package com.ruoyi.web.controller.hanler;
|
|
import com.ruoyi.common.annotation.IpWhitelist;
|
import com.ruoyi.system.domain.SysConfig;
|
import com.ruoyi.system.mapper.SysConfigMapper;
|
import org.apache.commons.net.util.SubnetUtils;
|
import org.springframework.beans.factory.annotation.Autowired;
|
import org.springframework.http.HttpStatus;
|
import org.springframework.stereotype.Component;
|
import org.springframework.web.method.HandlerMethod;
|
import org.springframework.web.servlet.HandlerInterceptor;
|
|
import javax.servlet.http.HttpServletRequest;
|
import javax.servlet.http.HttpServletResponse;
|
import java.util.Arrays;
|
import java.util.List;
|
import java.util.regex.Pattern;
|
|
@Component
|
public class IpWhitelistInterceptor implements HandlerInterceptor {
|
@Autowired
|
private SysConfigMapper sysConfigMapper;
|
|
@Override
|
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
|
System.out.println("处理器类: " + handler.getClass().getName());
|
if (handler instanceof HandlerMethod) {
|
HandlerMethod handlerMethod = (HandlerMethod) handler;
|
if (handlerMethod.hasMethodAnnotation(IpWhitelist.class)) {
|
//获取请求的IP，判断是不是在白名单中
|
String clientIp = getClientIp(request);
|
if (!isIpInWhitelist(clientIp)) {
|
response.setStatus(HttpStatus.FORBIDDEN.value());
|
response.getWriter().write("Access denied: IP address not whitelisted");
|
return false;
|
}
|
}
|
}
|
return true;
|
}
|
|
private String getClientIp(HttpServletRequest request) {
|
String ip = request.getHeader("X-Forwarded-For");
|
if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
|
ip = request.getHeader("Proxy-Client-IP");
|
}
|
if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
|
ip = request.getHeader("WL-Proxy-Client-IP");
|
}
|
if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
|
ip = request.getRemoteAddr();
|
}
|
return ip;
|
}
|
|
private boolean isIpInWhitelist(String ip) {
|
try {
|
SysConfig config = new SysConfig();
|
config.setConfigKey("sys.ip.whitelist");
|
SysConfig sysConfig = sysConfigMapper.selectConfig(config);
|
List<String> whitelistIps = Arrays.asList(sysConfig.getConfigValue().split(","));
|
for (String whitelist : whitelistIps) {
|
if (isInRange(ip, whitelist)) {
|
return true;
|
}
|
}
|
} catch (Exception e) {
|
return false;
|
}
|
return false;
|
}
|
|
/**
|
* 智能验证IP是否在指定的模式内
|
* 支持：CIDR格式、通配符格式、单个IP
|
*/
|
public boolean isInRange(String ip, String pattern) {
|
if (pattern == null || ip == null) {
|
return false;
|
}
|
|
// 1. 如果是CIDR格式（包含/）
|
if (pattern.contains("/")) {
|
try {
|
SubnetUtils utils = new SubnetUtils(pattern);
|
return utils.getInfo().isInRange(ip);
|
} catch (IllegalArgumentException e) {
|
return false;
|
}
|
}
|
|
// 2. 如果是通配符格式（包含*）
|
if (pattern.contains("*")) {
|
return matchesWildcardPattern(ip, pattern);
|
}
|
|
// 3. 如果是单个IP地址
|
if (isValidIp(pattern)) {
|
return ip.equals(pattern);
|
}
|
|
return false;
|
}
|
|
/**
|
* 通配符模式匹配
|
*/
|
private boolean matchesWildcardPattern(String ip, String wildcardPattern) {
|
// 将通配符转换为正则表达式
|
String regex = wildcardPattern.replace(".", "\\.").replace("*", "\\d+");
|
|
return Pattern.matches(regex, ip);
|
}
|
|
/**
|
* 验证是否为合法IP地址
|
*/
|
private boolean isValidIp(String ip) {
|
return Pattern.matches("^\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}$", ip);
|
}
|
}
|
