From ef0a29552e1e633df74d349eefb67c328126e1fb Mon Sep 17 00:00:00 2001 From: RuoYi Date: Mon, 20 Feb 2023 12:54:02 +0800 Subject: [PATCH] =?UTF-8?q?=E6=94=AF=E6=8C=81=E7=99=BB=E5=BD=95IP=E9=BB=91?= =?UTF-8?q?=E5=90=8D=E5=8D=95=E9=99=90=E5=88=B6?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../resources/static/i18n/messages.properties | 1 + .../monitor/logininfor/logininfor.html | 5 +- .../exception/user/BlackListException.java | 16 +++ .../java/com/ruoyi/common/utils/IpUtils.java | 109 +++++++++++++++++- .../com/ruoyi/common/utils/ShiroUtils.java | 2 +- .../shiro/service/SysLoginService.java | 14 +++ sql/{ry_20230216.sql => ry_20230220.sql} | 1 + 7 files changed, 145 insertions(+), 3 deletions(-) create mode 100644 ruoyi-common/src/main/java/com/ruoyi/common/exception/user/BlackListException.java rename sql/{ry_20230216.sql => ry_20230220.sql} (99%) diff --git a/ruoyi-admin/src/main/resources/static/i18n/messages.properties b/ruoyi-admin/src/main/resources/static/i18n/messages.properties index 5e03cdf03..02cb2fda6 100644 --- a/ruoyi-admin/src/main/resources/static/i18n/messages.properties +++ b/ruoyi-admin/src/main/resources/static/i18n/messages.properties @@ -8,6 +8,7 @@ user.password.retry.limit.exceed=密码输入错误{0}次，帐户锁定10分钟 user.password.delete=对不起，您的账号已被删除 user.blocked=用户已封禁，请联系管理员 role.blocked=角色已封禁，请联系管理员 +login.blocked=很遗憾，访问IP已被列入系统黑名单 user.logout.success=退出成功 length.not.valid=长度必须在{min}到{max}个字符之间 diff --git a/ruoyi-admin/src/main/resources/templates/monitor/logininfor/logininfor.html b/ruoyi-admin/src/main/resources/templates/monitor/logininfor/logininfor.html index 5e5b0a4c6..549b8db48 100644 --- a/ruoyi-admin/src/main/resources/templates/monitor/logininfor/logininfor.html +++ b/ruoyi-admin/src/main/resources/templates/monitor/logininfor/logininfor.html @@ -90,7 +90,10 @@ }, { field: 'ipaddr', - title: '登录地址' + title: '登录地址', + formatter: function(value, row, index) { + return $.table.tooltip(value); + } }, { field: 'loginLocation', diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/exception/user/BlackListException.java b/ruoyi-common/src/main/java/com/ruoyi/common/exception/user/BlackListException.java new file mode 100644 index 000000000..2bf503865 --- /dev/null +++ b/ruoyi-common/src/main/java/com/ruoyi/common/exception/user/BlackListException.java @@ -0,0 +1,16 @@ +package com.ruoyi.common.exception.user; + +/** + * 黑名单IP异常类 + * + * @author ruoyi + */ +public class BlackListException extends UserException +{ + private static final long serialVersionUID = 1L; + + public BlackListException() + { + super("login.blocked", null); + } +} diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/IpUtils.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/IpUtils.java index 5b3baa002..a8c282d91 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/IpUtils.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/IpUtils.java @@ -11,6 +11,13 @@ import javax.servlet.http.HttpServletRequest; */ public class IpUtils { + public final static String REGX_0_255 = "(25[0-5]|2[0-4]\\d|1\\d{2}|[1-9]\\d|\\d)"; + // 匹配 ip + public final static String REGX_IP = "((" + REGX_0_255 + "\\.){3}" + REGX_0_255 + ")"; + public final static String REGX_IP_WILDCARD = "(((\\*\\.){3}\\*)|(" + REGX_0_255 + "(\\.\\*){3})|(" + REGX_0_255 + "\\." + REGX_0_255 + ")(\\.\\*){2}" + "|((" + REGX_0_255 + "\\.){3}\\*))"; + // 匹配网段 + public final static String REGX_IP_SEG = "(" + REGX_IP + "\\-" + REGX_IP + ")"; + /** * 获取客户端IP * @@ -247,7 +254,7 @@ public class IpUtils } } } - return ip; + return StringUtils.substring(ip, 0, 255); } /** @@ -260,4 +267,104 @@ public class IpUtils { return StringUtils.isBlank(checkString) || "unknown".equalsIgnoreCase(checkString); } + + /** + * 是否为IP + */ + public static boolean isIP(String ip) + { + return StringUtils.isNotBlank(ip) && ip.matches(REGX_IP); + } + + /** + * 是否为IP，或 *为间隔的通配符地址 + */ + public static boolean isIpWildCard(String ip) + { + return StringUtils.isNotBlank(ip) && ip.matches(REGX_IP_WILDCARD); + } + + /** + * 检测参数是否在ip通配符里 + */ + public static boolean ipIsInWildCardNoCheck(String ipWildCard, String ip) + { + String[] s1 = ipWildCard.split("\\."); + String[] s2 = ip.split("\\."); + boolean isMatchedSeg = true; + for (int i = 0; i < s1.length && !s1[i].equals("*"); i++) + { + if (!s1[i].equals(s2[i])) + { + isMatchedSeg = false; + break; + } + } + return isMatchedSeg; + } + + /** + * 是否为特定格式如:“10.10.10.1-10.10.10.99”的ip段字符串 + */ + public static boolean isIPSegment(String ipSeg) + { + return StringUtils.isNotBlank(ipSeg) && ipSeg.matches(REGX_IP_SEG); + } + + /** + * 判断ip是否在指定网段中 + */ + public static boolean ipIsInNetNoCheck(String iparea, String ip) + { + int idx = iparea.indexOf('-'); + String[] sips = iparea.substring(0, idx).split("\\."); + String[] sipe = iparea.substring(idx + 1).split("\\."); + String[] sipt = ip.split("\\."); + long ips = 0L, ipe = 0L, ipt = 0L; + for (int i = 0; i < 4; ++i) + { + ips = ips << 8 | Integer.parseInt(sips[i]); + ipe = ipe << 8 | Integer.parseInt(sipe[i]); + ipt = ipt << 8 | Integer.parseInt(sipt[i]); + } + if (ips > ipe) + { + long t = ips; + ips = ipe; + ipe = t; + } + return ips <= ipt && ipt <= ipe; + } + + /** + * 校验ip是否符合过滤串规则 + * + * @param filter 过滤IP列表,支持后缀'*'通配,支持网段如:`10.10.10.1-10.10.10.99` + * @param ip 校验IP地址 + * @return boolean 结果 + */ + public static boolean isMatchedIp(String filter, String ip) + { + if (StringUtils.isEmpty(filter) && StringUtils.isEmpty(ip)) + { + return false; + } + String[] ips = filter.split(";"); + for (String iStr : ips) + { + if (isIP(iStr) && iStr.equals(ip)) + { + return true; + } + else if (isIpWildCard(iStr) && ipIsInWildCardNoCheck(iStr, ip)) + { + return true; + } + else if (isIPSegment(iStr) && ipIsInNetNoCheck(iStr, ip)) + { + return true; + } + } + return false; + } } \ No newline at end of file diff --git a/ruoyi-common/src/main/java/com/ruoyi/common/utils/ShiroUtils.java b/ruoyi-common/src/main/java/com/ruoyi/common/utils/ShiroUtils.java index f0c894322..1c7ab4ddb 100644 --- a/ruoyi-common/src/main/java/com/ruoyi/common/utils/ShiroUtils.java +++ b/ruoyi-common/src/main/java/com/ruoyi/common/utils/ShiroUtils.java @@ -65,7 +65,7 @@ public class ShiroUtils public static String getIp() { - return getSubject().getSession().getHost(); + return StringUtils.substring(getSubject().getSession().getHost(), 0, 128); } public static String getSessionId() diff --git a/ruoyi-framework/src/main/java/com/ruoyi/framework/shiro/service/SysLoginService.java b/ruoyi-framework/src/main/java/com/ruoyi/framework/shiro/service/SysLoginService.java index af1e2cdb6..ffcf9d71a 100644 --- a/ruoyi-framework/src/main/java/com/ruoyi/framework/shiro/service/SysLoginService.java +++ b/ruoyi-framework/src/main/java/com/ruoyi/framework/shiro/service/SysLoginService.java @@ -10,18 +10,21 @@ import com.ruoyi.common.constant.UserConstants; import com.ruoyi.common.core.domain.entity.SysRole; import com.ruoyi.common.core.domain.entity.SysUser; import com.ruoyi.common.enums.UserStatus; +import com.ruoyi.common.exception.user.BlackListException; import com.ruoyi.common.exception.user.CaptchaException; import com.ruoyi.common.exception.user.UserBlockedException; import com.ruoyi.common.exception.user.UserDeleteException; import com.ruoyi.common.exception.user.UserNotExistsException; import com.ruoyi.common.exception.user.UserPasswordNotMatchException; import com.ruoyi.common.utils.DateUtils; +import com.ruoyi.common.utils.IpUtils; import com.ruoyi.common.utils.MessageUtils; import com.ruoyi.common.utils.ServletUtils; import com.ruoyi.common.utils.ShiroUtils; import com.ruoyi.common.utils.StringUtils; import com.ruoyi.framework.manager.AsyncManager; import com.ruoyi.framework.manager.factory.AsyncFactory; +import com.ruoyi.system.service.ISysConfigService; import com.ruoyi.system.service.ISysMenuService; import com.ruoyi.system.service.ISysUserService; @@ -42,6 +45,9 @@ public class SysLoginService @Autowired private ISysMenuService menuService; + @Autowired + private ISysConfigService configService; + /** * 登录 */ @@ -75,6 +81,14 @@ public class SysLoginService throw new UserPasswordNotMatchException(); } + // IP黑名单校验 + String blackStr = configService.selectConfigByKey("sys.login.blackIPList"); + if (IpUtils.isMatchedIp(blackStr, ShiroUtils.getIp())) + { + AsyncManager.me().execute(AsyncFactory.recordLogininfor(username, Constants.LOGIN_FAIL, MessageUtils.message("login.blocked"))); + throw new BlackListException(); + } + // 查询用户信息 SysUser user = userService.selectUserByLoginName(username); diff --git a/sql/ry_20230216.sql b/sql/ry_20230220.sql similarity index 99% rename from sql/ry_20230216.sql rename to sql/ry_20230220.sql index e45ee65c8..237606d33 100644 --- a/sql/ry_20230216.sql +++ b/sql/ry_20230220.sql @@ -546,6 +546,7 @@ insert into sys_config values(7, '用户管理-账号密码更新周期', ' insert into sys_config values(8, '主框架页-菜单导航显示风格', 'sys.index.menuStyle', 'default', 'Y', 'admin', sysdate(), '', null, '菜单导航显示风格（default为左侧导航菜单，topnav为顶部导航菜单）'); insert into sys_config values(9, '主框架页-是否开启页脚', 'sys.index.footer', 'true', 'Y', 'admin', sysdate(), '', null, '是否开启底部页脚显示（true显示，false隐藏）'); insert into sys_config values(10, '主框架页-是否开启页签', 'sys.index.tagsView', 'true', 'Y', 'admin', sysdate(), '', null, '是否开启菜单多页签显示（true显示，false隐藏）'); +INSERT INTO sys_config VALUES(11, '用户登录-黑名单列表', 'sys.login.blackIPList', '', 'Y', 'admin', SYSDATE(), '', NULL, '设置登录IP黑名单限制，多个匹配项以;分隔，支持匹配（*通配、网段）'); -- ----------------------------