Andrew Shvayka
4 years ago
committed by
GitHub
GitHub
25 changed files with 399 additions and 26 deletions
@ -0,0 +1,46 @@ |
|||
/** |
|||
* Copyright © 2016-2021 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.transport.mqtt.limits; |
|||
|
|||
import io.netty.channel.ChannelHandlerContext; |
|||
import io.netty.channel.ChannelInboundHandlerAdapter; |
|||
import io.netty.handler.codec.haproxy.HAProxyMessage; |
|||
import io.netty.handler.ipfilter.AbstractRemoteAddressFilter; |
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.thingsboard.server.transport.mqtt.MqttTransportContext; |
|||
import org.thingsboard.server.transport.mqtt.MqttTransportService; |
|||
|
|||
import java.net.InetSocketAddress; |
|||
|
|||
@Slf4j |
|||
public class IpFilter extends AbstractRemoteAddressFilter<InetSocketAddress> { |
|||
|
|||
private MqttTransportContext context; |
|||
|
|||
public IpFilter(MqttTransportContext context) { |
|||
this.context = context; |
|||
} |
|||
|
|||
@Override |
|||
protected boolean accept(ChannelHandlerContext ctx, InetSocketAddress remoteAddress) throws Exception { |
|||
if(context.checkAddress(remoteAddress)){ |
|||
ctx.channel().attr(MqttTransportService.ADDRESS).set(remoteAddress); |
|||
return true; |
|||
} else { |
|||
return false; |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,60 @@ |
|||
/** |
|||
* Copyright © 2016-2021 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.transport.mqtt.limits; |
|||
|
|||
import io.netty.channel.ChannelHandlerContext; |
|||
import io.netty.channel.ChannelInboundHandlerAdapter; |
|||
import io.netty.handler.codec.haproxy.HAProxyMessage; |
|||
import io.netty.util.AttributeKey; |
|||
import lombok.extern.slf4j.Slf4j; |
|||
import org.thingsboard.server.transport.mqtt.MqttTransportContext; |
|||
import org.thingsboard.server.transport.mqtt.MqttTransportService; |
|||
|
|||
import java.net.InetAddress; |
|||
import java.net.InetSocketAddress; |
|||
|
|||
@Slf4j |
|||
public class ProxyIpFilter extends ChannelInboundHandlerAdapter { |
|||
|
|||
|
|||
private MqttTransportContext context; |
|||
|
|||
public ProxyIpFilter(MqttTransportContext context) { |
|||
this.context = context; |
|||
} |
|||
|
|||
@Override |
|||
public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception { |
|||
if(msg instanceof HAProxyMessage){ |
|||
HAProxyMessage proxyMsg = (HAProxyMessage) msg; |
|||
if(proxyMsg.sourceAddress() != null && proxyMsg.sourcePort() > 0) { |
|||
InetSocketAddress address = new InetSocketAddress(proxyMsg.sourceAddress(), proxyMsg.sourcePort()); |
|||
if(!context.checkAddress(address)){ |
|||
ctx.close(); |
|||
} else { |
|||
ctx.channel().attr(MqttTransportService.ADDRESS).set(address); |
|||
// We no longer need this channel in the pipeline. Similar to HAProxyMessageDecoder
|
|||
ctx.pipeline().remove(this); |
|||
} |
|||
} else { |
|||
log.debug("Received local health-check connection message: {}", proxyMsg); |
|||
ctx.close(); |
|||
} |
|||
} else { |
|||
super.channelRead(ctx, msg); |
|||
} |
|||
} |
|||
} |
|||
@ -0,0 +1,33 @@ |
|||
/** |
|||
* Copyright © 2016-2021 The Thingsboard Authors |
|||
* |
|||
* Licensed under the Apache License, Version 2.0 (the "License"); |
|||
* you may not use this file except in compliance with the License. |
|||
* You may obtain a copy of the License at |
|||
* |
|||
* http://www.apache.org/licenses/LICENSE-2.0
|
|||
* |
|||
* Unless required by applicable law or agreed to in writing, software |
|||
* distributed under the License is distributed on an "AS IS" BASIS, |
|||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|||
* See the License for the specific language governing permissions and |
|||
* limitations under the License. |
|||
*/ |
|||
package org.thingsboard.server.common.transport.limits; |
|||
|
|||
import lombok.Data; |
|||
|
|||
import java.util.concurrent.locks.Lock; |
|||
import java.util.concurrent.locks.ReentrantLock; |
|||
|
|||
@Data |
|||
public class InetAddressRateLimitStats { |
|||
|
|||
private final Lock lock = new ReentrantLock(); |
|||
|
|||
private boolean blocked; |
|||
private long lastActivityTs; |
|||
private int failureCount; |
|||
private int connectionsCount; |
|||
|
|||
} |
|||
Loading…
Reference in new issue