feat:manage proxy header

#781

api/waf_login.go

@@ -43,7 +43,7 @@ func (w *WafLoginApi) LoginApi(c *gin.Context) {
 		}
 		bean := wafAccountService.GetInfoByLoginApi(req)
 		if bean.Id != "" {
-			clientIP := c.ClientIP()
+			clientIP := utils.GetManageClientIP(c)
 			clientCountry := utils.GetCountry(clientIP)
 			// 检查客户端的登录错误次数
 			cacheKey := enums.CACHE_LOGIN_ERROR + clientIP
@@ -140,7 +140,7 @@ func (w *WafLoginApi) LoginApi(c *gin.Context) {
 
 			//记录状态
 			accessToken := utils.Md5String(uuid.GenUUID())
-			tokenInfo := wafTokenInfoService.AddApiWithFingerprintAndType(bean.LoginAccount, accessToken, c.ClientIP(), deviceFingerprint, loginType)
+			tokenInfo := wafTokenInfoService.AddApiWithFingerprintAndType(bean.LoginAccount, accessToken, utils.GetManageClientIP(c), deviceFingerprint, loginType)
 
 			//令牌记录到cache里
 			global.GCACHE_WAFCACHE.SetWithTTl(enums.CACHE_TOKEN+accessToken, *tokenInfo, time.Duration(global.GCONFIG_RECORD_TOKEN_EXPIRE_MINTUTES)*time.Minute)

global/config.go

@@ -7,6 +7,7 @@ var (
 	GCONFIG_RECORD_MAX_RES_BODY_LENGTH  int64  = 1024 * 4            //限制记录最大响应的body长度 record_max_rep_body_length
 	GCONFIG_RECORD_RESP                 int64  = 0                   // 是否记录响应记录 record_resp
 	GCONFIG_RECORD_PROXY_HEADER         string = ""                  //配置获取IP头信息
+	GCONFIG_MANAGE_PROXY_HEADER         string = ""                  //管理端获取客户端IP头信息，留空则直接取网络IP
 	GCONFIG_RECORD_AUTO_LOAD_SSL        int64  = 1                   //是否每天凌晨3点自动加载ssl证书
 	GCONFIG_RECORD_KAFKA_ENABLE         int64  = 0                   //kafka 是否激活
 	GCONFIG_RECORD_KAFKA_URL            string = "127.0.0.1:9092"    //kafka url地址

middleware/auth_api_check.go

@@ -82,7 +82,7 @@ func Auth() gin.HandlerFunc {
 				tokenInfo := global.GCACHE_WAFCACHE.Get(enums.CACHE_TOKEN + tokenStr).(model.TokenInfo)
 
 				// IP检查逻辑
-				currentIP := c.ClientIP()
+				currentIP := utils.GetManageClientIP(c)
 				ipMatched := false
 
 				// 如果启用严格IP绑定，进行严格IP检查

middleware/ip_whitelist_middleware.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"SamWaf/global"
+	"SamWaf/utils"
 	"github.com/gin-gonic/gin"
 	"net"
 	"net/http"
@@ -11,7 +12,7 @@ import (
 // IPWhitelist IP白名单中间件
 func IPWhitelist() gin.HandlerFunc {
 	return func(c *gin.Context) {
-		clientIP := c.ClientIP()
+		clientIP := utils.GetManageClientIP(c)
 		allowed := false
 
 		allowedIPs := strings.Split(global.GWAF_IP_WHITELIST, ",")

utils/common.go

@@ -16,6 +16,8 @@ import (
 	"strconv"
 	"strings"
 	"time"
+
+	"github.com/gin-gonic/gin"
 )
 
 func GetExternalIp() string {
@@ -400,3 +402,28 @@ func IsIP(input string) bool {
 	// 如果是有效的 IP，返回非 nil
 	return net.ParseIP(input) != nil
 }
+
+// GetManageClientIP 获取管理端客户端真实IP。
+// 若 GCONFIG_MANAGE_PROXY_HEADER 为空（默认），直接返回网络层 IP（c.RemoteIP()），
+// 防止未经信任的 X-Forwarded-For 被接受。
+// 若已配置代理头（逗号分隔，按优先级排列），依次读取首个有效 IP；全部失败则回退到网络层 IP。
+func GetManageClientIP(c *gin.Context) string {
+	if global.GCONFIG_MANAGE_PROXY_HEADER == "" {
+		return c.RemoteIP()
+	}
+	for _, header := range strings.Split(global.GCONFIG_MANAGE_PROXY_HEADER, ",") {
+		header = strings.TrimSpace(header)
+		if header == "" {
+			continue
+		}
+		val := c.GetHeader(header)
+		if val == "" {
+			continue
+		}
+		ip := strings.TrimSpace(strings.SplitN(val, ",", 2)[0])
+		if IsValidIPv4(ip) || IsValidIPv6(ip) {
+			return ip
+		}
+	}
+	return c.RemoteIP()
+}

waftask/task_config.go

@@ -212,6 +212,9 @@ func setConfigStringValue(name string, value string, change int) {
 	case "gwaf_proxy_header":
 		global.GCONFIG_RECORD_PROXY_HEADER = value
 		break
+	case "gwaf_manage_proxy_header":
+		global.GCONFIG_MANAGE_PROXY_HEADER = value
+		break
 	case "owasp_mode":
 		switch value {
 		case "On", "DetectionOnly", "Off":
@@ -379,6 +382,7 @@ func TaskLoadSetting(initLoad bool) {
 	updateConfigStringItem(initLoad, "system", "gwaf_center_enable", global.GWAF_CENTER_ENABLE, "中心开关", "bool", "false|关闭,true|开启", configMap)
 	updateConfigStringItem(initLoad, "system", "gwaf_center_url", global.GWAF_CENTER_URL, "中心URL", "string", "", configMap)
 	updateConfigStringItem(initLoad, "system", "gwaf_proxy_header", global.GCONFIG_RECORD_PROXY_HEADER, "获取访客IP头信息（按照顺序）比如:X-Forwarded-For,X-Real-IP ,留空则提取的是直接访客IP", "string", "", configMap)
+	updateConfigStringItem(initLoad, "system", "gwaf_manage_proxy_header", global.GCONFIG_MANAGE_PROXY_HEADER, "管理端获取客户端IP头信息（按优先级逗号分隔，如 X-Forwarded-For,X-Real-IP,CF-Connecting-IP），留空则直接取网络IP", "string", "", configMap)
 
 	updateConfigIntItem(initLoad, "kafka", "kafka_enable", global.GCONFIG_RECORD_KAFKA_ENABLE, "kafka 是否激活", "int", "", configMap)
 	updateConfigStringItem(initLoad, "kafka", "kafka_url", global.GCONFIG_RECORD_KAFKA_URL, "kafka url地址", "string", "", configMap)