2. process::firewall::install(move(rules));如果有参数--firewall_rules则会添加规则
对应的代码如下：
// Initialize firewall rules.
if (flags.firewall_rules.isSome()) {
vector<Owned<FirewallRule>> rules;
-
const Firewall firewall = flags.firewall_rules.get();
-
if (firewall.has_disabled_endpoints()) {
hashset<string> paths;
-
foreach (const
string& path, firewall.disabled_endpoints().paths()) {
paths.insert(path);
}
-
rules.emplace_back(new DisabledEndpointsFirewallRule(paths));
}
-
process::firewall::install(move(rules));
}
|
对应的命令行参数如下：
这个参数的主要作用为，并不是Mesos的每一个API都想暴露出来，disabled_endpoints里面就是不能访问的API。
上面的install的代码会做下面的事情
最终会放到环境变量firewallRules里面。
那这些firewall是什么事情起作用的呢？
在3rdparty/libprocess/src/process.cpp里面有函数
synchronized (firewall_mutex) {
// Don't use a const reference, since it cannot be guaranteed
// that the rules don't keep an internal state.
foreach (Owned<firewall::FirewallRule>& rule, firewallRules) {
Option<Response> rejection = rule->apply(socket, *request);
if (rejection.isSome()) {
VLOG(1) << "Returning '"<< rejection.get().status << "' for '"
<< request->url.path << "' (firewall rule forbids request)";
-
// TODO(arojas): Get rid of the duplicated code to return an
// error.
-
// Get the HttpProxy pid for this socket.
PID<HttpProxy> proxy = socket_manager->proxy(socket);
-
// Enqueue the response with the HttpProxy so that it respects
// the order of requests to account for HTTP/1.1 pipelining.
dispatch(
proxy,
&HttpProxy::enqueue,
rejection.get(),
*request);
-
// Cleanup request.
delete request;
return;
}
}
}
|
