Zuul：限流
充當(dāng)?shù)氖茿PI網(wǎng)關(guān)的角色,每個(gè)請(qǐng)求都會(huì)經(jīng)過他,所以很適合在上面做API保護(hù),防止攻擊,比如某個(gè)API是發(fā)短信的,可能需要限制客戶端的請(qǐng)求速率,一定程度上抵制短信轟炸攻擊,降低損失,速度限流是放到前置過濾里面去做的,更具體一點(diǎn)來說,時(shí)機(jī)是在轉(zhuǎn)發(fā)之前調(diào)用,如果是前置過濾器有多個(gè)操作,限流要放到最靠前面的地方,比如Zuul的過濾器里面有限流,又有鑒權(quán),那么限流應(yīng)該早于限權(quán),限流的方案很多,這里我也不列舉太多了,我就拿一種來說,也是我們要實(shí)現(xiàn)的,也是比較廣泛的,叫令牌桶限流,中間就是一個(gè)桶,里面是用來裝令牌的,叫令牌桶,這上面會(huì)以一定的速率,往這里面添加令牌,可能是幾秒鐘放一個(gè),如果已經(jīng)放滿了,放不下了,就會(huì)丟掉,WEB請(qǐng)求過來,會(huì)從令牌桶里面獲取令牌,拿到令牌之后,才可以繼續(xù)往下走,如果你連令牌都拿不到的話,那就直接被拒絕,我一看到這個(gè)令牌桶算法呢,我就覺得和我們現(xiàn)實(shí)生活中,買房的例子特別像的,怎么像呢,這里面就是開發(fā)商放出來有多少套房,以一定的速率放滿,那可能這個(gè)月放200套放進(jìn)來,過兩個(gè)月再放一些,那你這群人從這里過來,開始買房,那你要先獲取令牌,這個(gè)令牌無非就是現(xiàn)在的條件,有的要3成,有的要你全款,當(dāng)然這是比較傷心的一件事了,全款的往里走,按揭的不要進(jìn)來,這個(gè)令牌就是一個(gè)資格,你有了這個(gè)資格,那么就可以繼續(xù)往下走
你就可以買房了,沒有的話很抱歉,繼續(xù)努力,現(xiàn)在我們回到程序來實(shí)現(xiàn)這個(gè)功能,還是新建一個(gè)filter,RateFilter extends ZuulFilter令牌桶算法已經(jīng)有一個(gè)開源的組件了,GOOGLE開源的,在guava組件就有令牌桶的實(shí)現(xiàn),他的類名叫做RateLimiter,我們可以點(diǎn)進(jìn)來看<dependency><groupId>com.google.guava</groupId><artifactId>guava</artifactId><version>18.0</version>
</dependency>com.google.common.util.concurrent.RateLimiter有一個(gè)create,看一下參數(shù),參數(shù)也寫的特別明白了private static final RateLimiter RATE_LIMITER = RateLimiter.create(100);/**
* Creates a {@code RateLimiter} with the specified stable throughput, given as
* "permits per second" (commonly referred to as <i>QPS</i>, queries per second).
*
* <p>The returned {@code RateLimiter} ensures that on average no more than {@code
* permitsPerSecond} are issued during any given second, with sustained requests
* being smoothly spread over each second. When the incoming request rate exceeds
* {@code permitsPerSecond} the rate limiter will release one permit every {@code
* (1.0 / permitsPerSecond)} seconds. When the rate limiter is unused,
* bursts of up to {@code permitsPerSecond} permits will be allowed, with subsequent
* requests being smoothly limited at the stable rate of {@code permitsPerSecond}.
*
* @param permitsPerSecond the rate of the returned {@code RateLimiter}, measured in
* how many permits become available per second
* @throws IllegalArgumentException if {@code permitsPerSecond} is negative or zero
*/
// TODO(user): "This is equivalent to
// {@code createWithCapacity(permitsPerSecond, 1, TimeUnit.SECONDS)}".
public static RateLimiter create(double permitsPerSecond) {這里面的值就是你每秒鐘,要往里面放多少個(gè)令牌,假設(shè)是100好了,每秒鐘往里面放100個(gè)令牌,限流肯定是在所有優(yōu)先級(jí)里面是最高的/*** filter類型** @return*/
@Override
public String filterType() {return PRE_TYPE;
}這就到順序了,順序目前哪個(gè)優(yōu)先級(jí)是最高,我們要比他定義的優(yōu)先級(jí)比他還要高,這里有一個(gè)-1,有一個(gè)-3,-3是優(yōu)先級(jí)里面最高的,所以我們比-3還要小/*** filter order for {@link org.springframework.cloud.netflix.zuul.filters.pre.ServletDetectionFilter#filterOrder()}*/
int SERVLET_DETECTION_FILTER_ORDER = -3;我們還需要減1@Override
public int filterOrder() {return SERVLET_DETECTION_FILTER_ORDER - 1;
}run就是我們具體的實(shí)現(xiàn)了,如果沒有拿到令牌的話,看一下這個(gè)方法/**
* Acquires a permit from this {@link RateLimiter} if it can be acquired immediately without
* delay.
*
* <p>
* This method is equivalent to {@code tryAcquire(1)}.
*
* @return {@code true} if the permit was acquired, {@code false} otherwise
* @since 14.0
*/
public boolean tryAcquire() {
return tryAcquire(1, 0, MICROSECONDS);
}一般我們可以不用填參數(shù),不用參數(shù)我們進(jìn)來看一下,其實(shí)就是去取一個(gè)令牌,如果沒有取到的話,如果沒有拿到令牌,你就返回結(jié)果,跟之前的差不多吧,之前是返回沒有權(quán)限,沒有令牌就不是權(quán)限的事了,你類似于就可以這么返回/*** 實(shí)現(xiàn)filter邏輯** @return*/
@Override
public Object run() {//判斷--獲取通行令牌-->如果沒有令牌不等于之前的沒有權(quán)限401，可以拋出自定義異常或者其他處理if (!RATE_LIMITER.tryAcquire()) {requestContext.setSendZuulResponse(false);requestContext.setResponseStatusCode(HttpStatus.UNAUTHORIZED.value());}return null;
}我們也可以直接拋一個(gè)異常,我就演示另外一種,我就可以拋一個(gè)異常,之前叫RateFilter,還是不太合適,我們還是叫RateLimitFilter,Rate是速率,RateLimit才是限流,統(tǒng)一一下,這樣子就完成了限流,代碼量其實(shí)很少,這主要還是得益于GOOGLE這個(gè)組件,這個(gè)令牌桶算法他已經(jīng)給我們寫好了,所以這里用起來的時(shí)候就特別方便,用到的地方就兩行代碼,除此之外我在github上也看到一個(gè)項(xiàng)目https://github.com/marcosbarbero/spring-cloud-zuul-ratelimit限流感覺也不錯(cuò),大家可以來看一下,這個(gè)項(xiàng)目是國(guó)外一個(gè)小伙子開發(fā)的,我們看一下他的用法,也是先引入依賴你可以看到groupId<dependency><groupId>com.marcosbarbero.cloud</groupId><artifactId>spring-cloud-zuul-ratelimit</artifactId><version>LATEST</version>
</dependency>這不是Spring Cloud官方的,是個(gè)人的,雖然他項(xiàng)目名是以Spring Cloud開頭,這里他支持很多種限流的儲(chǔ)存,有Redis,Consul,還有JPA,以及內(nèi)存,用法呢這里是他一系列的配置zuul:ratelimit:key-prefix: your-prefixenabled: truerepository: REDISbehind-proxy: trueadd-response-headers: truedefault-policy-list: #optional - will apply unless specific policy exists- limit: 10 #optional - request number limit per refresh interval windowquota: 1000 #optional - request time limit per refresh interval window (in seconds)refresh-interval: 60 #default value (in seconds)type: #optional- user- origin- url- httpmethodpolicy-list:myServiceId:- limit: 10 #optional - request number limit per refresh interval windowquota: 1000 #optional - request time limit per refresh interval window (in seconds)refresh-interval: 60 #default value (in seconds)type: #optional- user- origin- url- type: #optional value for each type- user=anonymous- origin=somemachine.com- url=/api #url prefix- role=user- httpmethod=get #case insensitive下面也給出了具體的用法
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
http://maven.apache.org/xsd/maven-4.0.0.xsd"><modelVersion>4.0.0</modelVersion><groupId>com.learn.cloud</groupId><artifactId>api-gateway</artifactId><version>0.0.1-SNAPSHOT</version><packaging>jar</packaging><parent><groupId>cn.learn</groupId><artifactId>microcloud02</artifactId><version>0.0.1</version></parent><properties><project.build.sourceEncoding>UTF-8</project.build.sourceEncoding><project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding><java.version>1.8</java.version></properties> <dependencies><!-- <dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-config</artifactId></dependency> --><dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-eureka</artifactId></dependency><!-- <dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-eureka-server</artifactId></dependency> --><dependency><groupId>org.springframework.cloud</groupId><artifactId>spring-cloud-starter-zuul</artifactId></dependency><dependency><groupId>com.google.guava</groupId><artifactId>guava</artifactId><version>18.0</version></dependency></dependencies><!-- 這個(gè)插件,可以將應(yīng)用打包成一個(gè)可執(zhí)行的jar包 --><build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins></build></project>
package com.learn.cloud.filter;import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.PRE_TYPE;
import static org.springframework.cloud.netflix.zuul.filters.support.FilterConstants.SERVLET_DETECTION_FILTER_ORDER;import org.springframework.stereotype.Component;import com.google.common.util.concurrent.RateLimiter;
import com.learn.cloud.exceptions.RateLimiterException;
import com.netflix.zuul.ZuulFilter;/*** 限流*/
@Component
public class RateLimiterFilter extends ZuulFilter {//create 每秒放入100個(gè)令牌private static final RateLimiter RATE_LIMITER = RateLimiter.create(100);/*** filter類型** @return*/@Overridepublic String filterType() {return PRE_TYPE;}/*** filter執(zhí)行順序，值越小優(yōu)先級(jí)越高* 官方推薦使用x-1方式優(yōu)先排序* 選擇最高優(yōu)先級(jí)SERVLET_DETECTION_FILTER_ORDER，并-1** @return*/@Overridepublic int filterOrder() {return SERVLET_DETECTION_FILTER_ORDER - 1;}/*** filter 開啟關(guān)閉** @return*/@Overridepublic boolean shouldFilter() {return true;}/*** 實(shí)現(xiàn)filter邏輯** @return*/@Overridepublic Object run() {//判斷--獲取通行令牌-->如果沒有令牌不等于之前的沒有權(quán)限401，可以拋出自定義異常或者其他處理if (!RATE_LIMITER.tryAcquire()) {throw new RateLimiterException();}return null;}
}
package com.learn.cloud.exceptions;public class RateLimiterException extends RuntimeException {
}
?
總結(jié)
- 上一篇： Zuul：Pre和Post过滤器(下)
- 下一篇： Zuul鉴权和添加用户服务