Apache Mina 白名单实现方法

我会带着你远行 2022-06-09 04:47 206阅读 0赞

Mina自带了一个黑名单过滤器**BlacklistFilter**，可过滤黑名单列表中的网络连接。用来防止非法的客户端访问。

但在某些应用场景里需要设定白名单，只接收某些指定IP的客户端发来的数据。这就需要实现白名单功能。

我们可以自己实现白名单过滤器，方法很简单只需仿照**BlacklistFilter**做些修改即可。

我自己写的WhiteFilter，代码如下：

/**
     * Whitelist filter (based on Mina's Blacklist filter).
     */
    public class WhitelistFilter extends IoFilterAdapter {
    
    	private final List<Subnet> whitelist = new CopyOnWriteArrayList<Subnet>();
    
    	private final static Logger LOGGER = LoggerFactory.getLogger(WhitelistFilter.class);
    
    	public void setWhitelist(InetAddress[] addresses) {
    		if (addresses == null) {
    			throw new NullPointerException("addresses");
    		}
    		whitelist.clear();
    		for (InetAddress addr : addresses) {
    			allow(addr);
    		}
    	}
    
    	public void setSubnetWhitelist(Subnet[] subnets) {
    		if (subnets == null) {
    			throw new NullPointerException("Subnets must not be null");
    		}
    		whitelist.clear();
    		for (Subnet subnet : subnets) {
    			allow(subnet);
    		}
    	}
    
    	public void setWhitelist(Iterable<InetAddress> addresses) {
    		if (addresses == null) {
    			throw new NullPointerException("addresses");
    		}
    
    		whitelist.clear();
    
    		for (InetAddress address : addresses) {
    			allow(address);
    		}
    	}
    
    	public void setSubnetWhitelist(Iterable<Subnet> subnets) {
    		if (subnets == null) {
    			throw new NullPointerException("Subnets must not be null");
    		}
    		whitelist.clear();
    		for (Subnet subnet : subnets) {
    			allow(subnet);
    		}
    	}
    
    	public void allow(InetAddress address) {
    		if (address == null) {
    			throw new NullPointerException("Adress to block can not be null");
    		}
    
    		allow(new Subnet(address, 32));
    	}
    
    	public void allow(Subnet subnet) {
    		if (subnet == null) {
    			throw new NullPointerException("Subnet can not be null");
    		}
    
    		whitelist.add(subnet);
    	}
    
    	public void disallow(InetAddress address) {
    		if (address == null) {
    			throw new NullPointerException("Adress to unblock can not be null");
    		}
    
    		disallow(new Subnet(address, 32));
    	}
    
    	public void disallow(Subnet subnet) {
    		if (subnet == null) {
    			throw new NullPointerException("Subnet can not be null");
    		}
    		whitelist.remove(subnet);
    	}
    
    	@Override
    	public void sessionCreated(NextFilter nextFilter, IoSession session) {
    		if (isAllowed(session)) {
    			nextFilter.sessionCreated(session);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	@Override
    	public void sessionOpened(NextFilter nextFilter, IoSession session) throws Exception {
    		if (isAllowed(session)) {
    			nextFilter.sessionOpened(session);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	@Override
    	public void sessionClosed(NextFilter nextFilter, IoSession session) throws Exception {
    		if (isAllowed(session)) {
    			nextFilter.sessionClosed(session);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	@Override
    	public void sessionIdle(NextFilter nextFilter, IoSession session, IdleStatus status) throws Exception {
    		if (isAllowed(session)) {
    			nextFilter.sessionIdle(session, status);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	@Override
    	public void messageReceived(NextFilter nextFilter, IoSession session, Object message) {
    		if (isAllowed(session)) {
    			nextFilter.messageReceived(session, message);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	@Override
    	public void messageSent(NextFilter nextFilter, IoSession session, WriteRequest writeRequest) throws Exception {
    		if (isAllowed(session)) {
    			nextFilter.messageSent(session, writeRequest);
    		} else {
    			blockSession(session);
    		}
    	}
    
    	private void blockSession(IoSession session) {
    		LOGGER.warn("Remote address is not allowed; closing.");
    		session.close(true);
    	}
    
    	private boolean isAllowed(IoSession session) {
    		SocketAddress remoteAddress = session.getRemoteAddress();
    		if (remoteAddress instanceof InetSocketAddress) {
    			InetAddress address = ((InetSocketAddress) remoteAddress).getAddress();
    
    			// check all subnets
    			for (Subnet subnet : whitelist) {
    				if (subnet.inSubnet(address)) {
    					return true;
    				}
    			}
    		}
    		return false;
    	}
    }

调用时要加入whitelist过滤器

IoAcceptor acceptor = new NioSocketAcceptor();
    
    WhitelistFilter whitelistFilter=new WhitelistFilter();
    InetAddress[] address= new InetAddress[1];
    address[0]=InetAddress.getByName("192.168.136.123");
    whitelistFilter.setWhitelist(address);
    acceptor.getFilterChain().addFirst("white",whitelistFilter);
    
    acceptor.getFilterChain().addLast("logger", new LoggingFilter());   
              
    acceptor.getFilterChain().addLast("codec", new ProtocolCodecFilter(new TextLineCodecFactory(Charset.forName("GBK"))));     
    acceptor.setHandler(new ServerHandler());     
              
    acceptor.getSessionConfig().setReadBufferSize(2048);     
    acceptor.getSessionConfig().setIdleTime(IdleStatus.BOTH_IDLE, 10);     
                 
    acceptor.bind(new InetSocketAddress(PORT));

这样服务端只会从指定的IP接收数据，如果客户端使用其他的IP地址则服务端拒绝连接。