Gateway的RemoteAddr与RemoteAddressResolver源码分析

头未秃

已于 2023-11-03 09:18:53 修改

阅读量1k

点赞数 1

分类专栏：源码分析文章标签： gateway java spring

于 2023-03-17 17:18:55 首次发布

本文链接：https://blog.csdn.net/qq_42764269/article/details/129622134

版权

源码分析专栏收录该内容

1 篇文章 0 订阅

订阅专栏

1、RemoteAddr断言

1.1 源码解析

## RemoteAddrRoutePredicateFactory类
public Predicate<ServerWebExchange> apply(RemoteAddrRoutePredicateFactory.Config config) {
	//获取yml配置的地址信息，如下图获取的到地址是192.168.21.21
    final List<IpSubnetFilterRule> sources = this.convert(config.sources);
    return new GatewayPredicate() {
        public boolean test(ServerWebExchange exchange) {
        	//获取请求的地址(执行的代码就是下面那一个方法) 如下图获取到的是192.168.21.100
            InetSocketAddress remoteAddress = config.remoteAddressResolver.resolve(exchange);
            if (remoteAddress != null && remoteAddress.getAddress() != null) {
                String hostAddress = remoteAddress.getAddress().getHostAddress();
                String host = exchange.getRequest().getURI().getHost();
                if (RemoteAddrRoutePredicateFactory.log.isDebugEnabled() && !hostAddress.equals(host)) {
                    RemoteAddrRoutePredicateFactory.log.debug("Remote addresses didn't match " + hostAddress + " != " + host);
                }

                Iterator var5 = sources.iterator();

                while(var5.hasNext()) {
                    IpSubnetFilterRule source = (IpSubnetFilterRule)var5.next();
                    //通过正则匹配判断是否通过
                    if (source.matches(remoteAddress)) {
                        return true;
                    }
                }
            }

            return false;
        }

        public Object getConfig() {
            return config;
        }

        public String toString() {
            return String.format("RemoteAddrs: %s", config.getSources());
        }
    };
}

## RemoteAddressResolver类
default InetSocketAddress resolve(ServerWebExchange exchange) {
	//获取直接连接网关的IP地址，如果通nginx转发到网关的，那么这里获取到的是nginx的IP地址。
    return exchange.getRequest().getRemoteAddress();
}

yml配置：

在这里插入图片描述

如果我们在yml的断言配置如下图，那么他将匹配不成功

在这里插入图片描述

2、XForwardedRemoteAddr断言

2.1 源码解析

## XForwardedRemoteAddrRoutePredicateFactory类
public Predicate<ServerWebExchange> apply(XForwardedRemoteAddrRoutePredicateFactory.Config config) {
    if (log.isDebugEnabled()) {
        log.debug("Applying XForwardedRemoteAddr route predicate with maxTrustedIndex of " + config.getMaxTrustedIndex() + " for " + config.getSources().size() + " source(s)");
    }

    org.springframework.cloud.gateway.handler.predicate.RemoteAddrRoutePredicateFactory.Config wrappedConfig = new org.springframework.cloud.gateway.handler.predicate.RemoteAddrRoutePredicateFactory.Config();
    /**
     * 获取yml配置的IP地址信息，将从获取yml配置的IP地址信息传递
     * 给RemoteAddrRoutePredicateFactory，如下图获取的到地址是192.168.21.21
     */
    wrappedConfig.setSources(config.getSources());
    /**
     * config.getMaxTrustedIndex() 默认值为 1
     * XForwardedRemoteAddressResolver重新了resolve这个方法，用来获取请求头中X-Forwarded-For的值
     */
    wrappedConfig.setRemoteAddressResolver(XForwardedRemoteAddressResolver.maxTrustedIndex(config.getMaxTrustedIndex()));
    //说明RemoteAddrRoutePredicateFactory底层还是用RemoteAddr断言的规则
    RemoteAddrRoutePredicateFactory remoteAddrRoutePredicateFactory = new RemoteAddrRoutePredicateFactory();
    //将封装好的config传递给RemoteAddrRoutePredicateFactory
    Predicate<ServerWebExchange> wrappedPredicate = remoteAddrRoutePredicateFactory.apply(wrappedConfig);
    return (exchange) -> {
        Boolean isAllowed = wrappedPredicate.test(exchange);
        if (log.isDebugEnabled()) {
            ServerHttpRequest request = exchange.getRequest();
            log.debug("Request for \"" + request.getURI() + "\" from client \"" + request.getRemoteAddress().getAddress().getHostAddress() + "\" with \"" + "X-Forwarded-For" + "\" header value of \"" + request.getHeaders().get("X-Forwarded-For") + "\" is " + (isAllowed ? "ALLOWED" : "NOT ALLOWED"));
        }

        return isAllowed;
    };
}

## RemoteAddrRoutePredicateFactory类
public Predicate<ServerWebExchange> apply(RemoteAddrRoutePredicateFactory.Config config) {
	//获取传递过来的IP地址，如下图获取的到地址是192.168.21.21
    final List<IpSubnetFilterRule> sources = this.convert(config.sources);
    return new GatewayPredicate() {
        public boolean test(ServerWebExchange exchange) {
        	//获取请求的地址(执行的代码就是下面那一个方法) 如下图获取到的是192.168.21.22
            InetSocketAddress remoteAddress = config.remoteAddressResolver.resolve(exchange);
            if (remoteAddress != null && remoteAddress.getAddress() != null) {
                String hostAddress = remoteAddress.getAddress().getHostAddress();
                String host = exchange.getRequest().getURI().getHost();
                if (RemoteAddrRoutePredicateFactory.log.isDebugEnabled() && !hostAddress.equals(host)) {
                    RemoteAddrRoutePredicateFactory.log.debug("Remote addresses didn't match " + hostAddress + " != " + host);
                }

                Iterator var5 = sources.iterator();

                while(var5.hasNext()) {
                    IpSubnetFilterRule source = (IpSubnetFilterRule)var5.next();
                    //通过正则匹配判断是否通过
                    if (source.matches(remoteAddress)) {
                        return true;
                    }
                }
            }

            return false;
        }
		...
    };
}

## XForwardedRemoteAddressResolver类
public InetSocketAddress resolve(ServerWebExchange exchange) {
	//获取请求头中X-Forwarded-For的值
    List<String> xForwardedValues = this.extractXForwardedValues(exchange);
    Collections.reverse(xForwardedValues);
    if (!xForwardedValues.isEmpty()) {
    	//获取指定位置的IP，
        int index = Math.min(xForwardedValues.size(), this.maxTrustedIndex) - 1;
        return new InetSocketAddress((String)xForwardedValues.get(index), 0);
    } else {
        return this.defaultRemoteIpResolver.resolve(exchange);
    }
}

## XForwardedRemoteAddressResolver类
private List<String> extractXForwardedValues(ServerWebExchange exchange) {
    List<String> xForwardedValues = exchange.getRequest().getHeaders().get("X-Forwarded-For");
    if (xForwardedValues != null && !xForwardedValues.isEmpty()) {
    	//如果X-Forwarded-For的值多个直接丢弃
        if (xForwardedValues.size() > 1) {
            log.warn("Multiple X-Forwarded-For headers found, discarding all");
            return Collections.emptyList();
        } else {
            List<String> values = Arrays.asList(((String)xForwardedValues.get(0)).split(", "));
            return values.size() == 1 && !StringUtils.hasText((String)values.get(0)) ? Collections.emptyList() : values;
        }
    } else {
        return Collections.emptyList();
    }
}

因config.getMaxTrustedIndex()的默认值为1，所以请求头X-Forwarded-For值的最后一个值，如下图，获取的值为192.168.21.22。
在这里插入图片描述
如果我们在yml的断言配置如下图，那么他将匹配不成功。

XForwardedRemoteAddressResolver有两个静态构造函数方法，它们采用不同的安全方法：

XForwardedRemoteAddressResolver::trustAllRemoteAddressResolver返回始终采用标头中找到的第一个 IP 地址的a X-Forwarded-For。这种方法容易受到欺骗，因为恶意客户端可以为设置一个初始值X-Forwarded-For，解析器会接受该值。
XForwardedRemoteAddressResolver::maxTrustedIndex采用与在 Spring Cloud Gateway 前面运行的可信基础设施数量相关的索引。例如，如果 Spring Cloud Gateway 只能通过 HAProxy 访问，则应使用值 1。如果在访问 Spring Cloud Gateway 之前需要两跳可信基础设施，则应使用值 2。