sequence

This paper mainly studies the authorityFilter of Dubo-Go-proxy

authorityFilter

dubbo-go-proxy/pkg/filter/authority/authority.go

func Init() {
	extension.SetFilterFunc(constant.HTTPAuthorityFilter, authorityFilterFunc())
}

func authorityFilterFunc() context.FilterFunc {
	return New().Do()
}

// authorityFilter is a filter for blacklist/whitelist.
type authorityFilter struct {
}

// New create blacklist/whitelist filter.
func New() filter.Filter {
	return &authorityFilter{}
}
Copy the code

AuthorityFilter toward the extension set called DGP. Filters. HTTP. Authority_filter authorityFilterFunc; This func executes the authorityFilter.do method

Do

dubbo-go-proxy/pkg/filter/authority/authority.go

// Do execute blacklist/whitelist filter logic.
func (f authorityFilter) Do() context.FilterFunc {
	return func(c context.Context) {
		f.doAuthorityFilter(c.(*http.HttpContext))
	}
}
Copy the code

The Do method executes the doAuthorityFilter method

doAuthorityFilter

dubbo-go-proxy/pkg/filter/authority/authority.go

func (f authorityFilter) doAuthorityFilter(c *http.HttpContext) { for _, r := range c.HttpConnectionManager.AuthorityConfig.Rules { item := c.GetClientIP() if r.Limit == model.App { item = c.GetApplicationName() } result := passCheck(item, r) if ! result { c.WriteWithStatus(nh.StatusForbidden, constant.Default403Body) c.Abort() return } } c.Next() }Copy the code

The doAuthorityFilter method iterates through AuthorityConfig Rules and executes passCheck one by one

passCheck

dubbo-go-proxy/pkg/filter/authority/authority.go

func passCheck(item string, rule model.AuthorityRule) bool { result := false for _, it := range rule.Items { if it == item { result = true break } } if (rule.Strategy == model.Blacklist && result == true)  || (rule.Strategy == model.Whitelist && result == false) { return false } return true }Copy the code

The passCheck method iterates through rule-items and checks whether clientIP matches a Blacklist or Whitelist one by one

summary

The authorityFilter of the Dubbo-go-proxy passes through the Rules of AuthorityConfig and checks whether clientIP matches the Blacklist or Whitelist one by one. If the matches fail, StatusForbidden is returned.

doc

  • dubbo-go-proxy