real-ip 客户端IP插件。

关键属性

源码解析

real-ip 插件用于动态改变传递到 APISIX 的客户端的 IP 和端口。

local function get_addr(conf, ctx)if conf.source == "http_x_forwarded_for" then-- use the last address from X-Forwarded-For header-- 用最后一个地址local addrs = core.request.header(ctx, "X-Forwarded-For")if not addrs thenreturn nilendif type(addrs) == "table" thenaddrs = addrs[#addrs]endlocal idx = core.string.rfind_char(addrs, ",")if not idx thenreturn addrsendfor i = idx + 1, #addrs doif str_byte(addrs, i) == str_byte(" ") thenidx = idx + 1elsebreakendendreturn str_sub(addrs, idx + 1)endreturn ctx.var[conf.source]
endfunction _M.rewrite(conf, ctx)if not is_apisix_or thencore.log.error("need to build APISIX-OpenResty to support setting real ip")return 501endif conf.trusted_addresses thenif not conf.matcher thenconf.matcher = core.ip.create_ip_matcher(conf.trusted_addresses)end-- 校验是否在范围内local remote_addr = ctx.var.remote_addrlocal trusted = conf.matcher:match(remote_addr)if not trusted thenreturnendendlocal addr = get_addr(conf, ctx)if not addr thencore.log.warn("missing real address")returnendlocal ip, port = core.utils.parse_addr(addr)if not ip or (not core.utils.parse_ipv4(ip) and not core.utils.parse_ipv6(ip)) thencore.log.warn("bad address: ", addr)returnendif str_byte(ip, 1, 1) == str_byte("[") then-- For IPv6, the `set_real_ip` accepts '::1' but not '[::1]'ip = str_sub(ip, 2, #ip - 1)end-- 端口范围正常时在 1到65535之间if port ~= nil and (port < 1 or port > 65535) thencore.log.warn("bad port: ", port)returnendcore.log.info("set real ip: ", ip, ", port: ", port)local ok, err = client.set_real_ip(ip, port)if not ok thencore.log.error("failed to set real ip: ", err)returnend-- flush cached vars in APISIXctx.var.remote_addr = nilctx.var.remote_port = nilctx.var.realip_remote_addr = nilctx.var.realip_remote_port = nil
end