package com.vincent.rsf.httpaudit.service;
|
|
import com.baomidou.mybatisplus.core.conditions.query.LambdaQueryWrapper;
|
import com.baomidou.mybatisplus.extension.service.impl.ServiceImpl;
|
import com.vincent.rsf.httpaudit.entity.HttpAuditRule;
|
import com.vincent.rsf.httpaudit.mapper.HttpAuditRuleMapper;
|
import com.vincent.rsf.httpaudit.model.HttpAuditDecision;
|
import com.vincent.rsf.httpaudit.props.HttpAuditProperties;
|
import com.vincent.rsf.httpaudit.support.HttpAuditSupport;
|
import lombok.extern.slf4j.Slf4j;
|
import org.springframework.scheduling.annotation.Scheduled;
|
|
import javax.annotation.PostConstruct;
|
import javax.servlet.http.HttpServletRequest;
|
import java.net.URI;
|
import java.util.List;
|
import java.util.concurrent.CopyOnWriteArrayList;
|
import java.util.regex.Pattern;
|
|
/**
|
* 规则缓存；入站/出站或关系；record_all 时白名单下也全记
|
*/
|
@Slf4j
|
public class HttpAuditRuleServiceImpl extends ServiceImpl<HttpAuditRuleMapper, HttpAuditRule> implements HttpAuditRuleService {
|
|
private final HttpAuditProperties props;
|
private final CopyOnWriteArrayList<HttpAuditRule> cache = new CopyOnWriteArrayList<>();
|
|
public HttpAuditRuleServiceImpl(HttpAuditRuleMapper mapper, HttpAuditProperties props) {
|
this.baseMapper = mapper;
|
this.props = props;
|
}
|
|
@PostConstruct
|
public void init() {
|
refreshCache();
|
}
|
|
@Override
|
@Scheduled(fixedDelayString = "${http-audit.rule-cache-refresh-ms:60000}")
|
public void refreshCache() {
|
try {
|
List<HttpAuditRule> list = list(new LambdaQueryWrapper<HttpAuditRule>()
|
.eq(HttpAuditRule::getDeleted, 0)
|
.eq(HttpAuditRule::getEnabled, 1)
|
.orderByAsc(HttpAuditRule::getSortOrder)
|
.orderByAsc(HttpAuditRule::getId));
|
cache.clear();
|
cache.addAll(list);
|
log.debug("http-audit 规则缓存已刷新，条数={}", cache.size());
|
} catch (Exception e) {
|
log.warn("http-audit 规则缓存刷新失败（白名单将不生效，入站不落库）", e);
|
}
|
}
|
|
@Override
|
public boolean shouldAudit(HttpServletRequest request, String requestBody) {
|
return decideInbound(request, requestBody).isAudit();
|
}
|
|
@Override
|
public HttpAuditDecision decideInbound(HttpServletRequest request, String requestBody) {
|
if (!props.isWhitelistOnly()) {
|
return HttpAuditDecision.yes(reqLimitFromRecordAllRow(), resLimitFromRecordAllRow());
|
}
|
if (cache.isEmpty()) {
|
return HttpAuditDecision.SKIP;
|
}
|
HttpAuditRule allRow = firstRecordAllRule();
|
if (allRow != null) {
|
return HttpAuditDecision.yes(allRow.getRequestMaxChars(), allRow.getResponseMaxChars());
|
}
|
String path = HttpAuditSupport.safePath(request);
|
String ip = HttpAuditSupport.clientIp(request);
|
String body = requestBody == null ? "" : requestBody;
|
for (HttpAuditRule r : cache) {
|
if (isRecordAll(r)) {
|
continue;
|
}
|
if (!appliesInbound(r)) {
|
continue;
|
}
|
try {
|
if (matchInbound(r, path, ip, body)) {
|
return HttpAuditDecision.yes(r.getRequestMaxChars(), r.getResponseMaxChars());
|
}
|
} catch (Exception e) {
|
log.debug("http-audit 规则 id={} 匹配异常：{}", r.getId(), e.getMessage());
|
}
|
}
|
return HttpAuditDecision.SKIP;
|
}
|
|
@Override
|
public HttpAuditDecision decideOutbound(String fullUrl, String method, String requestBody) {
|
if (!props.isWhitelistOnly()) {
|
return HttpAuditDecision.yes(reqLimitFromRecordAllRow(), resLimitFromRecordAllRow());
|
}
|
if (cache.isEmpty()) {
|
return HttpAuditDecision.SKIP;
|
}
|
HttpAuditRule allRow = firstRecordAllRule();
|
if (allRow != null) {
|
return HttpAuditDecision.yes(allRow.getRequestMaxChars(), allRow.getResponseMaxChars());
|
}
|
String body = requestBody == null ? "" : requestBody;
|
for (HttpAuditRule r : cache) {
|
if (isRecordAll(r)) {
|
continue;
|
}
|
if (!appliesOutbound(r)) {
|
continue;
|
}
|
try {
|
if (matchOutbound(r, fullUrl, body)) {
|
return HttpAuditDecision.yes(r.getRequestMaxChars(), r.getResponseMaxChars());
|
}
|
} catch (Exception e) {
|
log.debug("http-audit 出站规则 id={} 匹配异常：{}", r.getId(), e.getMessage());
|
}
|
}
|
return HttpAuditDecision.SKIP;
|
}
|
|
private Integer reqLimitFromRecordAllRow() {
|
HttpAuditRule row = firstRecordAllRule();
|
return row == null ? null : row.getRequestMaxChars();
|
}
|
|
private Integer resLimitFromRecordAllRow() {
|
HttpAuditRule row = firstRecordAllRule();
|
return row == null ? null : row.getResponseMaxChars();
|
}
|
|
private HttpAuditRule firstRecordAllRule() {
|
for (HttpAuditRule r : cache) {
|
if (isRecordAll(r)) {
|
return r;
|
}
|
}
|
return null;
|
}
|
|
private static boolean isRecordAll(HttpAuditRule r) {
|
return r.getRecordAll() != null && r.getRecordAll() == 1;
|
}
|
|
private static String dir(HttpAuditRule r) {
|
String d = r.getDirection();
|
if (d == null || d.isEmpty()) {
|
return HttpAuditRule.DIR_IN;
|
}
|
return d;
|
}
|
|
private static boolean appliesInbound(HttpAuditRule r) {
|
if (isRecordAll(r)) {
|
return false;
|
}
|
String d = dir(r);
|
return HttpAuditRule.DIR_IN.equals(d) || HttpAuditRule.DIR_BOTH.equals(d);
|
}
|
|
private static boolean appliesOutbound(HttpAuditRule r) {
|
if (isRecordAll(r)) {
|
return false;
|
}
|
String d = dir(r);
|
return HttpAuditRule.DIR_OUT.equals(d) || HttpAuditRule.DIR_BOTH.equals(d);
|
}
|
|
private static boolean matchInbound(HttpAuditRule r, String path, String ip, String body) {
|
return matchByRuleType(r, path, ip, body);
|
}
|
|
private boolean matchOutbound(HttpAuditRule r, String fullUrl, String body) {
|
String t = r.getRuleType();
|
String mode = r.getMatchMode();
|
String p = r.getPattern();
|
if (p == null) {
|
return false;
|
}
|
if (HttpAuditRule.TYPE_URI.equals(t)) {
|
if (matchString(fullUrl, mode, p)) {
|
return true;
|
}
|
return matchString(extractPath(fullUrl), mode, p);
|
}
|
if (HttpAuditRule.TYPE_IP.equals(t)) {
|
String host = extractHost(fullUrl);
|
return matchString(host, mode, p);
|
}
|
if (HttpAuditRule.TYPE_REQUEST_BODY.equals(t)) {
|
return matchString(body, mode, p);
|
}
|
return false;
|
}
|
|
private static String extractPath(String url) {
|
try {
|
URI u = URI.create(url);
|
String path = u.getPath();
|
return path == null ? "" : path;
|
} catch (Exception e) {
|
return url == null ? "" : url;
|
}
|
}
|
|
private static String extractHost(String url) {
|
try {
|
URI u = URI.create(url);
|
String h = u.getHost();
|
return h == null ? "" : h;
|
} catch (Exception e) {
|
return "";
|
}
|
}
|
|
private static boolean matchByRuleType(HttpAuditRule r, String path, String ip, String body) {
|
String t = r.getRuleType();
|
String mode = r.getMatchMode();
|
String p = r.getPattern();
|
if (p == null) {
|
return false;
|
}
|
if (HttpAuditRule.TYPE_URI.equals(t)) {
|
return matchString(path, mode, p);
|
}
|
if (HttpAuditRule.TYPE_IP.equals(t)) {
|
return matchString(ip, mode, p);
|
}
|
if (HttpAuditRule.TYPE_REQUEST_BODY.equals(t)) {
|
return matchString(body, mode, p);
|
}
|
return false;
|
}
|
|
private static boolean matchString(String value, String mode, String pattern) {
|
if (value == null) {
|
value = "";
|
}
|
if (HttpAuditRule.MODE_EQUAL.equals(mode)) {
|
return value.equals(pattern);
|
}
|
if (HttpAuditRule.MODE_PREFIX.equals(mode)) {
|
return value.startsWith(pattern);
|
}
|
if (HttpAuditRule.MODE_CONTAINS.equals(mode)) {
|
return value.contains(pattern);
|
}
|
if (HttpAuditRule.MODE_REGEX.equals(mode)) {
|
return Pattern.compile(pattern).matcher(value).find();
|
}
|
return false;
|
}
|
}
|
