You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by GitBox <gi...@apache.org> on 2022/11/29 06:16:13 UTC
[GitHub] [dubbo] Koooooo-7 opened a new pull request, #11051: update(qos): support foreign ip whitelist.
Koooooo-7 opened a new pull request, #11051:
URL: https://github.com/apache/dubbo/pull/11051
## What is the purpose of the change
> Currently, Dubbo qos only support qosAcceptForeignIp and this will deny all of the foreign ips, we may need support foreign ip whitelist.
close #11014
## Brief changelog
Support config `qos.accept.foreign.ip.whitelist` with `full match ip and escaped regex`, delimiter is `;`. i.e.
`qos.accept.foreign.ip.whitelist=172.12.32.1; ~175\\.\\d{1,3}\\.\\d{1,3}.\\d{1,3}`
## Verifying this change
<!-- Follow this checklist to help us incorporate your contribution quickly and easily: -->
## Checklist
- [x] Make sure there is a [GitHub_issue](https://github.com/apache/dubbo/issues) field for the change (usually before you start working on it). Trivial changes like typos do not require a GitHub issue. Your pull request should address just this issue, without pulling in other changes - one PR resolves one issue.
- [x] Each commit in the pull request should have a meaningful subject line and body.
- [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [x] Check if is necessary to patch to Dubbo 3 if you are work on Dubbo 2.7
- [x] Write necessary unit-test to verify your logic correction, more mock a little better when cross module dependency exist. If the new feature or significant change is committed, please remember to add sample in [dubbo samples](https://github.com/apache/dubbo-samples) project.
- [ ] Add some description to [dubbo-website](https://github.com/apache/dubbo-website) project if you are requesting to add a feature.
- [ ] GitHub Actions works fine on your own branch.
- [ ] If this contribution is large, please follow the [Software Donation Guide](https://github.com/apache/dubbo/wiki/Software-donation-guide).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] sonarcloud[bot] commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1330583921
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_dubbo&pullRequest=11051)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list) [79.2% Coverage](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] AlbumenJ commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
AlbumenJ commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1335157850
https://dubbo.apache.org/zh/docs3-v2/java-sdk/reference-manual/qos/overview/
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] sonarcloud[bot] commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1330570804
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_dubbo&pullRequest=11051)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [1 Code Smell](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list) [79.2% Coverage](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] sonarcloud[bot] commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1331714250
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_dubbo&pullRequest=11051)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [0 Code Smells](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list) [79.6% Coverage](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034763822
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
// true means to accept foreign IP
private boolean acceptForeignIp;
- public LocalHostPermitHandler(boolean acceptForeignIp) {
+ // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
+ // support specific ip and an ip range from CIDR specification
+ private String acceptForeignIpWhitelist;
+ private Predicate<String> whitelistPredicate = foreignIp -> false;
+
+ public LocalHostPermitHandler(boolean acceptForeignIp, String foreignIpWhitelist) {
this.acceptForeignIp = acceptForeignIp;
+ this.acceptForeignIpWhitelist = foreignIpWhitelist;
+ if (StringUtils.isNotEmpty(foreignIpWhitelist)) {
+ whitelistPredicate = Arrays.stream(foreignIpWhitelist.split(","))
+ .map(String::trim)
+ .filter(StringUtils::isNotEmpty)
+ .map(item -> (Predicate<String>) (foreignIp) -> {
+ try {
+ if (!item.contains("/")) {
+ return StringUtils.isEquals(item, foreignIp);
+ }
+ return new CIDRUtils(item).isInRange(foreignIp);
Review Comment:
Updated, a tricky part, hard port to -1 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034763822
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
// true means to accept foreign IP
private boolean acceptForeignIp;
- public LocalHostPermitHandler(boolean acceptForeignIp) {
+ // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
+ // support specific ip and an ip range from CIDR specification
+ private String acceptForeignIpWhitelist;
+ private Predicate<String> whitelistPredicate = foreignIp -> false;
+
+ public LocalHostPermitHandler(boolean acceptForeignIp, String foreignIpWhitelist) {
this.acceptForeignIp = acceptForeignIp;
+ this.acceptForeignIpWhitelist = foreignIpWhitelist;
+ if (StringUtils.isNotEmpty(foreignIpWhitelist)) {
+ whitelistPredicate = Arrays.stream(foreignIpWhitelist.split(","))
+ .map(String::trim)
+ .filter(StringUtils::isNotEmpty)
+ .map(item -> (Predicate<String>) (foreignIp) -> {
+ try {
+ if (!item.contains("/")) {
+ return StringUtils.isEquals(item, foreignIp);
+ }
+ return new CIDRUtils(item).isInRange(foreignIp);
Review Comment:
Renamed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] AlbumenJ merged pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
AlbumenJ merged PR #11051:
URL: https://github.com/apache/dubbo/pull/11051
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] sonarcloud[bot] commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
sonarcloud[bot] commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1330166833
Kudos, SonarCloud Quality Gate passed! [](https://sonarcloud.io/dashboard?id=apache_dubbo&pullRequest=11051)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG) [0 Bugs](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=BUG)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY) [0 Vulnerabilities](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=VULNERABILITY)
[](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT) [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=apache_dubbo&pullRequest=11051&resolved=false&types=SECURITY_HOTSPOT)
[](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL) [2 Code Smells](https://sonarcloud.io/project/issues?id=apache_dubbo&pullRequest=11051&resolved=false&types=CODE_SMELL)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list) [82.4% Coverage](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_coverage&view=list)
[](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list) [0.0% Duplication](https://sonarcloud.io/component_measures?id=apache_dubbo&pullRequest=11051&metric=new_duplicated_lines_density&view=list)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] AlbumenJ commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
AlbumenJ commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034669095
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
// true means to accept foreign IP
private boolean acceptForeignIp;
- public LocalHostPermitHandler(boolean acceptForeignIp) {
+ // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
+ // support specific ip and an ip range from CIDR specification
+ private String acceptForeignIpWhitelist;
+ private Predicate<String> whitelistPredicate = foreignIp -> false;
+
+ public LocalHostPermitHandler(boolean acceptForeignIp, String foreignIpWhitelist) {
this.acceptForeignIp = acceptForeignIp;
+ this.acceptForeignIpWhitelist = foreignIpWhitelist;
+ if (StringUtils.isNotEmpty(foreignIpWhitelist)) {
+ whitelistPredicate = Arrays.stream(foreignIpWhitelist.split(","))
+ .map(String::trim)
+ .filter(StringUtils::isNotEmpty)
+ .map(item -> (Predicate<String>) (foreignIp) -> {
+ try {
+ if (!item.contains("/")) {
+ return StringUtils.isEquals(item, foreignIp);
+ }
+ return new CIDRUtils(item).isInRange(foreignIp);
Review Comment:
use `org.apache.dubbo.common.utils.NetUtils#matchIpExpression`
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
Review Comment:
Pls rename this class
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 closed pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 closed pull request #11051: update(qos): support foreign ip whitelist.
URL: https://github.com/apache/dubbo/pull/11051
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] codecov-commenter commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
codecov-commenter commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1330585851
# [Codecov](https://codecov.io/gh/apache/dubbo/pull/11051?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) Report
> Merging [#11051](https://codecov.io/gh/apache/dubbo/pull/11051?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (932a772) into [3.1](https://codecov.io/gh/apache/dubbo/commit/4568958ef597e878fb5b4f318fa06d04a779cfd6?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) (4568958) will **decrease** coverage by `1.12%`.
> The diff coverage is `75.00%`.
```diff
@@ Coverage Diff @@
## 3.1 #11051 +/- ##
============================================
- Coverage 65.66% 64.54% -1.13%
+ Complexity 20 14 -6
============================================
Files 1418 1418
Lines 58937 58964 +27
Branches 8676 8651 -25
============================================
- Hits 38699 38056 -643
- Misses 16220 16870 +650
- Partials 4018 4038 +20
```
| [Impacted Files](https://codecov.io/gh/apache/dubbo/pull/11051?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | Coverage Δ | |
|---|---|---|
| [...c/main/java/org/apache/dubbo/config/Constants.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tY29tbW9uL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9kdWJiby9jb25maWcvQ29uc3RhbnRzLmphdmE=) | `100.00% <ø> (ø)` | |
| [.../java/org/apache/dubbo/qos/pu/QosWireProtocol.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcGx1Z2luL2R1YmJvLXFvcy9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcW9zL3B1L1Fvc1dpcmVQcm90b2NvbC5qYXZh) | `40.00% <ø> (ø)` | |
| [...ava/org/apache/dubbo/config/ApplicationConfig.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tY29tbW9uL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9kdWJiby9jb25maWcvQXBwbGljYXRpb25Db25maWcuamF2YQ==) | `83.92% <33.33%> (-1.88%)` | :arrow_down: |
| [.../main/java/org/apache/dubbo/qos/server/Server.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcGx1Z2luL2R1YmJvLXFvcy9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcW9zL3NlcnZlci9TZXJ2ZXIuamF2YQ==) | `80.00% <75.00%> (+1.27%)` | :arrow_up: |
| [...bbo/qos/server/handler/LocalHostPermitHandler.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcGx1Z2luL2R1YmJvLXFvcy9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcW9zL3NlcnZlci9oYW5kbGVyL0xvY2FsSG9zdFBlcm1pdEhhbmRsZXIuamF2YQ==) | `80.64% <79.31%> (+2.86%)` | :arrow_up: |
| [.../apache/dubbo/qos/protocol/QosProtocolWrapper.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcGx1Z2luL2R1YmJvLXFvcy9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcW9zL3Byb3RvY29sL1Fvc1Byb3RvY29sV3JhcHBlci5qYXZh) | `87.23% <100.00%> (+0.56%)` | :arrow_up: |
| [...he/dubbo/qos/server/handler/QosProcessHandler.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcGx1Z2luL2R1YmJvLXFvcy9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcW9zL3NlcnZlci9oYW5kbGVyL1Fvc1Byb2Nlc3NIYW5kbGVyLmphdmE=) | `59.45% <100.00%> (+1.12%)` | :arrow_up: |
| [...luster/router/script/ScriptStateRouterFactory.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tY2x1c3Rlci9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vcnBjL2NsdXN0ZXIvcm91dGVyL3NjcmlwdC9TY3JpcHRTdGF0ZVJvdXRlckZhY3RvcnkuamF2YQ==) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [...he/dubbo/test/common/impl/GreetingServiceImpl.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tdGVzdC9kdWJiby10ZXN0LWNvbW1vbi9zcmMvbWFpbi9qYXZhL29yZy9hcGFjaGUvZHViYm8vdGVzdC9jb21tb24vaW1wbC9HcmVldGluZ1NlcnZpY2VJbXBsLmphdmE=) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| [...zookeeper/curator/CuratorZookeeperTransporter.java](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation#diff-ZHViYm8tcmVtb3RpbmcvZHViYm8tcmVtb3Rpbmctem9va2VlcGVyL3NyYy9tYWluL2phdmEvb3JnL2FwYWNoZS9kdWJiby9yZW1vdGluZy96b29rZWVwZXIvY3VyYXRvci9DdXJhdG9yWm9va2VlcGVyVHJhbnNwb3J0ZXIuamF2YQ==) | `0.00% <0.00%> (-100.00%)` | :arrow_down: |
| ... and [112 more](https://codecov.io/gh/apache/dubbo/pull/11051/diff?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation) | |
:mega: We’re building smart automated test selection to slash your CI/CD build times. [Learn more](https://about.codecov.io/iterative-testing/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=The+Apache+Software+Foundation)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034763822
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
// true means to accept foreign IP
private boolean acceptForeignIp;
- public LocalHostPermitHandler(boolean acceptForeignIp) {
+ // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
+ // support specific ip and an ip range from CIDR specification
+ private String acceptForeignIpWhitelist;
+ private Predicate<String> whitelistPredicate = foreignIp -> false;
+
+ public LocalHostPermitHandler(boolean acceptForeignIp, String foreignIpWhitelist) {
this.acceptForeignIp = acceptForeignIp;
+ this.acceptForeignIpWhitelist = foreignIpWhitelist;
+ if (StringUtils.isNotEmpty(foreignIpWhitelist)) {
+ whitelistPredicate = Arrays.stream(foreignIpWhitelist.split(","))
+ .map(String::trim)
+ .filter(StringUtils::isNotEmpty)
+ .map(item -> (Predicate<String>) (foreignIp) -> {
+ try {
+ if (!item.contains("/")) {
+ return StringUtils.isEquals(item, foreignIp);
+ }
+ return new CIDRUtils(item).isInRange(foreignIp);
Review Comment:
Updated, a tricky part, hard code port to -1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] AlbumenJ commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
AlbumenJ commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1335157513
@Koooooo-7 Would you please help update the docs in dubbo-website?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034763822
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
// true means to accept foreign IP
private boolean acceptForeignIp;
- public LocalHostPermitHandler(boolean acceptForeignIp) {
+ // the whitelist of foreign IP when acceptForeignIp = false, the delimiter is colon(,)
+ // support specific ip and an ip range from CIDR specification
+ private String acceptForeignIpWhitelist;
+ private Predicate<String> whitelistPredicate = foreignIp -> false;
+
+ public LocalHostPermitHandler(boolean acceptForeignIp, String foreignIpWhitelist) {
this.acceptForeignIp = acceptForeignIp;
+ this.acceptForeignIpWhitelist = foreignIpWhitelist;
+ if (StringUtils.isNotEmpty(foreignIpWhitelist)) {
+ whitelistPredicate = Arrays.stream(foreignIpWhitelist.split(","))
+ .map(String::trim)
+ .filter(StringUtils::isNotEmpty)
+ .map(item -> (Predicate<String>) (foreignIp) -> {
+ try {
+ if (!item.contains("/")) {
+ return StringUtils.isEquals(item, foreignIp);
+ }
+ return new CIDRUtils(item).isInRange(foreignIp);
Review Comment:
Tricky part, hard port to -1 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on a diff in pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on code in PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#discussion_r1034764129
##########
dubbo-plugin/dubbo-qos/src/main/java/org/apache/dubbo/qos/server/handler/LocalHostPermitHandler.java:
##########
@@ -16,33 +16,81 @@
*/
package org.apache.dubbo.qos.server.handler;
-import org.apache.dubbo.qos.common.QosConstants;
-
import io.netty.buffer.ByteBuf;
import io.netty.buffer.Unpooled;
import io.netty.channel.ChannelFutureListener;
import io.netty.channel.ChannelHandlerAdapter;
import io.netty.channel.ChannelHandlerContext;
+import org.apache.dubbo.common.utils.CIDRUtils;
+import org.apache.dubbo.common.utils.StringUtils;
+import org.apache.dubbo.qos.common.QosConstants;
+import java.net.InetAddress;
import java.net.InetSocketAddress;
+import java.net.UnknownHostException;
+import java.util.Arrays;
+import java.util.function.Predicate;
public class LocalHostPermitHandler extends ChannelHandlerAdapter {
Review Comment:
Renamed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1335321601
@AlbumenJ PTAL [dubbo-website/#1623](https://github.com/apache/dubbo-website/pull/1623).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
[GitHub] [dubbo] Koooooo-7 commented on pull request #11051: update(qos): support foreign ip whitelist.
Posted by GitBox <gi...@apache.org>.
Koooooo-7 commented on PR #11051:
URL: https://github.com/apache/dubbo/pull/11051#issuecomment-1335261360
> @Koooooo-7 Would you please help update the docs in dubbo-website?
No prob, gonna update it later. 👌
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org