zuul简单实现ip黑白名单机制

超、凢脫俗 2022-12-20 15:55 152阅读 0赞

# 微服务--zuul简单实现ip黑白名单机制 #

网关zuul中简单的实现对访问ip的黑白名单机制，控制服务访问ip，一定程度上提高系统安全性。

--------------------

**目录**

微服务--zuul简单实现ip黑白名单机制

一、 从HttpServletRequest获取访问ip方法

二、继承ZuulFilter过滤器，重写run方法，实现

总结

--------------------

## 一、 从HttpServletRequest获取访问ip方法 ##

public static String getIpAddress(HttpServletRequest request) {
            String ip = request.getHeader("x-forwarded-for");
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("Proxy-Client-IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("WL-Proxy-Client-IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("HTTP_CLIENT_IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("HTTP_X_FORWARDED_FOR");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getRemoteAddr();
            }
            return ip;
        }

## 二、继承ZuulFilter过滤器，重写run方法，实现  ##

package com.ytkj.feec.filter;
    
    import com.alibaba.fastjson.JSON;
    import com.netflix.zuul.ZuulFilter;
    import com.netflix.zuul.context.RequestContext;
    import com.netflix.zuul.exception.ZuulException;
    import com.yuantiaokj.commonmodule.base.SysRes;
    import com.yuantiaokj.dao.manager.IpTblDao;
    import com.yuantiaokj.dict.paycentre_manager.DictIpStatus;
    import io.swagger.annotations.ApiOperation;
    import lombok.extern.slf4j.Slf4j;
    import org.springframework.stereotype.Component;
    import org.springframework.web.bind.annotation.PostMapping;
    import org.springframework.web.bind.annotation.RequestBody;
    import org.springframework.web.bind.annotation.RequestMapping;
    import org.springframework.web.bind.annotation.RestController;
    
    import javax.annotation.Resource;
    import javax.servlet.http.HttpServletRequest;
    import javax.validation.Valid;
    import java.io.IOException;
    import java.util.ArrayList;
    import java.util.List;
    
    /**
     * ***********************************************************
     * Copyright © 2019 Inc.All rights reserved.  *    *
     * **********************************************************
     *
     * @program: financial_eco-environment_cloud
     * @name: LoginFilter
     * @author: Mr.Cnzz
     * @create: 2019-12-11 15:27
     * @description: 登录认证过滤器
     **/
    @Component
    @Slf4j
    @RestController
    @RequestMapping("IpFilter")
    public class IpFilter extends ZuulFilter {
    
        @Resource
        private IpTblDao ipTblDao;
    
        //全局白名单ip List
        static List<String> whitelist = new ArrayList<>();
    
    
    //    自定义过虑器需要继承 ZuulFilter，ZuulFilter是一个抽象类，需要覆盖它的4个方法，如下：
    //    filterType：返回字符串代表过滤器的类型，返回值有：
    //          pre：在请求路由之前执行
    //          route：在请求路由时调用
    //          post：请求路由之后调用， 也就是在route和errror过滤器之后调用
    //          error：处理请求发生错误时调用
    //    filterOrder：此方法返回整型数值，通过此数值来定义过滤器的执行顺序，数字越小优先级越高。
    //    shouldFilter：返回Boolean值，判断该过滤器是否执行。返回true表示要执行此过虑器，false不执行。
    //    run：过滤器的业务逻辑。
    
    
        @Override
        public String filterType() {
    
            //请求路由前调用
            //log.info("请求路由前调用pre====");
            return "pre";
        }
    
        @Override
        public int filterOrder() {
    
            //int值来定义过滤器的执行顺序，数值越小优先级越高
            return 1;
        }
    
        @Override
        public boolean shouldFilter() {
    
            //该过滤器是否执行，true|执行，false不执行
            return true;
        }
    
        @Override
        public Object run() throws ZuulException {
            RequestContext context = RequestContext.getCurrentContext();
            HttpServletRequest request = context.getRequest();
    
            //ip 黑白名单机制
            String ip = getIpAddress(request);
            log.info("当前请求ip={}", ip);
            // 在黑名单中禁用
            //ip白名单
            whitelist.add("127.0.0.1");
            if (!whitelist.contains(ip)) {
                //非白名单
                context.set("isSuccess", false);
                context.setSendZuulResponse(false);
                context.setResponseBody(JSON.toJSONString(SysRes.failure("403", "老铁，你还不是白名单用户！ip=" + ip)));
                context.getResponse().setContentType("application/json; charset=utf-8");
                return null;
            }
    
            return null;
        }
    
    
        public static String getIpAddress(HttpServletRequest request) {
            String ip = request.getHeader("x-forwarded-for");
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("Proxy-Client-IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("WL-Proxy-Client-IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("HTTP_CLIENT_IP");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getHeader("HTTP_X_FORWARDED_FOR");
            }
            if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
                ip = request.getRemoteAddr();
            }
            return ip;
        }
    
        @ApiOperation("白名单生效")
        @PostMapping("/whiteIpEffect")
        public SysRes whiteIpEffect() {
            whitelist = ipTblDao.findIps(DictIpStatus.white_2.getIndex());
            log.info("白名单生效|whitelist={}", whitelist);
            return SysRes.success(whitelist);
        }
    
    }

--------------------

## 总结 ##

我这里是ip存储到库里，加了个后门刷新，也可以写个定时任务触发。