67 lines
1.8 KiB
Go
67 lines
1.8 KiB
Go
|
package middleware
|
||
|
|
|
||
|
|
import (
|
||
|
|
"net/http"
|
||
|
|
"time"
|
||
|
|
|
||
|
|
securityEntities "hyapi-server/internal/domains/security/entities"
|
||
|
|
securityServices "hyapi-server/internal/domains/security/services"
|
||
|
|
"hyapi-server/internal/shared/interfaces"
|
||
|
|
|
||
|
|
"github.com/gin-gonic/gin"
|
||
|
|
"go.uber.org/zap"
|
||
|
|
)
|
||
|
|
|
||
|
|
// ManagedIPBlacklistMiddleware 管理端维护的 IP 黑名单拦截
|
||
|
|
type ManagedIPBlacklistMiddleware struct {
|
||
|
|
blacklist *securityServices.BlacklistService
|
||
|
|
response interfaces.ResponseBuilder
|
||
|
|
logger *zap.Logger
|
||
|
|
}
|
||
|
|
|
||
|
|
func NewManagedIPBlacklistMiddleware(
|
||
|
|
blacklist *securityServices.BlacklistService,
|
||
|
|
response interfaces.ResponseBuilder,
|
||
|
|
logger *zap.Logger,
|
||
|
|
) *ManagedIPBlacklistMiddleware {
|
||
|
|
return &ManagedIPBlacklistMiddleware{
|
||
|
|
blacklist: blacklist,
|
||
|
|
response: response,
|
||
|
|
logger: logger,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
func (m *ManagedIPBlacklistMiddleware) GetName() string { return "managed_ip_blacklist" }
|
||
|
|
func (m *ManagedIPBlacklistMiddleware) GetPriority() int { return 25 }
|
||
|
|
func (m *ManagedIPBlacklistMiddleware) IsGlobal() bool { return true }
|
||
|
|
|
||
|
|
func (m *ManagedIPBlacklistMiddleware) Handle() gin.HandlerFunc {
|
||
|
|
return func(c *gin.Context) {
|
||
|
|
ip := c.ClientIP()
|
||
|
|
blocked, entry := m.blacklist.IsIPBlocked(c.Request.Context(), ip)
|
||
|
|
if !blocked {
|
||
|
|
c.Next()
|
||
|
|
return
|
||
|
|
}
|
||
|
|
reason := "IP在黑名单中"
|
||
|
|
if entry != nil && entry.Reason != "" {
|
||
|
|
reason = entry.Reason
|
||
|
|
}
|
||
|
|
m.blacklist.RecordHit(&securityEntities.BlacklistHitRecord{
|
||
|
|
HitType: securityEntities.HitTypeIP,
|
||
|
|
IP: ip,
|
||
|
|
Path: c.Request.URL.Path,
|
||
|
|
Method: c.Request.Method,
|
||
|
|
Reason: reason,
|
||
|
|
UserAgent: c.GetHeader("User-Agent"),
|
||
|
|
})
|
||
|
|
c.AbortWithStatusJSON(http.StatusForbidden, gin.H{
|
||
|
|
"success": false,
|
||
|
|
"message": "访问被拒绝",
|
||
|
|
"error": "该IP已被列入黑名单",
|
||
|
|
"request_id": c.GetString("request_id"),
|
||
|
|
"timestamp": time.Now().Unix(),
|
||
|
|
})
|
||
|
|
}
|
||
|
|
}
|