Method Apply

internal/firewalls/ddos_protection.go:75–165

Apply 应用配置

(config *ddosconfigs.ProtectionConfig)

// Apply 应用配置
func (this *DDoSProtectionManager) Apply(config *ddosconfigs.ProtectionConfig) error {
	// 加锁防止并发更改
	if !this.locker.TryLock() {
		return nil
	}
	defer this.locker.Unlock()

	// 同集群节点IP白名单
	var allowIPListChanged = false
	nodeConfig, _ := nodeconfigs.SharedNodeConfig()
	if nodeConfig != nil {
		var allowIPList = nodeConfig.AllowedIPs
		if !utils.EqualStrings(allowIPList, this.lastAllowIPList) {
			allowIPListChanged = true
			this.lastAllowIPList = allowIPList
		}
	}

	// 对比配置
	configJSON, err := json.Marshal(config)
	if err != nil {
		return fmt.Errorf("encode config to json failed: %w", err)
	}
	if !allowIPListChanged && bytes.Equal(this.lastConfig, configJSON) {
		return nil
	}
	remotelogs.Println("FIREWALL", "change DDoS protection config")

	if len(nftables.NftExePath()) == 0 {
		return errors.New("can not find nft command")
	}

	if nftablesInstance == nil {
		if config == nil || !config.IsOn() {
			return nil
		}
		return errors.New("nftables instance should not be nil")
	}

	if config == nil {
		// TCP
		err := this.removeTCPRules()
		if err != nil {
			return err
		}

		// TODO other protocols

		return nil
	}

	// TCP
	if config.TCP == nil {
		err := this.removeTCPRules()
		if err != nil {
			return err
		}
	} else {