ops / monitor-service · Commits

Go to a project

Authored by qinchao
Commit 0d403273bd0d969e8594faa466179bce14dba401 1 parent e77d8a2f

恶意ip封杀

Inline Side-by-side
Showing 6 changed files with 197 additions and 1 deletions
package com.model;
import lombok.Data;
import java.util.Date;
/**
* Created by craig.qin
*/
@Data
public class MaliciousIpsRecordForbid {
private int id;
private String ip;
private String reason;
/**
* 创建时间
*/
private Date createTime;
//封禁status 1 表示封
private String forbidStatus;
}
... ...
package com.monitor.mysql.mapper;
import com.model.MaliciousIpsRecordForbid;
import com.monitor.model.domain.PageBean;
import java.util.List;
/**
* Created by craig.qin
*/
public interface MaliciousIpsRecordForbidMapper {
int selectCount(PageBean page);//查询总数量
List<MaliciousIpsRecordForbid> selectByPage(PageBean page);
int insert(MaliciousIpsRecordForbid record);
void updateForbidStatusByPrimaryKey(MaliciousIpsRecordForbid record);
}
... ...
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" >
<mapper namespace="com.monitor.mysql.mapper.MaliciousIpsRecordForbidMapper" >
<resultMap id="BaseResultMap" type="com.model.MaliciousIpsRecordForbid" >
<id column="id" property="id" jdbcType="INTEGER" />
<result column="ip" property="ip" jdbcType="VARCHAR" />
<result column="reason" property="reason" jdbcType="VARCHAR" />
<result column="forbid_status" property="forbidStatus" jdbcType="VARCHAR" />
<result column="create_time" property="createTime" jdbcType="TIMESTAMP" />
</resultMap>
<sql id="Base_Column_List" >
id, ip,reason,create_time,forbid_status
</sql>
<select id="selectCount" resultType="java.lang.Integer">
select count(1) from malicious_ips_record_forbid
where 1=1
<if test="params.beginTime !=null &amp;&amp; params.beginTime !=''">
and create_time &gt;= #{params.beginTime,jdbcType=TIMESTAMP}
</if>
<if test="params.endTime !=null &amp;&amp; params.endTime !=''">
and create_time &lt;= #{params.endTime,jdbcType=TIMESTAMP}
</if>
</select>
<select id="selectByPage" resultMap="BaseResultMap">
select
<include refid="Base_Column_List"/>
from malicious_ips_record_forbid
where 1=1
<if test="params.beginTime !=null &amp;&amp; params.beginTime !=''">
and create_time &gt;= #{params.beginTime,jdbcType=TIMESTAMP}
</if>
<if test="params.endTime !=null &amp;&amp; params.endTime !=''">
and create_time &lt;= #{params.endTime,jdbcType=TIMESTAMP}
</if>
order by id desc
limit #{startIndex},#{pageSize}
</select>
<insert id="insert" parameterType="com.model.MaliciousIpsRecordForbid">
insert into malicious_ips_record_forbid(ip,reason,create_time)
values(#{ip,jdbcType=VARCHAR},#{reason,jdbcType=VARCHAR},now())
</insert>
<update id="updateForbidStatusByPrimaryKey" parameterType="com.model.MaliciousIpsRecordForbid" >
update malicious_ips_record_forbid
set forbid_status = #{forbidStatus,jdbcType=VARCHAR}
where id = #{id,jdbcType=INTEGER}
</update>
</mapper>
\ No newline at end of file
... ...
... ... @@ -83,6 +83,26 @@ public class MaliciousIpController {
}
/**
* 捕获的恶意ip写入运维系统的mysql
* @return
*/
@RequestMapping("/writeForbidMipsInfoToOpsDb")
@ResponseBody
public void writeForbidMipsInfoToOpsDb(@RequestBody String ipsObjs) {
ipImpl.writeForbidMipsInfoToOpsDb(ipsObjs);
}
@RequestMapping("/updateForbidStatus")
@ResponseBody
public BaseResponse updateForbidStatus(int id,String status) {
ipImpl.updateForbidStatus(id,status);
return new BaseResponse();
}
/**
* 从运维系统的db获取恶意ip
* @return
*/
... ... @@ -92,6 +112,12 @@ public class MaliciousIpController {
return ipImpl.getMipsInfoToOpsDb(pageRequest);
}
@RequestMapping("/getMaliciousIpRecordForbidList")
@ResponseBody
public BaseResponse getMaliciousIpRecordForbidList(@RequestBody MaliciousIpRecordReq pageRequest){
return ipImpl.getForbidMipsInfoToOpsDb(pageRequest);
}
/**
* 从运维系统的redis获取恶意ip
... ...
... ... @@ -26,8 +26,14 @@ public interface MaliciousIpService {
void writeMipsInfoToOpsDb(String ipsObjs);
void writeForbidMipsInfoToOpsDb(String ipsObjs);
void updateForbidStatus(int id ,String status);
BaseResponse getMipsInfoToOpsDb(MaliciousIpRecordReq request);
BaseResponse getForbidMipsInfoToOpsDb(MaliciousIpRecordReq request);
/**
*从运维系统的redis查询恶意ip
*/
... ...
... ... @@ -6,6 +6,7 @@ import com.alibaba.fastjson.JSONObject;
import com.contants.AlarmGroupContants;
import com.model.MalIpRule;
import com.model.MaliciousIpsRecord;
import com.model.MaliciousIpsRecordForbid;
import com.monitor.common.service.AlarmMsgService;
import com.monitor.influxdb.contants.InfluxDBContants;
import com.monitor.influxdb.mapper.MaliciousIpMapper;
... ... @@ -15,6 +16,7 @@ import com.monitor.model.request.MaliciousIpRecordReq;
import com.monitor.model.response.BaseResponse;
import com.monitor.model.response.PageResponse;
import com.monitor.mysql.mapper.MalIpRuleMapper;
import com.monitor.mysql.mapper.MaliciousIpsRecordForbidMapper;
import com.monitor.mysql.mapper.MaliciousIpsRecordMapper;
import com.monitor.other.maliciousip.contants.MaliciousIpContants;
import com.monitor.other.maliciousip.contants.MaliciousIpModel;
... ... @@ -70,6 +72,9 @@ public class MaliciousIpServiceImpl implements MaliciousIpService {
private MaliciousIpsRecordMapper maliciousIpsRecordMapper;
@Autowired
private MaliciousIpsRecordForbidMapper maliciousIpsRecordForbidMapper;
@Autowired
@Qualifier("awsRedisTemplate")
private RedisTemplate<String,String> awsRedisTemplate;
... ... @@ -183,7 +188,7 @@ public class MaliciousIpServiceImpl implements MaliciousIpService {
public void writeMipsInfoToOpsDb(String ipsObjs){
logger.info("begin writeMipsInfoToOpsDb :"+ipsObjs);
//logger.info("begin writeMipsInfoToOpsDb :"+ipsObjs);
if(StringUtils.isNotBlank(ipsObjs)){
JSONArray ipsObjArray=JSON.parseArray(ipsObjs);
for(int i=0;i<ipsObjArray.size();i++){
... ... @@ -200,6 +205,32 @@ public class MaliciousIpServiceImpl implements MaliciousIpService {
}
}
public void writeForbidMipsInfoToOpsDb(String ipsObjs){
//logger.info("begin writeForbidMipsInfoToOpsDb :"+ipsObjs);
if(StringUtils.isNotBlank(ipsObjs)){
JSONArray ipsObjArray=JSON.parseArray(ipsObjs);
for(int i=0;i<ipsObjArray.size();i++){
JSONObject jo= ipsObjArray.getJSONObject(i);
String ip=jo.getString("ip");
String reason=jo.toJSONString();
//写入mysql
MaliciousIpsRecordForbid record=new MaliciousIpsRecordForbid();
record.setIp(ip);
record.setReason(reason);
maliciousIpsRecordForbidMapper.insert(record);
}
}
}
public void updateForbidStatus(int id ,String status){
MaliciousIpsRecordForbid recordForbid=new MaliciousIpsRecordForbid();
recordForbid.setId(id);
recordForbid.setForbidStatus(status);
maliciousIpsRecordForbidMapper.updateForbidStatusByPrimaryKey(recordForbid);
}
public BaseResponse getMipsInfoToOpsDb(MaliciousIpRecordReq request){
PageBean page = PageBean.initPageInfo(request.getCurrentPage(), request.getPageSize(), request);
maliciousIpsRecordMapper.selectByPage(page);
... ... @@ -237,6 +268,43 @@ public class MaliciousIpServiceImpl implements MaliciousIpService {
return new BaseResponse<>(pageResp);
}
public BaseResponse getForbidMipsInfoToOpsDb(MaliciousIpRecordReq request){
PageBean page = PageBean.initPageInfo(request.getCurrentPage(), request.getPageSize(), request);
maliciousIpsRecordForbidMapper.selectByPage(page);
// 先查询符合条件的总数量
int total = maliciousIpsRecordForbidMapper.selectCount(page);
// 数量为0 直接返回
if (total == 0) {
return new BaseResponse<>();
}
// 获取列表
List<MaliciousIpsRecordForbid> ls = maliciousIpsRecordForbidMapper.selectByPage(page);
if (org.springframework.util.CollectionUtils.isEmpty(ls)) {
return new BaseResponse<>();
}
//解析reason到汉字
for(MaliciousIpsRecordForbid record:ls){
String reasonForbid=record.getReason();
if(StringUtils.isNotBlank(reasonForbid)){
try{
MaliciousIpModel model=JSON.parseObject(reasonForbid,MaliciousIpModel.class);
reasonForbid=model.toHtmlString4DB();
record.setReason(reasonForbid);
}catch (Exception e){
///查询异常就不管了
}
}
}
PageResponse<MaliciousIpsRecordForbid> pageResp = new PageResponse<>();
pageResp.setCurrentPage(request.getCurrentPage());
pageResp.setPageSize(request.getPageSize());
pageResp.setTotal(total);
pageResp.setRows(ls);
return new BaseResponse<>(pageResp);
}
/**
*从运维系统的redis查询恶意ip,并且从influxdb中取对应的ip信息
*/
... ...