Andrew Shvayka
5 years ago
committed by
GitHub
GitHub
25 changed files with 399 additions and 26 deletions
@ -0,0 +1,46 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.mqtt.limits; |
||||
|
|
||||
|
import io.netty.channel.ChannelHandlerContext; |
||||
|
import io.netty.channel.ChannelInboundHandlerAdapter; |
||||
|
import io.netty.handler.codec.haproxy.HAProxyMessage; |
||||
|
import io.netty.handler.ipfilter.AbstractRemoteAddressFilter; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.thingsboard.server.transport.mqtt.MqttTransportContext; |
||||
|
import org.thingsboard.server.transport.mqtt.MqttTransportService; |
||||
|
|
||||
|
import java.net.InetSocketAddress; |
||||
|
|
||||
|
@Slf4j |
||||
|
public class IpFilter extends AbstractRemoteAddressFilter<InetSocketAddress> { |
||||
|
|
||||
|
private MqttTransportContext context; |
||||
|
|
||||
|
public IpFilter(MqttTransportContext context) { |
||||
|
this.context = context; |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
protected boolean accept(ChannelHandlerContext ctx, InetSocketAddress remoteAddress) throws Exception { |
||||
|
if(context.checkAddress(remoteAddress)){ |
||||
|
ctx.channel().attr(MqttTransportService.ADDRESS).set(remoteAddress); |
||||
|
return true; |
||||
|
} else { |
||||
|
return false; |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,60 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.transport.mqtt.limits; |
||||
|
|
||||
|
import io.netty.channel.ChannelHandlerContext; |
||||
|
import io.netty.channel.ChannelInboundHandlerAdapter; |
||||
|
import io.netty.handler.codec.haproxy.HAProxyMessage; |
||||
|
import io.netty.util.AttributeKey; |
||||
|
import lombok.extern.slf4j.Slf4j; |
||||
|
import org.thingsboard.server.transport.mqtt.MqttTransportContext; |
||||
|
import org.thingsboard.server.transport.mqtt.MqttTransportService; |
||||
|
|
||||
|
import java.net.InetAddress; |
||||
|
import java.net.InetSocketAddress; |
||||
|
|
||||
|
@Slf4j |
||||
|
public class ProxyIpFilter extends ChannelInboundHandlerAdapter { |
||||
|
|
||||
|
|
||||
|
private MqttTransportContext context; |
||||
|
|
||||
|
public ProxyIpFilter(MqttTransportContext context) { |
||||
|
this.context = context; |
||||
|
} |
||||
|
|
||||
|
@Override |
||||
|
public void channelRead(ChannelHandlerContext ctx, Object msg) throws Exception { |
||||
|
if(msg instanceof HAProxyMessage){ |
||||
|
HAProxyMessage proxyMsg = (HAProxyMessage) msg; |
||||
|
if(proxyMsg.sourceAddress() != null && proxyMsg.sourcePort() > 0) { |
||||
|
InetSocketAddress address = new InetSocketAddress(proxyMsg.sourceAddress(), proxyMsg.sourcePort()); |
||||
|
if(!context.checkAddress(address)){ |
||||
|
ctx.close(); |
||||
|
} else { |
||||
|
ctx.channel().attr(MqttTransportService.ADDRESS).set(address); |
||||
|
// We no longer need this channel in the pipeline. Similar to HAProxyMessageDecoder
|
||||
|
ctx.pipeline().remove(this); |
||||
|
} |
||||
|
} else { |
||||
|
log.debug("Received local health-check connection message: {}", proxyMsg); |
||||
|
ctx.close(); |
||||
|
} |
||||
|
} else { |
||||
|
super.channelRead(ctx, msg); |
||||
|
} |
||||
|
} |
||||
|
} |
||||
@ -0,0 +1,33 @@ |
|||||
|
/** |
||||
|
* Copyright © 2016-2021 The Thingsboard Authors |
||||
|
* |
||||
|
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
|
* you may not use this file except in compliance with the License. |
||||
|
* You may obtain a copy of the License at |
||||
|
* |
||||
|
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
* |
||||
|
* Unless required by applicable law or agreed to in writing, software |
||||
|
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
|
* See the License for the specific language governing permissions and |
||||
|
* limitations under the License. |
||||
|
*/ |
||||
|
package org.thingsboard.server.common.transport.limits; |
||||
|
|
||||
|
import lombok.Data; |
||||
|
|
||||
|
import java.util.concurrent.locks.Lock; |
||||
|
import java.util.concurrent.locks.ReentrantLock; |
||||
|
|
||||
|
@Data |
||||
|
public class InetAddressRateLimitStats { |
||||
|
|
||||
|
private final Lock lock = new ReentrantLock(); |
||||
|
|
||||
|
private boolean blocked; |
||||
|
private long lastActivityTs; |
||||
|
private int failureCount; |
||||
|
private int connectionsCount; |
||||
|
|
||||
|
} |
||||
Loading…
Reference in new issue