feature: support server authentication blacklist configuration

core/src/main/java/io/seata/core/constants/ConfigurationKeys.java

@@ -449,6 +449,16 @@ public interface ConfigurationKeys {
      */
     String DISTRIBUTED_LOCK_EXPIRE_TIME = SERVER_PREFIX + "distributedLockExpireTime";
 
+    /**
+     * The constant TM_BLACKLIST
+     */
+    String TM_BLACKLIST = SERVER_PREFIX + "tmBlacklist";
+
+    /**
+     * The constant RM_BLACKLIST
+     */
+    String RM_BLACKLIST = SERVER_PREFIX + "rmBlacklist";
+
     /**
      * The constant MIN_SERVER_POOL_SIZE.
      */

core/src/main/java/io/seata/core/rpc/DefaultServerMessageListenerImpl.java

@@ -112,7 +112,7 @@ public void onRegRmMessage(RpcMessage request, ChannelHandlerContext ctx, Regist
         boolean isSuccess = false;
         String errorInfo = StringUtils.EMPTY;
         try {
-            if (checkAuthHandler == null || checkAuthHandler.regResourceManagerCheckAuth(message)) {
+            if (checkAuthHandler == null || checkAuthHandler.regResourceManagerCheckAuth(ctx)) {
                 ChannelManager.registerRMChannel(message, ctx.channel());
                 Version.putChannelVersion(ctx.channel(), message.getVersion());
                 isSuccess = true;
@@ -144,7 +144,7 @@ public void onRegTmMessage(RpcMessage request, ChannelHandlerContext ctx, Regist
         boolean isSuccess = false;
         String errorInfo = StringUtils.EMPTY;
         try {
-            if (checkAuthHandler == null || checkAuthHandler.regTransactionManagerCheckAuth(message)) {
+            if (checkAuthHandler == null || checkAuthHandler.regTransactionManagerCheckAuth(ctx)) {
                 ChannelManager.registerTMChannel(message, ctx.channel());
                 Version.putChannelVersion(ctx.channel(), message.getVersion());
                 isSuccess = true;

core/src/main/java/io/seata/core/rpc/RegisterCheckAuthHandler.java

@@ -15,8 +15,7 @@
  */
 package io.seata.core.rpc;
 
-import io.seata.core.protocol.RegisterRMRequest;
-import io.seata.core.protocol.RegisterTMRequest;
+import io.netty.channel.ChannelHandlerContext;
 
 /**
  * The interface Register check auth handler.
@@ -28,16 +27,16 @@ public interface RegisterCheckAuthHandler {
     /**
      * Reg transaction manager check auth boolean.
      *
-     * @param request the request
+     * @param ctx the ctx
      * @return the boolean
      */
-    boolean regTransactionManagerCheckAuth(RegisterTMRequest request);
+    boolean regTransactionManagerCheckAuth(ChannelHandlerContext ctx);
 
     /**
      * Reg resource manager check auth boolean.
      *
-     * @param request the request
+     * @param ctx the ctx
      * @return the boolean
      */
-    boolean regResourceManagerCheckAuth(RegisterRMRequest request);
+    boolean regResourceManagerCheckAuth(ChannelHandlerContext ctx);
 }

core/src/main/java/io/seata/core/rpc/processor/server/RegRmProcessor.java

@@ -63,7 +63,7 @@ private void onRegRmMessage(ChannelHandlerContext ctx, RpcMessage rpcMessage) {
         boolean isSuccess = false;
         String errorInfo = StringUtils.EMPTY;
         try {
-            if (null == checkAuthHandler || checkAuthHandler.regResourceManagerCheckAuth(message)) {
+            if (null == checkAuthHandler || checkAuthHandler.regResourceManagerCheckAuth(ctx)) {
                 ChannelManager.registerRMChannel(message, ctx.channel());
                 Version.putChannelVersion(ctx.channel(), message.getVersion());
                 isSuccess = true;

core/src/main/java/io/seata/core/rpc/processor/server/RegTmProcessor.java

@@ -64,7 +64,7 @@ private void onRegTmMessage(ChannelHandlerContext ctx, RpcMessage rpcMessage) {
         boolean isSuccess = false;
         String errorInfo = StringUtils.EMPTY;
         try {
-            if (null == checkAuthHandler || checkAuthHandler.regTransactionManagerCheckAuth(message)) {
+            if (null == checkAuthHandler || checkAuthHandler.regTransactionManagerCheckAuth(ctx)) {
                 ChannelManager.registerTMChannel(message, ctx.channel());
                 Version.putChannelVersion(ctx.channel(), message.getVersion());
                 isSuccess = true;

seata-spring-autoconfigure/seata-spring-autoconfigure-server/src/main/java/io/seata/spring/boot/autoconfigure/properties/server/ServerProperties.java

@@ -34,6 +34,8 @@ public class ServerProperties {
     private Boolean enableCheckAuth = true;
     private Integer retryDeadThreshold = 130000;
     private Integer servicePort;
+    private String tmBlacklist = null;
+    private String rmBlacklist = null;
 
     public Duration getMaxCommitRetryTimeout() {
         return maxCommitRetryTimeout;
@@ -88,4 +90,22 @@ public ServerProperties setServicePort(Integer servicePort) {
         this.servicePort = servicePort;
         return this;
     }
+
+    public String getTmBlacklist() {
+        return tmBlacklist;
+    }
+
+    public ServerProperties setTmBlacklist(String tmBlacklist) {
+        this.tmBlacklist = tmBlacklist;
+        return this;
+    }
+
+    public String getRmBlacklist() {
+        return rmBlacklist;
+    }
+
+    public ServerProperties setRmBlacklist(String rmBlacklist) {
+        this.rmBlacklist = rmBlacklist;
+        return this;
+    }
 }

server/src/main/java/io/seata/server/auth/AbstractCheckAuthHandler.java

@@ -15,10 +15,9 @@
  */
 package io.seata.server.auth;
 
+import io.netty.channel.ChannelHandlerContext;
 import io.seata.config.ConfigurationFactory;
 import io.seata.core.constants.ConfigurationKeys;
-import io.seata.core.protocol.RegisterRMRequest;
-import io.seata.core.protocol.RegisterTMRequest;
 import io.seata.core.rpc.RegisterCheckAuthHandler;
 
 import static io.seata.common.DefaultValues.DEFAULT_SERVER_ENABLE_CHECK_AUTH;
@@ -32,22 +31,22 @@ public abstract class AbstractCheckAuthHandler implements RegisterCheckAuthHandl
         ConfigurationKeys.SERVER_ENABLE_CHECK_AUTH, DEFAULT_SERVER_ENABLE_CHECK_AUTH);
 
     @Override
-    public boolean regTransactionManagerCheckAuth(RegisterTMRequest request) {
+    public boolean regTransactionManagerCheckAuth(ChannelHandlerContext ctx) {
         if (!ENABLE_CHECK_AUTH) {
             return true;
         }
-        return doRegTransactionManagerCheck(request);
+        return doRegTransactionManagerCheck(ctx);
     }
 
-    public abstract boolean doRegTransactionManagerCheck(RegisterTMRequest request);
+    public abstract boolean doRegTransactionManagerCheck(ChannelHandlerContext ctx);
 
     @Override
-    public boolean regResourceManagerCheckAuth(RegisterRMRequest request) {
+    public boolean regResourceManagerCheckAuth(ChannelHandlerContext ctx) {
         if (!ENABLE_CHECK_AUTH) {
             return true;
         }
-        return doRegResourceManagerCheck(request);
+        return doRegResourceManagerCheck(ctx);
     }
 
-    public abstract boolean doRegResourceManagerCheck(RegisterRMRequest request);
+    public abstract boolean doRegResourceManagerCheck(ChannelHandlerContext ctx);
 }

server/src/main/java/io/seata/server/auth/Blacklist.java

@@ -0,0 +1,72 @@
+/*
+ *  Copyright 1999-2019 Seata.io Group.
+ *
+ *  Licensed under the Apache License, Version 2.0 (the "License");
+ *  you may not use this file except in compliance with the License.
+ *  You may obtain a copy of the License at
+ *
+ *       http://www.apache.org/licenses/LICENSE-2.0
+ *
+ *  Unless required by applicable law or agreed to in writing, software
+ *  distributed under the License is distributed on an "AS IS" BASIS,
+ *  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ *  See the License for the specific language governing permissions and
+ *  limitations under the License.
+ */
+package io.seata.server.auth;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.concurrent.CopyOnWriteArrayList;
+
+import io.seata.config.ConfigurationChangeEvent;
+import io.seata.config.ConfigurationChangeListener;
+import io.seata.config.ConfigurationFactory;
+import io.seata.core.constants.ConfigurationKeys;
+
+public class Blacklist {
+
+    private static final long DEFAULT_CONFIG_TIMEOUT = 5000;
+
+    private static final String IP_CONFIG_SPLIT_CHAR = ";";
+
+    private List<String> ipList = new CopyOnWriteArrayList<>();
+
+    public Blacklist(String blacklistConfig) {
+        String ips = ConfigurationFactory.getInstance().getConfig(blacklistConfig);
+        if (ips != null) {
+            String[] ipArray = ips.split(IP_CONFIG_SPLIT_CHAR);
+            Collections.addAll(ipList, ipArray);
+        }
+
+        ConfigurationFactory.getInstance().addConfigListener(blacklistConfig, new ConfigurationChangeListener() {
+            @Override
+            public void onChangeEvent(ConfigurationChangeEvent event) {
+                String currentIps = ConfigurationFactory.getInstance().getLatestConfig(blacklistConfig, null, DEFAULT_CONFIG_TIMEOUT);
+                clear();
+                if (currentIps == null) {
+                    return;
+                }
+                String[] currentIpArray = currentIps.split(IP_CONFIG_SPLIT_CHAR);
+                Collections.addAll(ipList, currentIpArray);
+            }
+        });
+    }
+
+    public void setIpList(List<String> ipList) {
+        this.ipList = ipList;
+    }
+
+    public List<String> getIpList() {
+        return ipList;
+    }
+
+    public void clear() {
+        ipList.clear();
+    }
+
+    public boolean contains(String address) {
+        return ipList.contains(address);
+    }
+}
+

server/src/main/java/io/seata/server/auth/DefaultCheckAuthHandler.java

@@ -15,23 +15,36 @@
  */
 package io.seata.server.auth;
 
+import io.netty.channel.ChannelHandlerContext;
 import io.seata.common.loader.LoadLevel;
-import io.seata.core.protocol.RegisterRMRequest;
-import io.seata.core.protocol.RegisterTMRequest;
+import io.seata.common.util.NetUtil;
+import io.seata.core.constants.ConfigurationKeys;
 
 /**
  * @author slievrly
  */
 @LoadLevel(name = "defaultCheckAuthHandler", order = 100)
 public class DefaultCheckAuthHandler extends AbstractCheckAuthHandler {
 
+    Blacklist tmBlacklist = new Blacklist(ConfigurationKeys.TM_BLACKLIST);
+
+    Blacklist rmBlacklist = new Blacklist(ConfigurationKeys.RM_BLACKLIST);
+
     @Override
-    public boolean doRegTransactionManagerCheck(RegisterTMRequest request) {
+    public boolean doRegTransactionManagerCheck(ChannelHandlerContext ctx) {
+        String ip = NetUtil.toStringAddress(ctx.channel().remoteAddress()).split(":")[0];
+        if (tmBlacklist.contains(ip)) {
+            return false;
+        }
         return true;
     }
 
     @Override
-    public boolean doRegResourceManagerCheck(RegisterRMRequest request) {
+    public boolean doRegResourceManagerCheck(ChannelHandlerContext ctx) {
+        String ip = NetUtil.toStringAddress(ctx.channel().remoteAddress()).split(":")[0];
+        if (rmBlacklist.contains(ip)) {
+            return false;
+        }
         return true;
     }
 }