTime; + } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java index b98a1072..a7b1458c 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityGroupDO.java @@ -1,6 +1,8 @@ package org.dromara.neutrinoproxy.server.dal.entity; import cn.hutool.core.bean.BeanUtil; +import cn.hutool.core.date.DatePattern; +import cn.hutool.core.date.DateUtil; import com.baomidou.mybatisplus.annotation.IdType; import com.baomidou.mybatisplus.annotation.TableId; import com.baomidou.mybatisplus.annotation.TableName; @@ -61,8 +63,10 @@ public class SecurityGroupDO { public SecurityGroupRes toRes() { SecurityGroupRes res = new SecurityGroupRes(); BeanUtil.copyProperties(this, res); - res.setEnable(enable.getDesc()); - res.setDefaultPassType(defaultPassType.getDesc()); + res.setEnable(enable.getDesc()) + .setDefaultPassType(defaultPassType.getDesc()) + .setCreateTime(DateUtil.format(this.getCreateTime(), DatePattern.NORM_DATETIME_FORMAT)) + .setUpdateTime(DateUtil.format(this.getUpdateTime(), DatePattern.NORM_DATETIME_FORMAT)); return res; } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java index 2b0c8525..048ca204 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java @@ -1,6 +1,8 @@ package org.dromara.neutrinoproxy.server.dal.entity; import cn.hutool.core.bean.BeanUtil; +import cn.hutool.core.date.DatePattern; +import cn.hutool.core.date.DateUtil; import cn.hutool.core.net.Ipv4Util; import cn.hutool.core.util.StrUtil; import com.baomidou.mybatisplus.annotation.IdType; @@ -80,9 +82,9 @@ public class SecurityRuleDO { private Date updateTime; /** - * 判断当前规则是否允许指定ip同行 - * @param ip - * @return + * 判断当前规则是否允许指定ip放行 + * @param ip 指定的IP + * @return 放行状态 */ public SecurityRulePassTypeEnum allow(String ip) { @@ -124,8 +126,8 @@ public class SecurityRuleDO { // 掩码类型 if (rule.matches("(\\d+\\.){3}\\d+/\\d+")) { String[] netIp = rule.split("/"); - Long beginIp = Ipv4Util.getBeginIpLong(netIp[0], Integer.valueOf(netIp[1])); - Long endIp = Ipv4Util.getEndIpLong(netIp[0], Integer.valueOf(netIp[1])); + Long beginIp = Ipv4Util.getBeginIpLong(netIp[0], Integer.parseInt(netIp[1])); + Long endIp = Ipv4Util.getEndIpLong(netIp[0], Integer.parseInt(netIp[1])); if (beginIp <= ipLong && ipLong <= endIp) { return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; } @@ -144,7 +146,11 @@ public class SecurityRuleDO { public SecurityRuleRes toRes() { SecurityRuleRes res = new SecurityRuleRes(); BeanUtil.copyProperties(this, res); - res.setPassType(this.passType.getDesc()); + res.setPassType(this.passType.getDesc()) + .setEnable(this.getEnable().getDesc()) + .setCreateTime(DateUtil.format(this.getCreateTime(), DatePattern.NORM_DATETIME_FORMAT)) + .setUpdateTime(DateUtil.format(this.getUpdateTime(), DatePattern.NORM_DATETIME_FORMAT)) + ; return res; } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java index 6493be65..6036b68c 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/UdpVisitorChannelHandler.java @@ -10,12 +10,16 @@ import lombok.extern.slf4j.Slf4j; import org.apache.commons.lang3.StringUtils; import org.dromara.neutrinoproxy.core.Constants; import org.dromara.neutrinoproxy.core.ProxyMessage; +import org.dromara.neutrinoproxy.core.util.IpUtil; import org.dromara.neutrinoproxy.server.constant.NetworkProtocolEnum; import org.dromara.neutrinoproxy.server.proxy.domain.ProxyAttachment; import org.dromara.neutrinoproxy.server.proxy.domain.VisitorChannelAttachInfo; import org.dromara.neutrinoproxy.server.service.FlowReportService; +import org.dromara.neutrinoproxy.server.service.PortMappingService; +import org.dromara.neutrinoproxy.server.service.SecurityGroupService; import org.dromara.neutrinoproxy.server.util.ProxyUtil; import org.noear.solon.Solon; +import org.noear.solon.annotation.Inject; import java.net.InetSocketAddress; import java.nio.charset.StandardCharsets; @@ -27,6 +31,12 @@ import java.nio.charset.StandardCharsets; @Slf4j public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler { + @Inject + private SecurityGroupService securityGroupService; + + @Inject + private PortMappingService portMappingService; + @Override protected void channelRead0(ChannelHandlerContext ctx, DatagramPacket datagramPacket) throws Exception { log.debug("chid>>>{}", ctx.channel().id().asLongText()); @@ -118,6 +128,13 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler ipAllowControlCache = CacheUtil.newLRUCache(100, 1000 * 60 * 5); - @Init + @Init(index = 100) public synchronized void init() { securityGroupMap.clear(); List groupDOList = securityGroupMapper.selectList(Wrappers.lambdaQuery(SecurityGroupDO.class) @@ -63,7 +64,10 @@ public class SecurityGroupService { public void createGroup(SecurityGroupCreateReq req) { SecurityGroupDO groupDO = new SecurityGroupDO(); BeanUtil.copyProperties(req, groupDO); - groupDO.setUserId(SystemContextHolder.getUserId()); + groupDO.setEnable(EnableStatusEnum.ENABLE) + .setUserId(SystemContextHolder.getUserId()) + .setCreateTime(new Date()) + .setUpdateTime(new Date()); securityGroupMapper.insert(groupDO); init(); } @@ -87,7 +91,7 @@ public class SecurityGroupService { /** * 删除安全组，并级联删除安全组下的规则，删除后，需缓存 - * @param groupId + * @param groupId 安全组Id */ public void deleteGroup(Integer groupId) { securityGroupMapper.deleteById(groupId); @@ -106,7 +110,10 @@ public class SecurityGroupService { public void createRule(SecurityRuleCreateReq req) { SecurityRuleDO ruleDO = new SecurityRuleDO(); BeanUtil.copyProperties(req, ruleDO); - ruleDO.setUserId(SystemContextHolder.getUserId()); + ruleDO.setUserId(SystemContextHolder.getUserId()) + .setCreateTime(new Date()) + .setEnable(EnableStatusEnum.ENABLE) + .setUpdateTime(new Date()); securityRuleMapper.insert(ruleDO); clearCache(); } diff --git a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql index aa422022..1234ddc0 100644 --- a/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql +++ b/neutrino-proxy-server/src/main/resources/sql/mysql/init-structure.sql @@ -56,8 +56,8 @@ CREATE TABLE IF NOT EXISTS `security_group` ( `name` varchar(20) NOT NULL COMMENT '安全组名称', `description` varchar(255) COMMENT '安全组描述', `user_id` int NOT NULL COMMENT '用户ID', - `enable` int(1) NOT NULL COMMENT '启用状态', - `default_pass_type` int(1) NOT NULL COMMENT '默认放行类型', + `enable` varchar(20) NOT NULL COMMENT '启用状态', + `default_pass_type` varchar(20) NOT NULL COMMENT '默认放行类型', `create_time` datetime(3) NOT NULL COMMENT '创建时间', `update_time` datetime(3) NOT NULL COMMENT '更新时间', PRIMARY KEY (`id`) @@ -70,10 +70,10 @@ CREATE TABLE IF NOT EXISTS `security_rule` ( `name` varchar(20) NOT NULL COMMENT '规则名称', `description` varchar(255) NOT NULL COMMENT '规则描述', `rule` text NOT NULL COMMENT '规则内容', - `pass_type` int(1) NOT NULL COMMENT '放行类型', + `pass_type` varchar(20) NOT NULL COMMENT '放行类型', `priority` int(1) NOT NULL COMMENT '优先级', `user_id` int NOT NULL COMMENT '用户ID', - `enable` int(1) NOT NULL COMMENT '启用状态', + `enable` varchar(20) NOT NULL COMMENT '启用状态', `create_time` datetime(3) NOT NULL COMMENT '创建时间', `update_time` datetime(3) NOT NULL COMMENT '更新时间', PRIMARY KEY (`id`), From 781b14861cbc635a6f2e24d4b7eb11dec5cda854 Mon Sep 17 00:00:00 2001 From: = <=> Date: Wed, 6 Dec 2023 17:22:14 +0800 Subject: [PATCH 08/11] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=E5=AE=89=E5=85=A8?= =?UTF-8?q?=E7=BB=84=E9=A1=B5=E9=9D=A2=E5=92=8C=E5=AE=89=E5=85=A8=E8=A7=84?= =?UTF-8?q?=E5=88=99=E9=A1=B5=E9=9D=A2?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- neutrino-proxy-admin/src/api/securityGroup.js | 97 +++++ neutrino-proxy-admin/src/lang/zh.js | 15 +- neutrino-proxy-admin/src/router/index.js | 2 + .../src/views/system/securityGroup.vue | 310 ++++++++++++++++ .../src/views/system/securityRule.vue | 349 ++++++++++++++++++ .../constant/SecurityRulePassTypeEnum.java | 4 +- .../server/controller/SecurityController.java | 8 +- .../server/service/SecurityGroupService.java | 8 +- 8 files changed, 787 insertions(+), 6 deletions(-) create mode 100644 neutrino-proxy-admin/src/api/securityGroup.js create mode 100644 neutrino-proxy-admin/src/views/system/securityGroup.vue create mode 100644 neutrino-proxy-admin/src/views/system/securityRule.vue diff --git a/neutrino-proxy-admin/src/api/securityGroup.js b/neutrino-proxy-admin/src/api/securityGroup.js new file mode 100644 index 00000000..c9456516 --- /dev/null +++ b/neutrino-proxy-admin/src/api/securityGroup.js @@ -0,0 +1,97 @@ +import request from '@/utils/request' + +const baseUri = '/security'; + +export function fetchGroupList() { + return request({ + url: `${baseUri}/group/s`, + method: 'get' + }) +} + +export function fetchGroupOne(groupId) { + return request({ + url: `${baseUri}/group/getOne?groupId=${groupId}`, + method: 'get' + }) +} + +export function createGroup(data) { + return request({ + url: `${baseUri}/group/create`, + method: 'post', + data + }) +} + +export function updateGroup(data) { + return request({ + url: `${baseUri}/group/update`, + method: 'post', + data + }) +} + +export function deleteGroup(groupId) { + return request({ + url: `${baseUri}/group/delete?groupId=${groupId}`, + method: 'post' + }) +} + +export function enableGroup(groupId) { + return request({ + url: `${baseUri}/group/enable?groupId=${groupId}`, + method: 'post' + }) +} + +export function disableGroup(groupId) { + return request({ + url: `${baseUri}/group/disable?groupId=${groupId}`, + method: 'post' + }) +} + +export function fetchRuleList(groupId) { + return request({ + url: `${baseUri}/rule/s?groupId=${groupId}`, + method: 'get' + }) +} + +export function createRule(data) { + return request({ + url: `${baseUri}/rule/create`, + method: 'post', + data + }) +} + +export function updateRule(data) { + return request({ + url: `${baseUri}/rule/update`, + method: 'post', + data + }) +} +export function deleteRule(ruleId) { + return request({ + url: `${baseUri}/rule/delete?ruleId=${ruleId}`, + method: 'post' + }) +} + +export function enableRule(ruleId) { + return request({ + url: `${baseUri}/rule/enable?ruleId=${ruleId}`, + method: 'post' + }) +} + +export function disableRule(ruleId) { + return request({ + url: `${baseUri}/rule/disable?ruleId=${ruleId}`, + method: 'post' + }) +} \ No newline at end of file diff --git a/neutrino-proxy-admin/src/lang/zh.js b/neutrino-proxy-admin/src/lang/zh.js index 4cc16d9b..27ed91f5 100644 --- a/neutrino-proxy-admin/src/lang/zh.js +++ b/neutrino-proxy-admin/src/lang/zh.js @@ -48,6 +48,8 @@ export default { user: '用户管理', system: '系统管理', portPool: '端口池管理', + securityGroup: '安全组管理', + securityRule: '安全规则管理', portGroup: '端口分组管理', protocal: '协议管理', proxy: '代理配置', @@ -128,6 +130,7 @@ export default { confirm: '确 定', userId: '用户ID', userName: '用户名', + name: '名称', group: '分组', groupName: '分组名称', groupPossessor: '分组所属', @@ -169,7 +172,17 @@ export default { totalFlow: '总流量', protocalName: '协议', supportStatus: '支持状态', - domainName: '域名' + domainName: '域名', + defaultPassType: '默认放行类型', + ruleName: '规则名称', + rule: '规则内容', + passType: '放行类型', + priority: '优先级', + ruleConfig: '规则配置', + portMappingBindSecurityGroup: '绑定安全组', + securityGroupBindPortMapping: '绑定端口映射', + bind: '绑定', + unbind: '解绑' }, button: { lookOver: '查看' diff --git a/neutrino-proxy-admin/src/router/index.js b/neutrino-proxy-admin/src/router/index.js index 3c246651..47a870f2 100644 --- a/neutrino-proxy-admin/src/router/index.js +++ b/neutrino-proxy-admin/src/router/index.js @@ -77,6 +77,8 @@ export const asyncRouterMap = [ { path: 'user', component: _import('system/user'), name: 'user', meta: { title: 'user' }}, { path: 'portGroup', component: _import('system/portGroup'), name: 'portGroup', meta: { title: 'portGroup' }}, { path: 'portPool', component: _import('system/portPool'), name: 'portPool', meta: { title: 'portPool' }}, + { path: 'securityGroup', component: _import('system/securityGroup'), name: 'securityGroup', meta: { title: 'securityGroup' }}, + { path: 'securityRule', component: _import('system/securityRule'), name: 'securityRule', meta: { title: 'securityRule' }, hidden: true}, { path: 'protocal', component: _import('system/protocal'), name: 'protocal', meta: { title: 'protocal' }}, { path: 'jobManager', component: _import('system/jobManager'), name: 'jobManager', meta: { title: 'jobManager' }} ] diff --git a/neutrino-proxy-admin/src/views/system/securityGroup.vue b/neutrino-proxy-admin/src/views/system/securityGroup.vue new file mode 100644 index 00000000..dea5b8d6 --- /dev/null +++ b/neutrino-proxy-admin/src/views/system/securityGroup.vue @@ -0,0 +1,310 @@ + + + diff --git a/neutrino-proxy-admin/src/views/system/securityRule.vue b/neutrino-proxy-admin/src/views/system/securityRule.vue new file mode 100644 index 00000000..dfeda98e --- /dev/null +++ b/neutrino-proxy-admin/src/views/system/securityRule.vue @@ -0,0 +1,349 @@ + + + diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java index 60991e30..07cd72c9 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/constant/SecurityRulePassTypeEnum.java @@ -6,9 +6,9 @@ import lombok.Getter; @AllArgsConstructor @Getter public enum SecurityRulePassTypeEnum { - DENY(-1, "DENY"), + DENY(0, "deny"), ALLOW(1, "allow"), - NONE(0, "none") + NONE(-1, "none") ; private final Integer code; diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java index 0fb1b157..18dc335e 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/SecurityController.java @@ -36,6 +36,12 @@ public class SecurityController { return groupDOList.stream().map(SecurityGroupDO::toRes).collect(Collectors.toList()); } + @Get + @Mapping("/group/getOne") + public SecurityGroupRes getGroupOne(Integer groupId) { + return groupService.queryGroupOne(groupId).toRes(); + } + @Post @Mapping("/group/create") public void createGroup(SecurityGroupCreateReq req) { @@ -50,7 +56,7 @@ public class SecurityController { /** * 将级联删除对应规则,并更新缓存 - * @param groupId + * @param groupId 安全组Id */ @Post @Mapping("/group/delete") diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java index d0c49abc..88732379 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java @@ -61,6 +61,10 @@ public class SecurityGroupService { .eq(SecurityGroupDO::getUserId, SystemContextHolder.getUserId())); } + public SecurityGroupDO queryGroupOne(Integer groupId) { + return securityGroupMapper.selectById(groupId); + } + public void createGroup(SecurityGroupCreateReq req) { SecurityGroupDO groupDO = new SecurityGroupDO(); BeanUtil.copyProperties(req, groupDO); @@ -80,8 +84,8 @@ public class SecurityGroupService { } public void setGroupStatus(Integer groupId, EnableStatusEnum statusEnum) { - SecurityGroupDO groupDO = securityGroupMap.get(groupId); - if (groupDO == null || groupDO.getEnable() == EnableStatusEnum.DISABLE) { + SecurityGroupDO groupDO = securityGroupMapper.selectById(groupId); + if (groupDO == null) { throw new RuntimeException("指定的安全组不存在"); } groupDO.setEnable(statusEnum); From 6cbf2ecac47fe2b8c2d192ad129b7bfd1e228bf5 Mon Sep 17 00:00:00 2001 From: az Date: Wed, 6 Dec 2023 22:18:09 +0800 Subject: [PATCH 09/11] =?UTF-8?q?=E6=9B=B4=E6=96=B0vue=E7=89=88=E6=9C=AC?= =?UTF-8?q?=EF=BC=8C=E6=B7=BB=E5=8A=A0=E7=AB=AF=E5=8F=A3=E6=98=A0=E5=B0=84?= =?UTF-8?q?=E9=85=8D=E7=BD=AE?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- neutrino-proxy-admin/package.json | 2 +- neutrino-proxy-admin/src/api/portMapping.js | 19 ++ .../src/components/Link/linkPopover.vue | 83 +++++++++ neutrino-proxy-admin/src/lang/zh.js | 6 +- .../src/views/proxy/portMapping.vue | 16 ++ .../src/views/system/securityGroup.vue | 163 ++++++++++++++---- .../controller/PortMappingController.java | 17 +- .../PortMappingBindSecurityGroupReq.java | 12 ++ .../req/proxy/PortMappingUpdateReq.java | 6 + .../res/proxy/PortMappingListRes.java | 6 + .../server/dal/entity/PortMappingDO.java | 17 +- .../server/service/PortMappingService.java | 15 +- 12 files changed, 292 insertions(+), 70 deletions(-) create mode 100644 neutrino-proxy-admin/src/components/Link/linkPopover.vue create mode 100644 neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/proxy/PortMappingBindSecurityGroupReq.java diff --git a/neutrino-proxy-admin/package.json b/neutrino-proxy-admin/package.json index 9073308a..d2bdb819 100644 --- a/neutrino-proxy-admin/package.json +++ b/neutrino-proxy-admin/package.json @@ -23,7 +23,7 @@ "codemirror": "5.32.0", "dropzone": "5.2.0", "echarts": "3.8.5", - "element-ui": "2.0.8", + "element-ui": "^2.15.14", "file-saver": "1.3.3", "font-awesome": "4.7.0", "js-cookie": "2.2.0", diff --git a/neutrino-proxy-admin/src/api/portMapping.js b/neutrino-proxy-admin/src/api/portMapping.js index cf7989e9..315e4f50 100644 --- a/neutrino-proxy-admin/src/api/portMapping.js +++ b/neutrino-proxy-admin/src/api/portMapping.js @@ -44,3 +44,22 @@ export function updateEnableStatus(id, enable) { } }) } + +export function portMappingBindSecurityGroup(id, securityGroupId) { + return request({ + url: '/port-mapping/bind/security-group', + method: 'post', + data: { + id: id, + securityGroupId: securityGroupId + } + }) +} + +export function portMappingUnbindSecurityGroup(id) { + return request({ + url: `/port-mapping/unbind/security-group?id=${id}`, + method: 'post' + }) +} + diff --git a/neutrino-proxy-admin/src/components/Link/linkPopover.vue b/neutrino-proxy-admin/src/components/Link/linkPopover.vue new file mode 100644 index 00000000..d199e124 --- /dev/null +++ b/neutrino-proxy-admin/src/components/Link/linkPopover.vue @@ -0,0 +1,83 @@ + + + + + diff --git a/neutrino-proxy-admin/src/lang/zh.js b/neutrino-proxy-admin/src/lang/zh.js index 27ed91f5..a9c3b139 100644 --- a/neutrino-proxy-admin/src/lang/zh.js +++ b/neutrino-proxy-admin/src/lang/zh.js @@ -173,6 +173,7 @@ export default { protocalName: '协议', supportStatus: '支持状态', domainName: '域名', + securityGroup: '安全组', defaultPassType: '默认放行类型', ruleName: '规则名称', rule: '规则内容', @@ -180,9 +181,10 @@ export default { priority: '优先级', ruleConfig: '规则配置', portMappingBindSecurityGroup: '绑定安全组', - securityGroupBindPortMapping: '绑定端口映射', + securityGroupBindPortMapping: '端口映射绑定', bind: '绑定', - unbind: '解绑' + unbind: '解绑', + bindOtherSecurityGroup: '已绑定其他安全组' }, button: { lookOver: '查看' diff --git a/neutrino-proxy-admin/src/views/proxy/portMapping.vue b/neutrino-proxy-admin/src/views/proxy/portMapping.vue index 9caf8f0e..eadbfaf3 100644 --- a/neutrino-proxy-admin/src/views/proxy/portMapping.vue +++ b/neutrino-proxy-admin/src/views/proxy/portMapping.vue @@ -176,6 +176,12 @@ + + + + + + @@ -204,6 +210,7 @@ + \ No newline at end of file diff --git a/neutrino-proxy-admin/src/views/system/securityRule.vue b/neutrino-proxy-admin/src/views/system/securityRule.vue index dfeda98e..fb9c8a64 100644 --- a/neutrino-proxy-admin/src/views/system/securityRule.vue +++ b/neutrino-proxy-admin/src/views/system/securityRule.vue @@ -35,8 +35,8 @@ @@ -62,11 +62,10 @@ @@ -132,7 +131,7 @@ import {fetchGroupOne, fetchRuleList, createRule, updateRule, deleteRule, enableRule, disableRule} from '@/api/securityGroup' import waves from '@/directive/waves' // 水波纹指令 import { parseTime } from '@/utils' -import ButtonPopover from '../../components/Button/buttonPopover' +import LinkPopover from '../../components/Link/linkPopover' export default { name: 'complexTable', @@ -140,7 +139,7 @@ import ButtonPopover from '../../components/Button/buttonPopover' waves }, components: { - ButtonPopover + LinkPopover }, data() { return { @@ -164,7 +163,7 @@ import ButtonPopover from '../../components/Button/buttonPopover' update: '编辑', create: '新建' }, - passTypeList: [{key: 'allow', value: 1}, {key: 'deny', value: 0}], + passTypeList: [{key: '允许', value: 1}, {key: '拒绝', value: 0}], dialogPvVisible: false, pvData: [], rules: { @@ -304,6 +303,7 @@ import ButtonPopover from '../../components/Button/buttonPopover' }, handleUpdate(row) { this.temp = Object.assign({}, row) // copy obj + this.temp.passType = row.passType == 'allow' ? 1 : 0 this.temp.timestamp = new Date(this.temp.timestamp) this.dialogStatus = 'update' this.dialogFormVisible = true diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java index 76abe801..b6f2af36 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/PortMappingDO.java @@ -97,7 +97,7 @@ public class PortMappingDO { /** * 安全组Id */ - private Integer securityGroupId; + private Integer securityGroupId = 0; // 设置为null不生效，不知道为啥 /** * 创建时间 diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/PortMappingService.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/PortMappingService.java index 4bbc15ed..58c3f59e 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/PortMappingService.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/PortMappingService.java @@ -187,6 +187,9 @@ public class PortMappingService implements LifecycleBean { PortMappingDO portMappingDO = new PortMappingDO(); BeanUtil.copyProperties(req, portMappingDO); + if (req.getSecurityGroupId() == null) { + portMappingDO.setSecurityGroupId(0); + } portMappingDO.setUpdateTime(new Date()); portMappingDO.setEnable(EnableStatusEnum.ENABLE.getStatus()); portMappingMapper.updateById(portMappingDO); @@ -292,7 +295,7 @@ public class PortMappingService implements LifecycleBean { if (mappingDO == null) { throw new RuntimeException("指定的端口映射不存在"); } - mappingDO.setSecurityGroupId(null); + mappingDO.setSecurityGroupId(0); mappingDO.setUpdateTime(new Date()); portMappingMapper.updateById(mappingDO); portToSecurityGroupMap.remove(mappingDO.getServerPort()); From 7a173757f0d9d22e5a920d8b3c85a7a15f722659 Mon Sep 17 00:00:00 2001 From: = <=> Date: Thu, 7 Dec 2023 11:03:54 +0800 Subject: [PATCH 11/11] =?UTF-8?q?=E7=AB=AF=E5=8F=A3=E6=98=A0=E5=B0=84?= =?UTF-8?q?=E5=AE=89=E5=85=A8=E8=A7=84=E5=88=99=E7=95=8C=E9=9D=A2=E4=BF=AE?= =?UTF-8?q?=E6=94=B9=E5=90=8E=E5=8D=B3=E6=97=B6=E7=94=9F=E6=95=88?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../src/views/system/securityRule.vue | 2 +- .../src/main/resources/app.yml | 2 +- .../req/proxy/PortMappingCreateReq.java | 6 +++ .../server/dal/entity/SecurityRuleDO.java | 6 ++- .../proxy/core/TcpVisitorChannelHandler.java | 8 ++-- .../proxy/core/UdpVisitorChannelHandler.java | 8 ++-- .../server/service/PortMappingService.java | 43 +++++++++++++++---- .../server/service/SecurityGroupService.java | 16 +++++-- 8 files changed, 64 insertions(+), 27 deletions(-) diff --git a/neutrino-proxy-admin/src/views/system/securityRule.vue b/neutrino-proxy-admin/src/views/system/securityRule.vue index fb9c8a64..d103e6e6 100644 --- a/neutrino-proxy-admin/src/views/system/securityRule.vue +++ b/neutrino-proxy-admin/src/views/system/securityRule.vue @@ -86,7 +86,7 @@
规则描述:
-
单个ip：192.168.1.1,0:0:0:0:0:0:10.0.0.1, ipv6只支持单个ip判断
+
单个ip：192.168.1.1, AA22:BB11:1122:CDEF:1234:AA99:7654:7410, ipv6只支持单个ip判断
范围类型：192.168.1.0-192.168.1.255
掩码类型：192.168.1.0/24
泛型：0.0.0.0/ALL
diff --git a/neutrino-proxy-client/src/main/resources/app.yml b/neutrino-proxy-client/src/main/resources/app.yml index c513862e..7ed0a997 100644 --- a/neutrino-proxy-client/src/main/resources/app.yml +++ b/neutrino-proxy-client/src/main/resources/app.yml @@ -44,7 +44,7 @@ neutrino: # 是否启用SSL(注意：该配置必须和server-port对应上) ssl-enable: ${SSL_ENABLE:true} # 客户端连接唯一凭证 - license-key: ${LICENSE_KEY:} + license-key: ${LICENSE_KEY:b0a907332b474b25897c4dcb31fc7eb6} # 客户端唯一身份标识（可忽略，若不设置首次启动会自动生成） client-id: ${CLIENT_ID:} # 是否开启隧道传输报文日志(日志级别为debug时开启才有效) diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/proxy/PortMappingCreateReq.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/proxy/PortMappingCreateReq.java index 5270e8c6..1ee94e0c 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/proxy/PortMappingCreateReq.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/controller/req/proxy/PortMappingCreateReq.java @@ -62,6 +62,12 @@ public class PortMappingCreateReq { * 代理超时时间 */ private Long proxyTimeoutMs; + + /** + * 安全组Id + */ + private Integer securityGroupId; + /** * 描述 */ diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java index 048ca204..9a3240d4 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/dal/entity/SecurityRuleDO.java @@ -86,7 +86,7 @@ public class SecurityRuleDO { * @param ip 指定的IP * @return 放行状态 */ - public SecurityRulePassTypeEnum allow(String ip) { + public SecurityRulePassTypeEnum judge(String ip) { // 被判断的IP地址为空，不做判断 if (StrUtil.isEmpty(ip)) { @@ -108,9 +108,11 @@ public class SecurityRuleDO { String[] rules = this.rule.split(","); for (String rule : rules) { + rule = rule.trim(); + // 单个ip,ipv6在此步已处理，后面不需要额外判断ipv6的情况 if (rule.matches("(\\d+\\.){3}\\d+") || isIpv6) { - if (rule.equals(ip)) { + if (rule.equalsIgnoreCase(ip)) { return passType == SecurityRulePassTypeEnum.ALLOW ? SecurityRulePassTypeEnum.ALLOW : SecurityRulePassTypeEnum.DENY; } } diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java index 8dcb9bda..d9aa25a9 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/proxy/core/TcpVisitorChannelHandler.java @@ -29,11 +29,9 @@ import java.net.InetSocketAddress; @Slf4j public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler { - @Inject - private SecurityGroupService securityGroupService; + private final SecurityGroupService securityGroupService = Solon.context().getBean(SecurityGroupService.class); - @Inject - private PortMappingService portMappingService; + private final PortMappingService portMappingService = Solon.context().getBean(PortMappingService.class); @Override public void exceptionCaught(ChannelHandlerContext ctx, Throwable cause) { @@ -74,7 +72,7 @@ public class TcpVisitorChannelHandler extends SimpleChannelInboundHandler { - @Inject - private SecurityGroupService securityGroupService; + private final SecurityGroupService securityGroupService = Solon.context().getBean(SecurityGroupService.class); - @Inject - private PortMappingService portMappingService; + private final PortMappingService portMappingService = Solon.context().getBean(PortMappingService.class); @Override protected void channelRead0(ChannelHandlerContext ctx, DatagramPacket datagramPacket) throws Exception { @@ -130,7 +128,7 @@ public class UdpVisitorChannelHandler extends SimpleChannelInboundHandler portToSecurityGroupMap = new ConcurrentHashMap<>(); + private final Map mappingPortToSecurityGroupMap = new ConcurrentHashMap<>(); public PageInfo page(PageQuery pageQuery, PortMappingListReq req) { if (StringUtils.isNotEmpty(req.getDescription())) { @@ -166,6 +167,9 @@ public class PortMappingService implements LifecycleBean { if (NetworkProtocolEnum.isHttp(portMappingDO.getProtocal()) && StrUtil.isNotBlank(proxyConfig.getServer().getTcp().getDomainName()) && StrUtil.isNotBlank(portMappingDO.getSubdomain())) { ProxyUtil.setSubdomainToServerPort(portMappingDO.getSubdomain(), portMappingDO.getServerPort()); } + + updateMappingPortToSecurityGroupMap(portMappingDO.getServerPort(), req.getSecurityGroupId()); + return new PortMappingCreateRes(); } @@ -203,6 +207,8 @@ public class PortMappingService implements LifecycleBean { if (NetworkProtocolEnum.isHttp(portMappingDO.getProtocal()) && StrUtil.isNotBlank(proxyConfig.getServer().getTcp().getDomainName()) && StrUtil.isNotBlank(portMappingDO.getSubdomain())) { ProxyUtil.setSubdomainToServerPort(portMappingDO.getSubdomain(), portMappingDO.getServerPort()); } + + updateMappingPortToSecurityGroupMap(portMappingDO.getServerPort(), req.getSecurityGroupId()); } public PortMappingDetailRes detail(Integer id) { @@ -277,6 +283,8 @@ public class PortMappingService implements LifecycleBean { if (NetworkProtocolEnum.isHttp(portMappingDO.getProtocal()) && StrUtil.isNotBlank(portMappingDO.getSubdomain())) { ProxyUtil.removeSubdomainToServerPort(portMappingDO.getSubdomain()); } + + updateMappingPortToSecurityGroupMap(portMappingDO.getServerPort(), null); } public void portBindSecurityGroup(Integer portMappingId, Integer groupId) { @@ -287,7 +295,7 @@ public class PortMappingService implements LifecycleBean { mappingDO.setSecurityGroupId(groupId); mappingDO.setUpdateTime(new Date()); portMappingMapper.updateById(mappingDO); - portToSecurityGroupMap.put(mappingDO.getServerPort(), groupId); + updateMappingPortToSecurityGroupMap(mappingDO.getServerPort(), groupId); } public void portUnbindSecurityGroup(Integer portMappingId) { @@ -298,7 +306,7 @@ public class PortMappingService implements LifecycleBean { mappingDO.setSecurityGroupId(0); mappingDO.setUpdateTime(new Date()); portMappingMapper.updateById(mappingDO); - portToSecurityGroupMap.remove(mappingDO.getServerPort()); + updateMappingPortToSecurityGroupMap(mappingDO.getServerPort(), null); } /** @@ -311,8 +319,8 @@ public class PortMappingService implements LifecycleBean { return portMappingMapper.findEnableListByLicenseId(licenseId); } - public Integer getSecurityGroupIdByMappingPor(Integer port) { - return portToSecurityGroupMap.get(port); + public Integer getSecurityGroupIdByMappingPort(Integer port) { + return mappingPortToSecurityGroupMap.get(port); } @@ -327,11 +335,22 @@ public class PortMappingService implements LifecycleBean { } portMappingMapper.updateOnlineStatus(OnlineStatusEnum.OFFLINE.getStatus(), new Date()); + List allMappingDOList = portMappingMapper.selectList(Wrappers.lambdaQuery(PortMappingDO.class)); + allMappingDOList.forEach(item -> { + Integer securityGroupId = item.getSecurityGroupId(); + if (securityGroupId != null && securityGroupId > 0) { + updateMappingPortToSecurityGroupMap(item.getServerPort(), item.getSecurityGroupId()); + } + }); + // 未配置域名，则不需要处理域名映射逻辑 if (StrUtil.isBlank(proxyConfig.getServer().getTcp().getDomainName())) { return; } - List portMappingDOList = portMappingMapper.selectList(new LambdaQueryWrapper().eq(PortMappingDO::getProtocal, NetworkProtocolEnum.HTTP.getDesc()).isNotNull(PortMappingDO::getSubdomain)); + List portMappingDOList = allMappingDOList.stream() + .filter(item -> NetworkProtocolEnum.HTTP.getDesc().equals(item.getProtocal()) && item.getSubdomain() != null) + .collect(Collectors.toList()); +// List portMappingDOList = portMappingMapper.selectList(new LambdaQueryWrapper().eq(PortMappingDO::getProtocal, NetworkProtocolEnum.HTTP.getDesc()).isNotNull(PortMappingDO::getSubdomain)); if (CollectionUtil.isEmpty(portMappingDOList)) { return; } @@ -340,12 +359,18 @@ public class PortMappingService implements LifecycleBean { return; } ProxyUtil.setSubdomainToServerPort(item.getSubdomain(), item.getServerPort()); - if (item.getSecurityGroupId() != null) { - portToSecurityGroupMap.put(item.getServerPort(), item.getSecurityGroupId()); - } + }); } + private void updateMappingPortToSecurityGroupMap(Integer serverPort, Integer securityGroupId) { + if (securityGroupId == null || securityGroupId == 0) { + mappingPortToSecurityGroupMap.remove(serverPort); + return; + } + mappingPortToSecurityGroupMap.put(serverPort, securityGroupId); + } + @Override public void start() throws Throwable { diff --git a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java index 88732379..6411379a 100644 --- a/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java +++ b/neutrino-proxy-server/src/main/java/org/dromara/neutrinoproxy/server/service/SecurityGroupService.java @@ -149,24 +149,30 @@ public class SecurityGroupService { * @return 是否放行 */ public boolean judgeAllow(String ip, Integer groupId) { - + ip = ip.toLowerCase(); // 不能判断当前连接的IP，保守处理，拒绝放行 if (StrUtil.isEmpty(ip)) { + log.debug("【安全组】不能正确获取到IP地址，保守处理，拒绝放行"); return false; } // 黑名单规则，没有该安全组，则放行 if (groupId == null) { + log.debug("【安全组】{}：该IP访问的端口映射没有绑定安全组（1）， 放行", ip); return true; } SecurityGroupDO groupDO = securityGroupMap.get(groupId); if (groupDO == null) { + log.debug("【安全组】{}：该IP访问的端口映射没有绑定安全组（2）， 放行", ip); return true; } + Boolean allow = null; String judgeAllowMapKey = ip + groupId; if (ipAllowControlCache.containsKey(judgeAllowMapKey)) { - return ipAllowControlCache.get(judgeAllowMapKey); + allow = ipAllowControlCache.get(judgeAllowMapKey); + log.debug("【安全组】{}-安全组{}：该IP在缓存中，缓存策略为{}", ip, groupId, allow ? "允许" : "拒绝"); + return allow; } List ruleDOList = securityRuleMapper.selectList(Wrappers.lambdaQuery(SecurityRuleDO.class) @@ -174,15 +180,16 @@ public class SecurityGroupService { .eq(SecurityRuleDO::getEnable, EnableStatusEnum.ENABLE) .orderByAsc(SecurityRuleDO::getPriority) ); - Boolean allow = null; for (SecurityRuleDO ruleDO : ruleDOList) { - SecurityRulePassTypeEnum passType = ruleDO.allow(ip); + SecurityRulePassTypeEnum passType = ruleDO.judge(ip); if (passType == SecurityRulePassTypeEnum.ALLOW) { allow = true; + log.debug("【安全组】{}-安全组{}：匹配到安全规则{}行为：{}", ip, groupId, ruleDO.getId(), "允许"); break; } if (passType == SecurityRulePassTypeEnum.DENY) { allow = false; + log.info("【安全组】{}-安全组{}：匹配到安全规则{}行为：{}", ip, groupId, ruleDO.getId(), "拒绝"); break; } } @@ -190,6 +197,7 @@ public class SecurityGroupService { // 当前IP没有匹配到任何一条规则，则使用安全组默认规则 if (allow == null) { allow = groupDO.getDefaultPassType() == SecurityRulePassTypeEnum.ALLOW; + log.debug("【安全组】{}-安全组{}：使用安全组默认放行类型：{}", ip, groupId, allow ? "允许" : "拒绝"); } ipAllowControlCache.put(judgeAllowMapKey, allow);