ip:
  whitelist: "192.168.1.1, 192.168.1.2"

import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;

import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;

/**
 * 自定義 IP 白名單 Filter
 * 作用：攔截請(qǐng)求，檢查客戶端 IP 是否在白名單中
 */
@Component
public class IpWhiteListFilter implements Filter {

    @Value("${ip.whitelist}")
    private String whitelistStr;

    // 用于存儲(chǔ)白名單的 List
    private List<String> whiteList;

    /**
     * 初始化白名單
     */
    @Override
    public void init(FilterConfig filterConfig) {
        whiteList = Arrays.stream(whitelistStr.split(","))
                .map(String::trim)
                .collect(java.util.stream.Collectors.toList());
    }

    /**
     * 處理請(qǐng)求
     */
    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;

        String clientIP = getClientIP(httpRequest); // 獲取真實(shí) IP
        if (whiteList.contains(clientIP)) {
            chain.doFilter(request, response); // IP 在白名單中，放行
        } else {
            httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN, "IP 未授權(quán)訪問");
        }
    }

    /**
     * 獲取客戶端真實(shí) IP（支持代理服務(wù)器）
     */
    private String getClientIP(HttpServletRequest request) {
        // 從 X-Forwarded-For 頭獲取真實(shí) IP
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr(); // 如果沒有代理，直接獲取遠(yuǎn)程地址
        }
        return ip;
    }

    @Override
    public void destroy() {
        // 清理資源
    }
}

@Configuration
public class FilterConfig {

    @Bean
    public FilterRegistrationBean<IpWhiteListFilter> ipWhiteListFilter(IpWhiteListFilter filter) {
        FilterRegistrationBean<IpWhiteListFilter> registration = new FilterRegistrationBean<>(filter);
        registration.addUrlPatterns("/*"); // 攔截所有請(qǐng)求
        return registration;
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

ip:
  whitelist: "192.168.1.1, 192.168.1.2"

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

import java.util.Arrays;

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${ip.whitelist}")
    private String[] whiteList;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/**")
                .access("hasIpAddress('192.168.1.1') or hasIpAddress('192.168.1.2')") // 支持多個(gè) IP
                .and()
            .csrf().disable(); // 關(guān)閉 CSRF 保護(hù)
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-aop</artifactId>
</dependency>

import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

/**
 * 自定義注解，標(biāo)記需要 IP 白名單保護(hù)的方法
 */
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface IpWhiteList {
}

import org.aspectj.lang.ProceedingJoinPoint;
import org.aspectj.lang.annotation.Around;
import org.aspectj.lang.annotation.Aspect;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.stereotype.Component;
import org.springframework.web.context.request.RequestContextHolder;
import org.springframework.web.context.request.ServletRequestAttributes;

import javax.servlet.http.HttpServletRequest;
import java.io.IOException;
import java.util.Arrays;
import java.util.List;

/**
 * AOP 切面類：檢查 IP 是否在白名單中
 */
@Aspect
@Component
public class IpWhiteListAspect {

    @Value("${ip.whitelist}")
    private String whitelistStr;

    private List<String> whiteList;

    public IpWhiteListAspect() {
        // 初始化白名單
        whiteList = Arrays.stream(whitelistStr.split(","))
                .map(String::trim)
                .collect(java.util.stream.Collectors.toList());
    }

    /**
     * 切面邏輯：在方法執(zhí)行前檢查 IP
     */
    @Around("@annotation(IpWhiteList)")
    public Object checkIp(ProceedingJoinPoint joinPoint) throws Throwable {
        HttpServletRequest request = ((ServletRequestAttributes) RequestContextHolder.currentRequestAttributes()).getRequest();
        String clientIP = getClientIP(request);

        if (whiteList.contains(clientIP)) {
            return joinPoint.proceed(); // IP 在白名單中，繼續(xù)執(zhí)行方法
        } else {
            throw new AccessDeniedException("IP 未授權(quán)訪問");
        }
    }

    /**
     * 獲取客戶端真實(shí) IP（支持代理服務(wù)器）
     */
    private String getClientIP(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (ip == null || ip.isEmpty() || "unknown".equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        return ip;
    }
}

@RestController
public class DemoController {

    @IpWhiteList
    @GetMapping("/api/test")
    public String test() {
        return "Access granted";
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>

CREATE TABLE sys_ip_whitelist (
    id INT PRIMARY KEY AUTO_INCREMENT,
    ip VARCHAR(45) NOT NULL
);

import jakarta.persistence.*;

@Entity
@Table(name = "sys_ip_whitelist")
public class SysIpWhitelist {

    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;

    private String ip;

    // Getters and Setters
}

import org.springframework.data.jpa.repository.JpaRepository;

public interface SysIpWhitelistRepository extends JpaRepository<SysIpWhitelist, Long> {
    SysIpWhitelist findByIp(String ip);
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;

import java.util.List;
import java.util.concurrent.TimeUnit;

@Service
public class WhiteListService {

    @Autowired
    private SysIpWhitelistRepository repository;

    // 使用 Redis 緩存白名單（示例代碼）
    @Autowired
    private RedisTemplate<String, Object> redisTemplate;

    private static final String WHITE_LIST_KEY = "ip:white_list";

    /**
     * 檢查 IP 是否在白名單中（支持緩存）
     */
    public boolean isWhiteListed(String ip) {
        // 先查緩存
        List<String> cachedList = (List<String>) redisTemplate.opsForValue().get(WHITE_LIST_KEY);
        if (cachedList != null && cachedList.contains(ip)) {
            return true;
        }

        // 再查數(shù)據(jù)庫
        SysIpWhitelist entity = repository.findByIp(ip);
        if (entity != null) {
            // 更新緩存
            List<String> list = repository.findAll().stream().map(SysIpWhitelist::getIp).collect(Collectors.toList());
            redisTemplate.opsForValue().set(WHITE_LIST_KEY, list, 1, TimeUnit.MINUTES);
            return true;
        }
        return false;
    }
}

@Autowired
private WhiteListService whiteListService;

// 在 doFilter 或 checkIp 方法中調(diào)用
if (!whiteListService.isWhiteListed(clientIP)) {
    response.sendError(HttpServletResponse.SC_FORBIDDEN, "IP 未授權(quán)訪問");
}

sudo apt update
sudo apt install iptables

# 允許白名單 IP
sudo iptables -A INPUT -s 192.168.1.1 -j ACCEPT
sudo iptables -A INPUT -s 192.168.1.2 -j ACCEPT

# 拒絕其他所有 IP
sudo iptables -A INPUT -j DROP

# 安裝保存工具
sudo apt install iptables-persistent

# 保存規(guī)則
sudo netfilter-persistent save

<dependencies>
    <!-- Spring Boot Starter Web -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    
    <!-- Lombok簡化代碼 -->
    <dependency>
        <groupId>org.projectlombok</groupId>
        <artifactId>lombok</artifactId>
        <optional>true</optional>
    </dependency>
    
    <!-- 配置處理 -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-configuration-processor</artifactId>
        <optional>true</optional>
    </dependency>
</dependencies>

@ConfigurationProperties(prefix = "security.ip.whitelist")
@Data
public class IpWhitelistProperties {
    /**
     * 是否啟用IP白名單功能
     */
    private boolean enabled = false;
    
    /**
     * 全局IP白名單列表
     */
    private List<String> globalAllowedIps = new ArrayList<>();
    
    /**
     * 監(jiān)控模式：true-只記錄不攔截，false-實(shí)際攔截
     */
    private boolean monitorMode = false;
    
    /**
     * 允許的IP段，支持CIDR表示法
     */
    private List<String> allowedIpRanges = new ArrayList<>();
}

security:
  ip:
    whitelist:
      enabled: true
      global-allowed-ips:
        - 192.168.1.100
        - 172.16.0.50
      allowed-ip-ranges:
        - 10.0.0.0/8
        - 192.168.0.0/16
      monitor-mode: false

public class IpUtils {
    private static final String UNKNOWN = "unknown";
    private static final String LOCALHOST_IPV4 = "127.0.0.1";
    private static final String LOCALHOST_IPV6 = "0:0:0:0:0:0:0:1";
    
    /**
     * 獲取客戶端真實(shí)IP地址
     */
    public static String getClientIp(HttpServletRequest request) {
        String ip = request.getHeader("X-Forwarded-For");
        if (StringUtils.isEmpty(ip) || UNKNOWN.equalsIgnoreCase(ip)) {
            ip = request.getHeader("Proxy-Client-IP");
        }
        if (StringUtils.isEmpty(ip) || UNKNOWN.equalsIgnoreCase(ip)) {
            ip = request.getHeader("WL-Proxy-Client-IP");
        }
        if (StringUtils.isEmpty(ip) || UNKNOWN.equalsIgnoreCase(ip)) {
            ip = request.getRemoteAddr();
        }
        // 處理多級(jí)代理情況
        if (ip != null && ip.contains(",")) {
            ip = ip.substring(0, ip.indexOf(",")).trim();
        }
        return LOCALHOST_IPV6.equals(ip) ? LOCALHOST_IPV4 : ip;
    }
    
    /**
     * 檢查IP是否匹配CIDR表示法的IP段
     */
    public static boolean isIpInRange(String ip, String cidr) {
        // 實(shí)現(xiàn)細(xì)節(jié)...
    }
    
    /**
     * 驗(yàn)證IP地址格式
     */
    public static boolean isValidIp(String ip) {
        // 實(shí)現(xiàn)細(xì)節(jié)...
    }
}

@Target({ElementType.METHOD, ElementType.TYPE})
@Retention(RetentionPolicy.RUNTIME)
@Documented
public @interface IpWhitelist {
    /**
     * 是否啟用IP白名單檢查
     */
    boolean enabled() default true;
    
    /**
     * 特定于該接口的允許IP列表
     */
    String[] allowedIps() default {};
    
    /**
     * 特定于該接口的允許IP段(CIDR)
     */
    String[] allowedIpRanges() default {};
    
    /**
     * 拒絕時(shí)的錯(cuò)誤消息
     */
    String message() default "Access denied by IP whitelist";
}

@RequiredArgsConstructor
public class IpWhitelistInterceptor implements HandlerInterceptor {
    private final IpWhitelistProperties properties;
    private final ObjectMapper objectMapper;
    
    @Override
    public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        if (!properties.isEnabled()) {
            return true;
        }
        
        // 處理HandlerMethod情況
        if (!(handler instanceof HandlerMethod)) {
            return true;
        }
        
        HandlerMethod handlerMethod = (HandlerMethod) handler;
        Method method = handlerMethod.getMethod();
        
        // 檢查類和方法上的注解
        IpWhitelist classAnnotation = handlerMethod.getBeanType().getAnnotation(IpWhitelist.class);
        IpWhitelist methodAnnotation = method.getAnnotation(IpWhitelist.class);
        
        // 如果都沒有注解，則跳過檢查
        if (classAnnotation == null && methodAnnotation == null) {
            return true;
        }
        
        // 合并注解配置
        boolean enabled = methodAnnotation != null ? methodAnnotation.enabled() : 
                         classAnnotation.enabled();
        String[] allowedIps = methodAnnotation != null && methodAnnotation.allowedIps().length > 0 ? 
                             methodAnnotation.allowedIps() : 
                             classAnnotation != null ? classAnnotation.allowedIps() : new String[0];
        String[] allowedIpRanges = methodAnnotation != null && methodAnnotation.allowedIpRanges().length > 0 ? 
                                  methodAnnotation.allowedIpRanges() : 
                                  classAnnotation != null ? classAnnotation.allowedIpRanges() : new String[0];
        String message = methodAnnotation != null ? methodAnnotation.message() : 
                        classAnnotation != null ? classAnnotation.message() : "Access denied by IP whitelist";
        
        if (!enabled) {
            return true;
        }
        
        String clientIp = IpUtils.getClientIp(request);
        
        // 檢查全局白名單
        boolean isAllowed = properties.getGlobalAllowedIps().contains(clientIp) || 
                           properties.getAllowedIpRanges().stream()
                               .anyMatch(range -> IpUtils.isIpInRange(clientIp, range));
        
        // 檢查注解指定的白名單
        if (!isAllowed) {
            isAllowed = Arrays.stream(allowedIps).anyMatch(ip -> ip.equals(clientIp)) || 
                       Arrays.stream(allowedIpRanges)
                           .anyMatch(range -> IpUtils.isIpInRange(clientIp, range));
        }
        
        if (!isAllowed) {
            if (properties.isMonitorMode()) {
                log.warn("IP whitelist monitor mode triggered. Denied IP: {}", clientIp);
                return true;
            }
            
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
            response.setStatus(HttpStatus.FORBIDDEN.value());
            response.getWriter().write(objectMapper.writeValueAsString(
                Map.of(
                    "code", 403,
                    "message", message,
                    "data", null
                )
            ));
            return false;
        }
        
        return true;
    }
}

@Configuration
@RequiredArgsConstructor
public class WebConfig implements WebMvcConfigurer {
    private final IpWhitelistProperties ipWhitelistProperties;
    private final ObjectMapper objectMapper;
    
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        if (ipWhitelistProperties.isEnabled()) {
            registry.addInterceptor(new IpWhitelistInterceptor(ipWhitelistProperties, objectMapper))
                .addPathPatterns("/**")
                .order(Ordered.HIGHEST_PRECEDENCE); // 設(shè)置最高優(yōu)先級(jí)
        }
    }
}

@RestController
@RequestMapping("/api")
public class TestController {
    
    @GetMapping("/public")
    public String publicApi() {
        return "This is a public API";
    }
    
    @IpWhitelist
    @GetMapping("/secure")
    public String secureApi() {
        return "This is a secure API with IP whitelist";
    }
    
    @IpWhitelist(
        allowedIps = {"192.168.1.100", "172.16.0.50"},
        allowedIpRanges = {"10.0.0.0/8"},
        message = "Custom IP restriction"
    )
    @GetMapping("/custom")
    public String customApi() {
        return "This API has custom IP whitelist rules";
    }
}

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

public class IpAuthenticationFilter extends OncePerRequestFilter {
    private final IpWhitelistProperties properties;
    private final ObjectMapper objectMapper;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) 
            throws ServletException, IOException {
        // 獲取請(qǐng)求路徑對(duì)應(yīng)的HandlerMethod
        HandlerExecutionChain handlerExecutionChain = null;
        try {
            handlerExecutionChain = ((DispatcherServlet) request.getAttribute(DispatcherServlet.class.getName() + ".CONTEXT"))
                .getHandler(request);
        } catch (Exception e) {
            filterChain.doFilter(request, response);
            return;
        }
        
        if (handlerExecutionChain == null || !(handlerExecutionChain.getHandler() instanceof HandlerMethod)) {
            filterChain.doFilter(request, response);
            return;
        }
        
        HandlerMethod handlerMethod = (HandlerMethod) handlerExecutionChain.getHandler();
        // 后續(xù)邏輯與Interceptor類似...
    }
}

@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    private final IpWhitelistProperties ipWhitelistProperties;
    private final ObjectMapper objectMapper;
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .addFilterBefore(new IpAuthenticationFilter(ipWhitelistProperties, objectMapper), 
                           UsernamePasswordAuthenticationFilter.class)
            .authorizeRequests()
                .antMatchers("/api/public").permitAll()
                .anyRequest().authenticated()
            .and()
            .formLogin().disable()
            .httpBasic().disable();
    }
}

@RestController
@RequestMapping("/api/v2")
public class SecureController {
    
    @PreAuthorize("@ipSecurityService.isAllowed(#request)")
    @GetMapping("/expression")
    public String expressionBasedApi(HttpServletRequest request) {
        return "This API uses expression-based IP control";
    }
}

@Service
public class IpSecurityService {
    public boolean isAllowed(HttpServletRequest request) {
        // 實(shí)現(xiàn)IP檢查邏輯
        return true;
    }
}

@Service
public class DynamicIpWhitelistService {
    private final List<String> dynamicAllowedIps = new CopyOnWriteArrayList<>();
    private final List<String> dynamicAllowedIpRanges = new CopyOnWriteArrayList<>();
    
    public synchronized void addAllowedIp(String ip) {
        if (IpUtils.isValidIp(ip) && !dynamicAllowedIps.contains(ip)) {
            dynamicAllowedIps.add(ip);
        }
    }
    
    public synchronized void removeAllowedIp(String ip) {
        dynamicAllowedIps.remove(ip);
    }
    
    public synchronized void reloadIps(List<String> ips) {
        dynamicAllowedIps.clear();
        dynamicAllowedIps.addAll(ips.stream()
            .filter(IpUtils::isValidIp)
            .collect(Collectors.toList()));
    }
    
    // 類似方法實(shí)現(xiàn)IP段管理...
}

@Configuration
public class RedisIpWhitelistConfig {
    
    @Bean
    public RedisTemplate<String, String> ipWhitelistRedisTemplate(RedisConnectionFactory factory) {
        RedisTemplate<String, String> template = new RedisTemplate<>();
        template.setConnectionFactory(factory);
        template.setKeySerializer(new StringRedisSerializer());
        template.setValueSerializer(new StringRedisSerializer());
        return template;
    }
}

@Service
@RequiredArgsConstructor
public class RedisIpWhitelistService {
    private static final String WHITELIST_KEY = "ip:whitelist";
    private static final String WHITELIST_RANGES_KEY = "ip:whitelist:ranges";
    
    private final RedisTemplate<String, String> redisTemplate;
    
    public boolean isAllowed(String ip) {
        // 檢查精確IP
        Boolean isMember = redisTemplate.opsForSet().isMember(WHITELIST_KEY, ip);
        if (Boolean.TRUE.equals(isMember)) {
            return true;
        }
        
        // 檢查IP段
        Set<String> ranges = redisTemplate.opsForSet().members(WHITELIST_RANGES_KEY);
        if (ranges != null) {
            return ranges.stream().anyMatch(range -> IpUtils.isIpInRange(ip, range));
        }
        
        return false;
    }
    
    // 其他管理方法...
}

@Service
public class CachedIpWhitelistService {
    private final LoadingCache<String, Boolean> ipCheckCache;
    
    public CachedIpWhitelistService(RedisIpWhitelistService redisService) {
        this.ipCheckCache = Caffeine.newBuilder()
            .maximumSize(10_000)
            .expireAfterWrite(5, TimeUnit.MINUTES)
            .build(redisService::isAllowed);
    }
    
    public boolean isAllowed(String ip) {
        return Boolean.TRUE.equals(ipCheckCache.get(ip));
    }
}

class IpUtilsTest {
    
    @Test
    void testIsIpInRange() {
        assertTrue(IpUtils.isIpInRange("192.168.1.100", "192.168.1.0/24"));
        assertFalse(IpUtils.isIpInRange("10.0.0.5", "192.168.1.0/24"));
    }
    
    @Test
    void testGetClientIp() {
        // 模擬HttpServletRequest測試各種頭部情況
    }
}

@SpringBootTest
@AutoConfigureMockMvc
class IpWhitelistIntegrationTest {
    
    @Autowired
    private MockMvc mockMvc;
    
    @Test
    @WithMockUser
    void testPublicApi() throws Exception {
        mockMvc.perform(get("/api/public"))
            .andExpect(status().isOk());
    }
    
    @Test
    @WithMockUser
    void testSecureApiWithAllowedIp() throws Exception {
        mockMvc.perform(get("/api/secure").with(request -> {
                request.setRemoteAddr("192.168.1.100");
                return request;
            }))
            .andExpect(status().isOk());
    }
    
    @Test
    @WithMockUser
    void testSecureApiWithDeniedIp() throws Exception {
        mockMvc.perform(get("/api/secure").with(request -> {
                request.setRemoteAddr("10.1.2.3");
                return request;
            }))
            .andExpect(status().isForbidden());
    }
}

@Bean
public RouteLocator customRouteLocator(RouteLocatorBuilder builder) {
    return builder.routes()
        .route("secure-service", r -> r.path("/api/secure/**")
            .filters(f -> f.filter(new IpWhitelistGatewayFilter()))
            .uri("lb://secure-service"))
        .build();
}

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: api-whitelist
spec:
  podSelector:
    matchLabels:
      app: spring-boot-app
  ingress:
  - from:
    - ipBlock:
        cidr: 192.168.1.0/24
    ports:
    - protocol: TCP
      port: 8080