zto-express / zms Goto Github PK

View Code? Open in Web Editor NEW

270.0 21.0 90.0 4.49 MB

ZMS是ZTO Message Service的缩写，使用方与集群解耦，屏蔽各消息集群差异，并对消息集群进行安装、管理、监控、告警管理的平台。

License: Apache License 2.0

Shell 1.33% Java 69.47% JavaScript 12.05% HTML 0.20% Vue 16.09% CSS 0.20% SCSS 0.65%

zms's Introduction

ZMS

什么是ZMS ?

ZMS是ZTO Message Service的缩写，使用方与集群解耦，屏蔽各消息集群差异，并对消息集群进行安装、管理、监控、告警管理的平台。

ZMS能做什么 ?

客户端快速接入

屏蔽消息接入方使用不同类型集群之间的差异（zms-client）
加密消息（待开源）
灰度消息（待开源）
消息轨迹（待开源）

自动化运维

集群一键安装、可视化运维
集群资源自定义告警
动态集群、主题、消费组迁移，客户端无感知

监控

接入客户端发送、消费指标实时监控
集群节点监控检测、指标监控

告警

支持自定义告警：tps、消费延迟、最后消费时间

快速启动

通过安装包快速启动，免去编译、打包步骤

安装包在710M左右，里面包含可以通过ZMS自动安装的第三方安装包

依赖：jdk1.8+ mysql 5.6+

GitHub下载地址：安装包

创建数据库

解压安装包，将初始化脚本导入到mysql数据库

例如连接msql客户端，通过原生命令导入 ${project.dir}:项目根目录
```
> source ${project.dir}/sql/zmsdb.sql
```
修改ZMS启动配置

${project.dir}/conf/application.properties
```
spring.datasource.url = jdbc:mysql://${you.mysql.host:port}/zms?useSSL=false&characterEncoding=utf8&serverTimezone=Asia/Shanghai
spring.datasource.username = ${username}
spring.datasource.password = ${password}

zms.portal.url=http://${portal.host:port}
```
以下参数需要替换成自己的配置

${you.mysql.host:port}：mysql数据库地址:端口

${username}：mysql user

${password}：mysql password

${portal.host:port}：ZMS管理后台启动地址，其他服务通过这个地址与ZMS管理后台进行交互（ZMS后台安装的真实ip、端，或域名映射）。如果 zms.portal.url 配置为空，默认取ZMS管理后台进程服务器的网卡地址
启动ZMS管理后台
```
> ${project.dir}bin/server.sh start
```

当显示下面的日志，说明启动成功

 server.port:8088 
 logging.path:/data/logs/zms-portal 
 Start success,pid:[12866]

访问服务

地址：http://localhost:8088

账号/密码：admin/admin

通过源码手动打包安装

依赖：jdk1.8+ nodejs 9-12 maven 3+

下载源码

 git clone https://github.com/ZTO-Express/zms.git
 checkout 最新版本tag

下载第三方软件安装包（可选）

如果跳过此步骤，ZMS添加主机时，主机必须有JDK环境，并且有外部网络访问权限

为了提升主机初始化速度，我们可以将主机需要安装软件包提前下载到ZMS管理后台的软件包目录，在主机进行初始化下载软件包时，直接通从ZMS的本地文件目录直接下载。
1. 下载地址:
  
  服务安装包
2. 解压文件：
  
  将压缩包解压到 ${project.dir}/distribution/lib/
进入项目根目录，初始化库

设置数据库地址：${project.dir}/distribution/pom.xml
```
   <driver>com.mysql.jdbc.Driver</driver>
    <url>jdbc:mysql://${you.mysql.host:port}</url>
    <username>${username}</username>
    <password>${password}</password>
```
${project.dir}/zms-portal/src/main/resources/application.properties
```
spring.datasource.url = jdbc:mysql://${you.mysql.host:port}/zms?useSSL=false&characterEncoding=utf8&serverTimezone=Asia/Shanghai
spring.datasource.username = ${username}
spring.datasource.password = ${password}

zms.portal.url=http://${portal.host:port}
```
${you.mysql.host:port}：mysql数据库地址:端口

${username}：mysql user

${password}：mysql password

${portal.host:port}：ZMS管理后台启动地址，其他服务通过这个地址与ZMS管理后台进行交互（ZMS后台安装的真实ip、端，或域名映射）。如果 zms.portal.url 配置为空，默认取ZMS管理后台进程服务器的网卡地址

初始化库命令，进入目录：${project.dir}/distribution（只需初始化一次）
```
mvn sql:execute
```
项目根目录打包

生成压缩包: distribution/target/zms-assembly-${project.version}.tar.gz
```
> mvn clean install -DskipTests 
```
如果需要刷新前端静态资源，执行如下命令在打包命令后新增：-P npm-build

解压压缩包

> tar -zxvf zms-assembly-${project.version}.tar.gz

启动服务

> cd zms-assembly-${project.version}
> bin/server.sh start

当显示下面的日志，说明启动成功

 server.port:8088 
 logging.path:/data/logs/zms-portal 
 Start success,pid:[12866]

访问服务

地址：http://locallhost:8088

账号/密码：admin/admin

使用文档

zms管理后台使用文档

zms管理系统使用文档
zms客户端接入文档

zms-client接入手册
zms设计文档

zms设计文档

zms's People

Contributors

Stargazers

Watchers

Forkers

shenfuding dingwpmz aqsunkai marionxue hengyang-xiaobin williamjie krystal-my fucfwangnet joson2020 runningdog yingxiongtang hehaono1 stunius7 tandan330 xinjianyang xiejiashuai vhicool hadesfeng xiaomin0322 yanbw objcoding zhanglei xiongmmaq ludwigws poppysix topjs ilaotan joypoint kmmshmily luchao0111 robincoin haloiq finema happyjianguo tandingbo chenzuyibao goldtoad6 panzw008 wildwolfbang hepyu linuxstar gump518 dewardchen 85668869 zwgshanc xinguoz skyzou henryleecn jangocheng newlysoft dianchao jangocity jinyue233 rwindwh awaiter johnwonder sunrui1225 wyx0578 skymysky xifenmin wonechao escapeex feng07202 dyb121 felixzh2020 teakong chenkechao superheizai crazytreechen zhbdesign szuliguo zyclove dhc575757 zhangyj131 ningxiaofa tunayoyo xiaostyy songhui1984 xiaolong321 alexpassionate mayl666 hadoop835 bob2325168 leehuihui h1992 zhengyuyzhao jinkaifeng yibinliao zhuchaoyang1

zms's Issues

Dependency org.apache.httpcomponents:httpclient, leading to CVE problem

Hi, In zms-1.0.0/zms-common，there is a dependency org.apache.httpcomponents:httpclient:4.5.2 that calls the risk method.

CVE-2020-13956

The scope of this CVE affected version is [,4.5.13)

After further analysis, in this project, the main Api called is <org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 5

<org.apache.http.client.utils.URIUtils: org.apache.http.HttpHost extractHost(java.net.URI)>
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.HttpHost determineTarget(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.CloseableHttpClient.java:[92]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.client.methods.CloseableHttpResponse execute(org.apache.http.client.methods.HttpUriRequest,org.apache.http.protocol.HttpContext)> (org.apache.http.impl.client.CloseableHttpClient.java:[82]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar
at <org.apache.http.impl.client.CloseableHttpClient: org.apache.http.client.methods.CloseableHttpResponse execute(org.apache.http.client.methods.HttpUriRequest)> (org.apache.http.impl.client.CloseableHttpClient.java:[107]) in /.m2/repository/org/apache/httpcomponents/httpclient/4.5.2/httpclient-4.5.2.jar
at <com.zto.zms.utils.HttpClient: java.lang.String post(java.lang.String,java.lang.String,int,int)> (com.zto.zms.utils.HttpClient.java:[87]) in /detect/unzip/zms-1.0.0/zms-common/target/classes

Dependency tree--

[INFO] com.zto.zms:zms-common:jar:1.0.0.RELEASE
[INFO] +- io.springside:springside-utils:jar:5.0.0-RC1:compile
[INFO] |  +- com.google.guava:guava:jar:20.0:compile
[INFO] |  \- org.apache.commons:commons-lang3:jar:3.8.1:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.7.26:compile
[INFO] +- org.apache.kafka:kafka-clients:jar:2.2.1:compile
[INFO] |  +- com.github.luben:zstd-jni:jar:1.3.8-1:compile
[INFO] |  +- org.lz4:lz4-java:jar:1.5.0:compile
[INFO] |  \- org.xerial.snappy:snappy-java:jar:1.1.7.2:compile
[INFO] +- org.apache.kafka:kafka_2.11:jar:2.2.1:compile
[INFO] |  +- com.fasterxml.jackson.core:jackson-databind:jar:2.9.9:compile
[INFO] |  |  +- com.fasterxml.jackson.core:jackson-annotations:jar:2.9.0:compile
[INFO] |  |  \- com.fasterxml.jackson.core:jackson-core:jar:2.9.9:compile
[INFO] |  +- com.fasterxml.jackson.datatype:jackson-datatype-jdk8:jar:2.9.9:compile
[INFO] |  +- net.sf.jopt-simple:jopt-simple:jar:5.0.4:compile
[INFO] |  +- com.yammer.metrics:metrics-core:jar:2.2.0:compile
[INFO] |  +- org.scala-lang:scala-library:jar:2.11.12:compile
[INFO] |  +- org.scala-lang:scala-reflect:jar:2.11.12:compile
[INFO] |  +- com.typesafe.scala-logging:scala-logging_2.11:jar:3.9.0:compile
[INFO] |  +- com.101tec:zkclient:jar:0.11:compile
[INFO] |  \- org.apache.zookeeper:zookeeper:jar:3.4.13:compile
[INFO] |     \- org.apache.yetus:audience-annotations:jar:0.5.0:compile
[INFO] +- org.apache.rocketmq:rocketmq-client:jar:4.1.0-incubating:compile
[INFO] |  \- org.apache.rocketmq:rocketmq-common:jar:4.1.0-incubating:compile
[INFO] |     \- org.apache.rocketmq:rocketmq-remoting:jar:4.1.0-incubating:compile
[INFO] |        \- io.netty:netty-all:jar:4.1.36.Final:compile
[INFO] +- org.apache.rocketmq:rocketmq-tools:jar:4.1.0-incubating:compile
[INFO] |  +- org.apache.rocketmq:rocketmq-store:jar:4.1.0-incubating:compile
[INFO] |  |  \- net.java.dev.jna:jna:jar:4.5.2:compile
[INFO] |  +- org.apache.rocketmq:rocketmq-srvutil:jar:4.1.0-incubating:compile
[INFO] |  |  \- commons-cli:commons-cli:jar:1.2:compile
[INFO] |  +- ch.qos.logback:logback-classic:jar:1.2.3:compile
[INFO] |  \- ch.qos.logback:logback-core:jar:1.2.3:compile
[INFO] +- com.alibaba:fastjson:jar:1.2.67:compile
[INFO] +- org.ini4j:ini4j:jar:0.5.4:compile
[INFO] \- org.apache.httpcomponents:httpclient:jar:4.5.2:compile
[INFO]    +- org.apache.httpcomponents:httpcore:jar:4.4.11:compile
[INFO]    +- commons-logging:commons-logging:jar:1.2:compile
[INFO]    \- commons-codec:commons-codec:jar:1.11:compile

Suggested solutions:

Update dependency version

Thank you very much.