增加白名单配置

chsm-common/src/main/java/com/sunyard/chsm/config/IpFilter.java

@@ -0,0 +1,85 @@
+package com.sunyard.chsm.config;
+
+
+import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
+import com.sunyard.chsm.constant.ParamConfKeyConstant;
+import com.sunyard.chsm.enums.EnableStatus;
+import com.sunyard.chsm.mapper.IpWhitelisttMapper;
+import com.sunyard.chsm.mapper.ParamConfMapper;
+import com.sunyard.chsm.model.entity.IpWhitelist;
+import com.sunyard.chsm.model.entity.ParamConf;
+import com.sunyard.chsm.utils.IpUtils;
+import lombok.extern.slf4j.Slf4j;
+import org.springframework.boot.ApplicationArguments;
+import org.springframework.boot.ApplicationRunner;
+import org.springframework.http.MediaType;
+import org.springframework.stereotype.Component;
+import org.springframework.util.CollectionUtils;
+import org.springframework.web.filter.OncePerRequestFilter;
+
+import javax.annotation.Resource;
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Objects;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+/**
+ * @author liulu
+ * @since 2024/12/2
+ */
+@Slf4j
+@Component
+public class IpFilter extends OncePerRequestFilter implements ApplicationRunner {
+
+    public static List<String> whiteIps = new ArrayList<>();
+
+    @Resource
+    private IpWhitelisttMapper ipWhitelisttMapper;
+    @Resource
+    private ParamConfMapper paramConfMapper;
+    private Boolean enableWhiteIp = false;
+
+
+    @Override
+    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
+        String ip = IpUtils.getIpAddress(request);
+        if (!enableWhiteIp || CollectionUtils.isEmpty(whiteIps) || whiteIps.contains(ip)) {
+            chain.doFilter(request, response);
+            return;
+        }
+        response.setStatus(HttpServletResponse.SC_FORBIDDEN);
+        response.setContentType(MediaType.TEXT_PLAIN_VALUE);
+        response.getWriter().println("此ip禁止访问");
+        response.getWriter().flush();
+    }
+
+
+    @Override
+    public void run(ApplicationArguments args) throws Exception {
+        Executors.newSingleThreadScheduledExecutor()
+                .scheduleWithFixedDelay(() -> {
+
+                    ParamConf conf = paramConfMapper.selectByKey(ParamConfKeyConstant.IP_WHITELIST_SWITCH);
+                    if (conf != null) {
+                        enableWhiteIp = Objects.equals("true", conf.getValue());
+                    }
+                    if (enableWhiteIp) {
+                        List<IpWhitelist> list = ipWhitelisttMapper.selectList(
+                                new LambdaQueryWrapper<IpWhitelist>()
+                                        .eq(IpWhitelist::getScope, "global")
+                                        .eq(IpWhitelist::getStatus, EnableStatus.ENABLED.getCode())
+                        );
+                        whiteIps = list.stream().map(IpWhitelist::getIp).collect(Collectors.toList());
+                    }
+                }, 0L, 5L, TimeUnit.MINUTES);
+    }
+
+
+}

chsm-common/src/main/java/com/sunyard/chsm/constant/ParamConfKeyConstant.java

@@ -1,4 +1,4 @@
-package com.sunyard.ssp.common.constant;
+package com.sunyard.chsm.constant;
 
 /**
  * @author:fyc

chsm-common/src/main/java/com/sunyard/chsm/mapper/ParamConfMapper.java

@@ -1,7 +1,7 @@
-package com.sunyard.ssp.modules.sysconf.paramconf.mapper;
+package com.sunyard.chsm.mapper;
 
 import com.baomidou.mybatisplus.core.mapper.BaseMapper;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
+import com.sunyard.chsm.model.entity.ParamConf;
 import org.apache.ibatis.annotations.Param;
 import org.apache.ibatis.annotations.Select;
 import org.springframework.stereotype.Repository;

chsm-common/src/main/java/com/sunyard/chsm/model/entity/ParamConf.java

@@ -1,10 +1,8 @@
-package com.sunyard.ssp.modules.sysconf.paramconf.entity;
+package com.sunyard.chsm.model.entity;
 
 import com.baomidou.mybatisplus.annotation.TableField;
 import com.baomidou.mybatisplus.annotation.TableId;
 import com.baomidou.mybatisplus.annotation.TableName;
-import io.swagger.annotations.ApiModel;
-import io.swagger.annotations.ApiModelProperty;
 import lombok.Data;
 import lombok.EqualsAndHashCode;
 import lombok.experimental.Accessors;
@@ -24,41 +22,32 @@ import java.time.LocalDateTime;
 @EqualsAndHashCode(callSuper = false)
 @Accessors(chain = true)
 @TableName("SC_PARAM_CONF")
-@ApiModel(value="", description="")
 public class ParamConf implements Serializable {
 
     private static final long serialVersionUID = 1L;
 
-    @ApiModelProperty(value = "主键")
     @TableId("ID")
     private Long id;
 
-    @ApiModelProperty(value = "数据大类")
     @TableField("ITEM")
     private Integer item;
 
-    @ApiModelProperty(value = "数据名称")
 //    @TableField("`KEY`") mysql需加
     @TableField("KEY")
     private String key;
 
-    @ApiModelProperty(value = "数据值")
     @TableField("VALUE")
     private String value;
 
-    @ApiModelProperty(value = "数据值类型")
     @TableField("TYPE")
     private String type;
 
-    @ApiModelProperty(value = "状态")
     @TableField("STATUS")
     private Integer status;
 
-    @ApiModelProperty(value = "创建时间")
     @TableField("CREATE_TIME")
     private LocalDateTime creatTime;
 
-    @ApiModelProperty(value = "备注")
     @TableField("MEMO")
     private String memo;
 

chsm-common/src/main/java/com/sunyard/chsm/utils/IpUtils.java

@@ -0,0 +1,52 @@
+package com.sunyard.chsm.utils;
+
+import org.springframework.util.ObjectUtils;
+import org.springframework.util.StringUtils;
+
+import javax.servlet.http.HttpServletRequest;
+
+public class IpUtils {
+
+
+    /**
+     * 获取真实ip地址，避免获取代理ip
+     */
+    public static String getIpAddress(HttpServletRequest request) {
+        if (request == null) {
+            return "unknown";
+        }
+        String ip = request.getHeader("x-forwarded-for");
+
+        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getHeader("Proxy-Client-IP");
+        }
+        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getHeader("X-Forwarded-For");
+            if (StringUtils.hasText(ip) && !"unknown".equalsIgnoreCase(ip)) {
+                // 多次反向代理后会有多个IP值，第一个为真实IP。
+                int index = ip.indexOf(',');
+                if (index != -1) {
+                    ip =  ip.substring(0, index);
+                }
+            }
+        }
+        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getHeader("WL-Proxy-Client-IP");
+        }
+        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getHeader("X-Real-IP");
+        }
+        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
+            ip = request.getRemoteAddr();
+        }
+        if("0:0:0:0:0:0:0:1".equals(ip)){
+            return "127.0.0.1";
+        }else {
+            if(ip.equals("127.0.0.1") || ip.equalsIgnoreCase("localhost") && ObjectUtils.isEmpty(request.getRemoteAddr())){
+                ip = request.getRemoteAddr();
+            }
+        }
+        return ip;
+    }
+
+}

chsm-web-manage/src/main/java/com/sunyard/chsm/service/impl/DeviceServiceImpl.java

@@ -8,14 +8,14 @@ import com.sunyard.chsm.dto.DeviceDTO;
 import com.sunyard.chsm.dto.TmkStatus;
 import com.sunyard.chsm.enums.ManufacturerEnum;
 import com.sunyard.chsm.enums.ManufacturerModelEnum;
+import com.sunyard.chsm.mapper.ParamConfMapper;
 import com.sunyard.chsm.mapper.SpDeviceMapper;
 import com.sunyard.chsm.mapper.TmkInfoMapper;
 import com.sunyard.chsm.model.entity.Device;
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.chsm.model.entity.TmkInfo;
 import com.sunyard.chsm.sdf.adapter.BcSdfApiAdaptor;
 import com.sunyard.chsm.service.DeviceService;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
-import com.sunyard.ssp.modules.sysconf.paramconf.mapper.ParamConfMapper;
 import lombok.extern.slf4j.Slf4j;
 import org.bouncycastle.util.encoders.Hex;
 import org.springframework.beans.BeanUtils;

chsm-web-manage/src/main/java/com/sunyard/chsm/service/impl/IpWhitelistServiceImpl.java

@@ -4,6 +4,7 @@ import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
 import com.baomidou.mybatisplus.core.metadata.IPage;
 import com.baomidou.mybatisplus.core.toolkit.IdWorker;
 import com.baomidou.mybatisplus.extension.plugins.pagination.Page;
+import com.sunyard.chsm.config.IpFilter;
 import com.sunyard.chsm.dto.IpWhitelistDTO;
 import com.sunyard.chsm.enums.EnableStatus;
 import com.sunyard.chsm.mapper.IpWhitelisttMapper;
@@ -103,6 +104,7 @@ public class IpWhitelistServiceImpl implements IpWhitelistService {
         whitelist.setRemark(save.getMemo());
 
         ipWhitelisttMapper.insert(whitelist);
+        IpFilter.whiteIps.add(save.getIpAddress());
 
         return whitelist.getId();
     }
@@ -129,6 +131,13 @@ public class IpWhitelistServiceImpl implements IpWhitelistService {
         whitelist.setStatus(update.getStatus() == 0 ? EnableStatus.ENABLED.getCode() : EnableStatus.DISABLED.getCode());
         whitelist.setUpdateTime(LocalDateTime.now());
         whitelist.setRemark(update.getMemo());
+        if (!Objects.equals(exist.getStatus(), whitelist.getStatus())) {
+            if (EnableStatus.ENABLED.getCode().equals(whitelist.getStatus())) {
+                IpFilter.whiteIps.add(update.getIpAddress());
+            } else {
+                IpFilter.whiteIps.remove(update.getIpAddress());
+            }
+        }
 
         ipWhitelisttMapper.updateById(whitelist);
     }
@@ -136,7 +145,11 @@ public class IpWhitelistServiceImpl implements IpWhitelistService {
     @Override
     public void delete(Long[] ids) {
         for (Long id : ids) {
+            IpWhitelist whitelist = ipWhitelisttMapper.selectById(id);
+            if (whitelist != null) {
                 ipWhitelisttMapper.deleteById(id);
+                IpFilter.whiteIps.remove(whitelist.getIp());
+            }
         }
     }
 }

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/monitor/log/aspect/AuditLogAspect.java

@@ -5,12 +5,12 @@ import com.alibaba.fastjson.JSONObject;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.sunyard.chsm.model.R;
+import com.sunyard.chsm.utils.IpUtils;
 import com.sunyard.ssp.common.Result;
 import com.sunyard.ssp.common.annotation.AuditControllerLog;
 import com.sunyard.ssp.modules.monitor.log.entity.AuditLog;
 import com.sunyard.ssp.modules.monitor.log.service.IAuditLogService;
 import com.sunyard.ssp.modules.user.entity.ScUser;
-import com.sunyard.ssp.utils.IpUtil;
 import com.sunyard.ssp.utils.SecurityUtil;
 import com.sunyard.ssp.utils.ThreadPoolUtil;
 import lombok.extern.slf4j.Slf4j;
@@ -119,7 +119,7 @@ public class AuditLogAspect {
             }
 
             //Ip信息
-            auditLog.setIpAddress(IpUtil.getIpAddress(request));
+            auditLog.setIpAddress(IpUtils.getIpAddress(request));
             auditLog.setIpInfo("未知");
 
             //请求相关

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/sysconf/cipherunit/controller/ScCipherMachineController.java

@@ -2,6 +2,7 @@ package com.sunyard.ssp.modules.sysconf.cipherunit.controller;
 
 import com.sun.jna.Pointer;
 import com.sun.jna.ptr.PointerByReference;
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.ssp.common.Result;
 import com.sunyard.ssp.common.annotation.AuditControllerLog;
 import com.sunyard.ssp.common.exception.SspwebException;
@@ -11,7 +12,6 @@ import com.sunyard.ssp.modules.sysconf.cipherunit.entity.ScCipherMachineVo;
 import com.sunyard.ssp.modules.sysconf.cipherunit.enums.RetEnum;
 import com.sunyard.ssp.modules.sysconf.cipherunit.service.ScCipherMachineService;
 import com.sunyard.ssp.modules.sysconf.cipherunit.utils.IniFileUpdater;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
 import com.sunyard.ssp.modules.sysconf.paramconf.service.IParamConfService;
 import com.sunyard.ssp.utils.ResultUtil;
 import io.swagger.annotations.Api;

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/sysconf/cipherunit/controller/StatusController.java

@@ -1,7 +1,7 @@
 package com.sunyard.ssp.modules.sysconf.cipherunit.controller;
 
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.ssp.common.Result;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
 import com.sunyard.ssp.modules.sysconf.paramconf.service.IParamConfService;
 import com.sunyard.ssp.utils.ResultUtil;
 import io.swagger.annotations.Api;

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/sysconf/paramconf/controller/ParamConfController.java

@@ -1,9 +1,9 @@
 package com.sunyard.ssp.modules.sysconf.paramconf.controller;
 
 
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.ssp.common.Result;
 import com.sunyard.ssp.common.annotation.AuditControllerLog;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
 import com.sunyard.ssp.modules.sysconf.paramconf.service.IParamConfService;
 import com.sunyard.ssp.utils.ResultUtil;
 import io.swagger.annotations.Api;

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/sysconf/paramconf/service/IParamConfService.java

@@ -1,7 +1,7 @@
 package com.sunyard.ssp.modules.sysconf.paramconf.service;
 
 import com.baomidou.mybatisplus.extension.service.IService;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
+import com.sunyard.chsm.model.entity.ParamConf;
 
 import java.util.Map;
 

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/sysconf/paramconf/serviceimpl/ParamConfServiceImpl.java

@@ -2,8 +2,8 @@ package com.sunyard.ssp.modules.sysconf.paramconf.serviceimpl;
 
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
+import com.sunyard.chsm.mapper.ParamConfMapper;
-import com.sunyard.ssp.modules.sysconf.paramconf.mapper.ParamConfMapper;
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.ssp.modules.sysconf.paramconf.service.IParamConfService;
 import com.sunyard.ssp.modules.user.entity.ScPermission;
 import com.sunyard.ssp.modules.user.service.IScPermissionService;
@@ -21,13 +21,13 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.APPROVAL_TRUE;
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.AUTHORITY_APPROVAL_PARAM_ITEM;
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.ENCRYPTION_MACHINE_APPROVAL;
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.IP_WHITELIST_ITEM;
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.IP_WHITELIST_SWITCH;
 import static com.sunyard.ssp.common.constant.CommonConstant.STATUS_DISABLE;
 import static com.sunyard.ssp.common.constant.CommonConstant.STATUS_NORMAL;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.APPROVAL_TRUE;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.AUTHORITY_APPROVAL_PARAM_ITEM;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.ENCRYPTION_MACHINE_APPROVAL;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.IP_WHITELIST_ITEM;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.IP_WHITELIST_SWITCH;
 
 /**
  * <p>

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/user/controller/ScUShieldController.java

@@ -5,6 +5,7 @@ import cn.hutool.core.collection.CollectionUtil;
 import cn.hutool.core.util.StrUtil;
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.fasterxml.jackson.core.JsonProcessingException;
+import com.sunyard.chsm.utils.IpUtils;
 import com.sunyard.chsm.utils.JsonUtils;
 import com.sunyard.ssp.common.Result;
 import com.sunyard.ssp.constv.Alg;
@@ -19,7 +20,6 @@ import com.sunyard.ssp.modules.user.entity.UkeyLoginParm;
 import com.sunyard.ssp.modules.user.service.IScUserRoleService;
 import com.sunyard.ssp.modules.user.service.IScUserService;
 import com.sunyard.ssp.util.BytesUtil;
-import com.sunyard.ssp.utils.IpUtil;
 import com.sunyard.ssp.utils.ResultUtil;
 import com.sunyard.ssp.utils.SecurityUtil;
 import com.sunyard.ssp.utils.UserUtil;
@@ -114,7 +114,7 @@ public class ScUShieldController {
         }
         auditLog.setRequestParam(JsonUtils.toJsonString(list));
         //Ip信息
-        auditLog.setIpAddress(IpUtil.getIpAddress(request));
+        auditLog.setIpAddress(IpUtils.getIpAddress(request));
         auditLog.setIpInfo("未知");
 
         //请求相关

chsm-web-manage/src/main/java/com/sunyard/ssp/modules/user/serviceimpl/ScPermissionServiceImpl.java

@@ -2,9 +2,9 @@ package com.sunyard.ssp.modules.user.serviceimpl;
 
 import com.baomidou.mybatisplus.core.conditions.query.QueryWrapper;
 import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
-import com.sunyard.ssp.common.constant.ParamConfKeyConstant;
+import com.sunyard.chsm.constant.ParamConfKeyConstant;
-import com.sunyard.ssp.modules.sysconf.paramconf.entity.ParamConf;
+import com.sunyard.chsm.mapper.ParamConfMapper;
-import com.sunyard.ssp.modules.sysconf.paramconf.mapper.ParamConfMapper;
+import com.sunyard.chsm.model.entity.ParamConf;
 import com.sunyard.ssp.modules.user.entity.ScPermission;
 import com.sunyard.ssp.modules.user.mapper.ScPermissionMapper;
 import com.sunyard.ssp.modules.user.service.IScPermissionService;
@@ -17,8 +17,8 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 
+import static com.sunyard.chsm.constant.ParamConfKeyConstant.SYS_DEBUG_SWITCH;
 import static com.sunyard.ssp.common.constant.CommonConstant.DEFAULT_USER_ROOT_ID;
-import static com.sunyard.ssp.common.constant.ParamConfKeyConstant.SYS_DEBUG_SWITCH;
 
 /**
  * <p>

chsm-web-manage/src/main/java/com/sunyard/ssp/utils/IpUtil.java

@@ -1,46 +0,0 @@
-package com.sunyard.ssp.utils;
-
-import javax.servlet.http.HttpServletRequest;
-import java.net.InetAddress;
-import java.net.UnknownHostException;
-
-public class IpUtil {
-
-
-    /**
-     * 获取真实ip地址，避免获取代理ip
-     */
-    public static String getIpAddress(HttpServletRequest request) {
-        String ip = request.getHeader("x-forwarded-for");
-        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
-            ip = request.getHeader("Proxy-Client-IP");
-        }
-        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
-            ip = request.getHeader("WL-Proxy-Client-IP");
-        }
-        if (ip == null || ip.length() == 0 || "unknown".equalsIgnoreCase(ip)) {
-            ip = request.getRemoteAddr();
-            if ("127.0.0.1".equals(ip)) {
-                //根据网卡取本机配置的IP
-                InetAddress inet = null;
-                try {
-                    inet = InetAddress.getLocalHost();
-                } catch (UnknownHostException e) {
-                    e.printStackTrace();
-                }
-                ip = inet.getHostAddress();
-            }
-        }
-
-        if (ip != null && ip.length() > 15) {
-            if (ip.indexOf(",") > 0) {
-                ip = ip.substring(0, ip.indexOf(","));
-            }
-        }
-        if("0:0:0:0:0:0:0:1".equals(ip)){
-            ip="127.0.0.1";
-        }
-        return ip;
-    }
-
-}