【第14章】Spring Cloud之Gateway路由断言(IP黑名单)

---

前言

Spring Cloud Gateway可以让我们根据请求内容精确匹配到对应路由服务,官方已经内置了很多路由断言,我们也可以根据需求自己定义,RemoteAddrRoutePredicateFactory就像是根据IP去匹配的白名单,接下来我们根据它来自定义一个IP黑名单。

---

一、内置路由断言

1. 案例（Weight）

spring:cloud:gateway:routes:- id: weight_highuri: https://weighthigh.orgpredicates:- Weight=group1, 8- id: weight_lowuri: https://weightlow.orgpredicates:- Weight=group1, 2

这条路线将把约80%的流量转发到weighthigh.org，约20%的流量转发给weighlow.org

2. 更多断言

序号	断言类型	用法	描述
1	After	- After=2017-01-20T17:42:47.789-07:00[America/Denver]	此路由与2017年1月20日17:42:47之后的任何请求相匹配。
2	Before	- Before=2017-01-20T17:42:47.789-07:00[America/Denver]	此路由与2017年1月20日17:42:47之前的任何请求相匹配。
3	Between	- Between=2017-01-20T17:42:47.789-07:00[America/Denver], 2017-01-21T17:42:47.789-07:00[America/Denver]	此路由与2017年1月20日17:42:47之后至2017年1月21日17:42:47之前提出的任何请求相匹配。
4	Cookie	- Cookie=chocolate, ch.p	此路由匹配名为chocolate的cookie的请求，该cookie的值与ch.p匹配。
5	Header	- Header=X-Request-Id, \d+	此路由匹配请求有一个名为X-request-Id的请求头，其值与\d+正则表达式匹配（即它有一个或多个数字的值）。
6	Host	- Host=.somehost.org,.anotherhost.org	此路由匹配请求的Host值为www.somehost.org、beta.somehost.org或www.anotherhost.org。
7	Method	- Method=GET,POST	此路由匹配请求方法是GET或POST。
8	Path	- Path=/red/{segment},/blue/{segment}	此路由匹配请求路径为：/red/1 或 /red/1/ 或 /red/blue 或/blue/green。
9	Query	- Query=green	- Query=green - Query=red, gree.
10	RemoteAddr	- RemoteAddr=192.168.1.1/24	如果请求的远程地址是192.168.1.10，则此路由匹配。
11	XForwarded Remote Addr	- XForwardedRemoteAddr=192.168.1.1/24	如果X-Forwarded-For标头包含例如192.168.1.10，则此路由匹配。

二、自定义路由断言

1. 黑名单断言

package org.example.gateway.predicate;import io.netty.handler.ipfilter.IpFilterRuleType;
import io.netty.handler.ipfilter.IpSubnetFilterRule;
import jakarta.validation.constraints.NotEmpty;
import jakarta.validation.constraints.NotNull;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.cloud.gateway.handler.predicate.AbstractRoutePredicateFactory;
import org.springframework.cloud.gateway.handler.predicate.GatewayPredicate;
import org.springframework.cloud.gateway.support.ipresolver.RemoteAddressResolver;
import org.springframework.stereotype.Component;
import org.springframework.validation.annotation.Validated;
import org.springframework.web.server.ServerWebExchange;
import java.net.InetSocketAddress;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.function.Predicate;
import static org.springframework.cloud.gateway.support.ShortcutConfigurable.ShortcutType.GATHER_LIST;/*** Create by zjg on 2024/7/29*/
@Component
public class BlackRemoteAddrRoutePredicateFactory  extends AbstractRoutePredicateFactory<BlackRemoteAddrRoutePredicateFactory.Config> {private static final Log log = LogFactory.getLog(BlackRemoteAddrRoutePredicateFactory.class);public BlackRemoteAddrRoutePredicateFactory() {super(BlackRemoteAddrRoutePredicateFactory.Config.class);}@Overridepublic ShortcutType shortcutType() {return GATHER_LIST;}@Overridepublic List<String> shortcutFieldOrder() {return Collections.singletonList("sources");}@NotNullprivate List<IpSubnetFilterRule> convert(List<String> values) {List<IpSubnetFilterRule> sources = new ArrayList<>();for (String arg : values) {addSource(sources, arg);}return sources;}@Overridepublic Predicate<ServerWebExchange> apply(BlackRemoteAddrRoutePredicateFactory.Config config) {List<IpSubnetFilterRule> sources = convert(config.sources);return new GatewayPredicate() {@Overridepublic boolean test(ServerWebExchange exchange) {InetSocketAddress remoteAddress = config.remoteAddressResolver.resolve(exchange);if (remoteAddress != null && remoteAddress.getAddress() != null) {String hostAddress = remoteAddress.getAddress().getHostAddress();String host = exchange.getRequest().getURI().getHost();if (log.isDebugEnabled() && !hostAddress.equals(host)) {log.debug("Black remote addresses didn't match " + hostAddress + " != " + host);}for (IpSubnetFilterRule source : sources) {if (source.matches(remoteAddress)) {exchange.getAttributes().put("BlackRemoteAddrRoutePredicateFactory",remoteAddress.getAddress().getHostAddress());return false;//能匹配到则在黑名单中,不再执行}}}return true;}@Overridepublic Object getConfig() {return config;}@Overridepublic String toString() {return String.format("BlackRemoteAddrs: %s", config.getSources());}};}private void addSource(List<IpSubnetFilterRule> sources, String source) {if (!source.contains("/")) { // no netmask, add defaultsource = source + "/32";}String[] ipAddressCidrPrefix = source.split("/", 2);String ipAddress = ipAddressCidrPrefix[0];int cidrPrefix = Integer.parseInt(ipAddressCidrPrefix[1]);sources.add(new IpSubnetFilterRule(ipAddress, cidrPrefix, IpFilterRuleType.ACCEPT));}@Validatedpublic static class Config {@NotEmptyprivate List<String> sources = new ArrayList<>();@NotNullprivate RemoteAddressResolver remoteAddressResolver = new RemoteAddressResolver() {};public List<String> getSources() {return sources;}public BlackRemoteAddrRoutePredicateFactory.Config setSources(List<String> sources) {this.sources = sources;return this;}public BlackRemoteAddrRoutePredicateFactory.Config setSources(String... sources) {this.sources = Arrays.asList(sources);return this;}public BlackRemoteAddrRoutePredicateFactory.Config setRemoteAddressResolver(RemoteAddressResolver remoteAddressResolver) {this.remoteAddressResolver = remoteAddressResolver;return this;}}
}

2. 全局异常处理

package org.example.gateway.config;import org.example.common.model.Result;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.cloud.gateway.support.NotFoundException;
import org.springframework.http.HttpStatus;
import org.springframework.http.HttpStatusCode;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.util.StringUtils;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RestControllerAdvice;
import org.springframework.web.reactive.resource.NoResourceFoundException;
import org.springframework.web.server.ServerWebExchange;
import java.io.PrintWriter;
import java.io.StringWriter;/*** Create by zjg on 2024/7/29*/
@RestControllerAdvice
public class GlobalExceptionHandler {Logger logger = LoggerFactory.getLogger(GlobalExceptionHandler.class);@ExceptionHandler(NoResourceFoundException.class)//无可用路由public Result exception(ServerWebExchange exchange, NoResourceFoundException ex){String detail = ex.getBody().getDetail();String mark="resource ";String message = detail.substring(detail.indexOf(mark) + mark.length());setStatusCode(exchange.getResponse(),ex.getStatusCode());if(StringUtils.hasText(exchange.getAttribute("BlackRemoteAddrRoutePredicateFactory"))){//IP黑名单return  Result.error(ex.getStatusCode().value(),"拒绝访问","您的IP已被添加到黑名单中,拒绝访问!");}return  Result.error(ex.getStatusCode().value(),"无可用路由",String.format("没有可用的路由[%s]",message));}@ExceptionHandler(NotFoundException.class)//无可用服务public Result exception(ServerHttpResponse response,NotFoundException ex){logger.error(ex.getMessage());String detail = ex.getBody().getDetail();String mark="for ";String message = detail.substring(detail.indexOf(mark) + mark.length());setStatusCode(response,ex.getStatusCode());return  Result.error(ex.getStatusCode().value(),"服务不可用",String.format("没有可用的服务实例[%s]",message));}@ExceptionHandler(Exception.class)//异常保底public Result exception(ServerHttpResponse response,Exception exception){StringWriter stringWriter = new StringWriter();PrintWriter writer=new PrintWriter(stringWriter);exception.printStackTrace(writer);logger.error(stringWriter.toString());setStatusCode(response,HttpStatus.INTERNAL_SERVER_ERROR);return  Result.error(HttpStatus.INTERNAL_SERVER_ERROR.value(),exception.getMessage());}private void setStatusCode(ServerHttpResponse response,HttpStatusCode httpStatusCode){response.setStatusCode(httpStatusCode);}
}

3. 应用配置

spring:cloud:gateway:routes:- id: provider-serviceuri: lb://provider-servicepredicates:- Path=/provider/**- BlackRemoteAddr=192.168.1.1/24,127.0.0.1

4. 单元测试

curl 192.168.0.104:8888/provider/hello

正常访问

黑名单访问

---

总结

回到顶部

这样我们就能通过断言配置黑名单，可以针对固定IP做灵活处理。