Kong基于QPS、IP限流

Rate Limiting限流插件

https://docs.konghq.com/hub/kong-inc/rate-limiting/

它可以针对consumer ,credential ,ip ,service,path,header 等多种维度来进行限流.流量控制的精准度也有多种方式可以参考,比如可以做到秒级,分钟级,小时级等限流控制.

基于IP限流

源码地址： kong/kong/plugins/ip-restriction/handler.lua at master · Kong/kong · GitHub

local lrucache = require "resty.lrucache"
local ipmatcher = require "resty.ipmatcher"
local kong_meta = require "kong.meta"local error = error
local kong = kong
local log = kong.log
local ngx_var = ngx.varlocal IPMATCHER_COUNT = 512
local IPMATCHER_TTL   = 3600
local cache = lrucache.new(IPMATCHER_COUNT)local IpRestrictionHandler = {PRIORITY = 990,VERSION = kong_meta.version,
}local isempty
dolocal tb_isempty = require "table.isempty"isempty = function(t)return t == nil or tb_isempty(t)end
endlocal function do_exit(status, message)status = status or 403message = message orstring.format("IP address not allowed: %s", ngx_var.remote_addr)log.warn(message)return kong.response.error(status, message)
endlocal function match_bin(list, binary_remote_addr)local matcher, errmatcher = cache:get(list)if not matcher thenmatcher, err = ipmatcher.new(list)if err thenreturn error("failed to create a new ipmatcher instance: " .. err)endcache:set(list, matcher, IPMATCHER_TTL)endlocal is_matchis_match, err = matcher:match_bin(binary_remote_addr)if err thenreturn error("invalid binary ip address: " .. err)endreturn is_match
endlocal function do_restrict(conf)local binary_remote_addr = ngx_var.binary_remote_addrif not binary_remote_addr thenreturn do_exit(403,"Cannot identify the client IP address, " .."unix domain sockets are not supported.")endlocal deny = conf.denyif not isempty(deny) thenlocal blocked = match_bin(deny, binary_remote_addr)if blocked thenreturn do_exit(conf.status, conf.message)endendlocal allow = conf.allowif not isempty(allow) thenlocal allowed = match_bin(allow, binary_remote_addr)if not allowed thenreturn do_exit(conf.status, conf.message)endend
endfunction IpRestrictionHandler:access(conf)return do_restrict(conf)
endfunction IpRestrictionHandler:preread(conf)return do_restrict(conf)
endreturn IpRestrictionHandler