Apache Dubbo

The dubbo-demo directory provides basic Dubbo usage examples intended for debugging and smoke testing. It covers three primary scenarios:

1. Basic RPC Protocol (dubbo-demo-api): Demonstrates fundamental RPC usage, including defining and implementing a simple service, starting a server on a specific port, and creating a consumer to call that service.
2. Spring Boot Integration (dubbo-demo-springboot): Shows how to integrate Dubbo with Spring Boot, including configuring and managing Dubbo services within the Spring Boot lifecycle.
3. Spring Boot with IDL (dubbo-demo-springboot-idl): Demonstrates how to use Dubbo with Spring Boot when services are defined using Interface Definition Language (IDL) files, such as Proto files.

For more advanced and feature-rich examples, refer to the dubbo-samples repository.

Apache Dubbo is a Web and RPC framework designed for building enterprise-grade microservices. It facilitates communication between consumers and providers using various RPC protocols (such as Triple, TCP, or REST).

Key architectural components include:

• Service Discovery: Consumers dynamically discover provider instances via registries like Zookeeper or Nacos.
• Traffic Management: Consumers manage traffic using defined strategies.
• Built-in Capabilities: Support for dynamic configuration, metrics, tracing, security, and a visualized console.

Dubbo is designed with the foundational assumption of an internal, trusted network. By default, Dubbo provides no authentication, no encryption, and permissive deserialization.

Key environmental assumptions include:

• Runtime: JDK 8–21 on Linux, macOS, or Windows.
• Network: Assumes a trusted internal network. Defaults do not include TLS or authentication.
• I/O: Uses Netty4 for network I/O (NIO/epoll).
• Trust: The Registry and Config Center are considered trusted components. A consumer implicitly trusts a provider once it is registered.

If you are deploying Dubbo in a non-trusted or public network environment, you must explicitly opt-in to security features like SSL and authentication.

Dubbo integrates DefaultSerializeClassChecker into the Hessian2 serializer factory to defend against arbitrary class instantiation. You can configure the protection level:

• WARN mode: Checks classes against a blocklist.
• STRICT mode: Checks classes against an allowlist. This is the recommended way to mitigate RCE risks associated with Hessian2 deserialization.

During an RPC invocation, the serialization type is determined by provider-priority negotiation.

1. The Provider declares its supported serialization formats (e.g., Hessian2, Protobuf, Java, Fastjson2) in its URL.
2. If multiple formats are declared, the negotiation process follows the priority established by the Provider.
3. The Consumer serializes arguments based on this negotiated format, and the Provider deserializes them upon receipt.

Because RPC request bodies are untrusted, providers are vulnerable to deserialization attacks. To mitigate this, follow these practices:

1. Enable Strict Serialization Check: Set serialize.check.status to STRICT. This blocks the deserialization of any class not explicitly on an allowlist.
2. Enforce Serializable Interface: Ensure serialize.check.serializable is set to true to enforce the Serializable interface on deserialized classes.
3. Limit Supported Serializers: The Provider controls the negotiation. Only declare the minimum necessary serialization formats (e.g., hessian2) to reduce the attack surface.

# Recommended security configuration for providers
serialize.check.status=STRICT
serialize.check.serializable=true
# Only use necessary serializers
serialization=hessian2

To propagate Dubbo tags from incoming HTTP requests to Dubbo calls, use the DubboTagHeaderOrParameterInterceptor. This interceptor looks for a header named dubbo-tag. If the header is missing, it falls back to checking the URL parameter dubbo.tag.

Register the interceptor in your Spring Boot application by implementing WebMvcConfigurer and adding it to the InterceptorRegistry.

@Configuration
public class WebMvcConfig implements WebMvcConfigurer {
    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new DubboTagHeaderOrParameterInterceptor())
                .addPathPatterns("/*")
                .excludePathPatterns("/admin");
    }
}

To start the Dubbo Spring Boot IDL provider demo, follow these two steps:

1. Generate the Protobuf Java files by running the Maven plugin: mvn dubbo:compile.
2. Execute the ProviderApplication class to start the service.

mvn dubbo:compile
# Then run ProviderApplication