nebula2.0.1的thriftserver服务问题

laughing · 2021 年8 月 22 日 13:25

nebula版本：2.0.1

您好，因为nebula的thrift通信，是无ip的白名单限制的。只能通过iptables防火墙来设置。我想尝试下利用thrfitserver的接口。在thriftserver的服务端这边，获取到客户端的ip。基于ip是否在名单里，从而允许此连接accept。

以nebula-storage为例

github.com

vesoft-inc/nebula-storage/blob/v2.0.1/src/daemons/MetaDaemon.cpp

/* Copyright (c) 2018 vesoft inc. All rights reserved.
 *
 * This source code is licensed under Apache 2.0 License,
 * attached with Common Clause Condition 1.0, found in the LICENSES directory.
 */

#include "common/base/Base.h"
#include "common/base/SignalHandler.h"
#include "common/webservice/Router.h"
#include "common/webservice/WebService.h"
#include "common/network/NetworkUtils.h"
#include "common/process/ProcessUtils.h"
#include "common/hdfs/HdfsHelper.h"
#include "common/hdfs/HdfsCommandHelper.h"
#include "common/thread/GenericThreadPool.h"
#include "common/time/TimeUtils.h"
#include "common/version/Version.h"
#include <thrift/lib/cpp2/server/ThriftServer.h>
#include "kvstore/PartManager.h"
#include "kvstore/NebulaStore.h"

该文件已被截断。显示原文

gServer仅有setServerEventHandler可以使用，仅仅能获取到客户端ip。
gServer的setServerEventHandler可以实现 TServerEventHandler。

github.com

facebook/fbthrift/blob/v2018.08.06.00/thrift/lib/cpp/server/TServerEventHandler.h

/*
 * Copyright 2018-present Facebook, Inc.
 *
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements. See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership. The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License. You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing,
 * software distributed under the License is distributed on an
 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
 * KIND, either express or implied. See the License for the
 * specific language governing permissions and limitations
 * under the License.
 */

该文件已被截断。显示原文

TServerEventHandler的connectionNewRequest、newConnection两个方法。等于这个连接已经被accept了。

想请教下。gServer哪里可以实现自定义对应的连接，从而判断ip是否在名单内，从而accept此连接

laughing · 2021 年8 月 23 日 02:17

社区人员能不能给点提示

Shylock-Hg · 2021 年8 月 24 日 02:22

ThrfitServer::setAcceptorFactory这个方法

然后定制一个Wangle::Acceptor,主要是重写canAccept这个方法

Shylock-Hg · 2021 年8 月 24 日 02:28

如果完成了，欢迎同步上上游

laughing · 2021 年9 月 1 日 02:32

我目前是这个方案：

ThrfitServer::setAcceptorFactory这个方法，

然后重写wangle/acceptor/Acceptor.h里面的AcceptorFactory。

然后。给Acceptor的LoadShedConfiguration对象加入ip白名单的地址。
这样，每次直接调用canAccept的时候，就会判断白名单了。

无需重写canAccept这个方法
以下是canAccept方法的开源代码：

github.com

facebook/wangle/blob/v2018.08.20.00/wangle/acceptor/Acceptor.cpp

/*
 * Copyright 2017-present Facebook, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *   http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include <wangle/acceptor/Acceptor.h>

#include <wangle/acceptor/ManagedConnection.h>
#include <wangle/ssl/SSLContextManager.h>
#include <wangle/acceptor/AcceptorHandshakeManager.h>

该文件已被截断。显示原文

loadShedConfig_.isWhitelisted(address) 白名单的实现。

可是，目前我自定义了ThrfitServer::setAcceptorFactory，发现ThrfitServer每次调用，并没调用到setAcceptorFactory的自定义类的实现。看了fbthrift源码的测试用例、demo也没类似案例代码。所以目前有点疑惑，ThrfitServer::setAcceptorFactory确定是否能走自定义的Acceptor类。
实施的时候卡在这里了

Shylock-Hg · 2021 年9 月 1 日 02:34

你要手动调用setAcceptorFactory

laughing · 2021 年9 月 1 日 02:36

laughing:

pplicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.

github.com

vesoft-inc/nebula-storage/blob/v2.0.1/src/daemons/MetaDaemon.cpp

/* Copyright (c) 2018 vesoft inc. All rights reserved.
 *
 * This source code is licensed under Apache 2.0 License,
 * attached with Common Clause Condition 1.0, found in the LICENSES directory.
 */

#include "common/base/Base.h"
#include "common/base/SignalHandler.h"
#include "common/webservice/Router.h"
#include "common/webservice/WebService.h"
#include "common/network/NetworkUtils.h"
#include "common/process/ProcessUtils.h"
#include "common/hdfs/HdfsHelper.h"
#include "common/hdfs/HdfsCommandHelper.h"
#include "common/thread/GenericThreadPool.h"
#include "common/time/TimeUtils.h"
#include "common/version/Version.h"
#include <thrift/lib/cpp2/server/ThriftServer.h>
#include "kvstore/PartManager.h"
#include "kvstore/NebulaStore.h"

该文件已被截断。显示原文

举例，MetaDaemon.cpp的

gServer->setAcceptorFactory(XXXXAcceptorFactory);这么调用。自定义一个自定义的XXXXAcceptorFactory。

laughing · 2021 年9 月 1 日 02:37

就是这样吧。那我再仔细看下调用不到的原因。我目前就想按照上面方案。canAccept其实已经有白名单了。我直接对LoadShedConfiguration里面set白名单

Shylock-Hg · 2021 年9 月 1 日 02:43

是的，这个是要你手动调用的

Shylock-Hg · 2021 年9 月 1 日 02:44

那确实不用重写，这个我也没细看

laughing · 2021 年9 月 1 日 02:48

针对白名单。要是支持动态扩容，有没有好的方案，我想通过配置文件加载，白名单ip放置在meta里面，通过leader获取。

Shylock-Hg · 2021 年9 月 1 日 03:08

你这个应该不是我们用的wangle版本，我们用的v2021.03.01.00

Shylock-Hg · 2021 年9 月 1 日 03:09

可以的，你可以从meta获取configuration，然后canAccept里面判断一下

laughing · 2021 年9 月 1 日 06:21

三方库我是使用开源图的脚本自己编译的。

github.com

vesoft-inc/nebula-common/blob/v2.0.1/third-party/externals/wangle.cmake

# Copyright (c) 2019 vesoft inc. All rights reserved.
#
# This source code is licensed under Apache 2.0 License,
# attached with Common Clause Condition 1.0, found in the LICENSES directory.

set(name wangle)
set(source_dir ${CMAKE_CURRENT_BINARY_DIR}/${name}/source)
ExternalProject_Add(
    ${name}
    URL https://github.com/facebook/wangle/archive/v2018.08.20.00.tar.gz
    URL_HASH MD5=b20856081c1d21c1a033f9ca161398c5
    DOWNLOAD_NAME wangle-2018-08-20.tar.gz
    PREFIX ${CMAKE_CURRENT_BINARY_DIR}/${name}
    TMP_DIR ${BUILD_INFO_DIR}
    STAMP_DIR ${BUILD_INFO_DIR}
    DOWNLOAD_DIR ${DOWNLOAD_DIR}
    SOURCE_DIR ${source_dir}
    CONFIGURE_COMMAND ""
    BUILD_COMMAND make -s -j${BUILDING_JOBS_NUM} -C wangle
    BUILD_IN_SOURCE 1

该文件已被截断。显示原文

这里显示是2018版本
只有
nebula-third-party的master分支，wangle的版本才是v2021.03.01.00。 2.0.1的第三方库采用是这个仓库的master分支吗

github.com

vesoft-inc/nebula-third-party/blob/master/project/externals/wangle.cmake

# Copyright (c) 2019 vesoft inc. All rights reserved.
#
# This source code is licensed under Apache 2.0 License.

set(name wangle)
set(source_dir ${CMAKE_CURRENT_BINARY_DIR}/${name}/source)
ExternalProject_Add(
    ${name}
    URL https://github.com/facebook/wangle/archive/refs/tags/v2022.12.26.00.tar.gz
    URL_HASH MD5=8e3200855c6382bf40ec2051e467cdab
    DOWNLOAD_NAME wangle-2022-12-26.tar.gz
    PREFIX ${CMAKE_CURRENT_BINARY_DIR}/${name}
    TMP_DIR ${BUILD_INFO_DIR}
    STAMP_DIR ${BUILD_INFO_DIR}
    DOWNLOAD_DIR ${DOWNLOAD_DIR}
    SOURCE_DIR ${source_dir}
    CONFIGURE_COMMAND ""
    BUILD_COMMAND make -s -j${BUILDING_JOBS_NUM} -C wangle
    BUILD_IN_SOURCE 1
    INSTALL_COMMAND make -s -j${BUILDING_JOBS_NUM} install -C wangle

该文件已被截断。显示原文

Shylock-Hg · 2021 年9 月 1 日 06:33

抱歉，没注意你的版本，那应该没问题

laughing · 2021 年9 月 1 日 06:53

那2.0.1的图，wangle和fbthrefit。也可以升级v2021.03.01.00。你们现在最新的第三方库采用的应该就是
nebula-third-party的master分支。是吧。

因为我发现在wangle以及fbthrefit的v2021.03.01.00版本，实现自定义accept的方式更加方便。api里面也有完整的案例

Shylock-Hg · 2021 年9 月 1 日 07:47

2.0.1可能需要修改源码才能升级，建议你直接用新版本

system · 2021 年10 月 1 日 07:47

此话题已在最后回复的 30 天后被自动关闭。不再允许新回复。