-
Notifications
You must be signed in to change notification settings - Fork 4.8k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add support for X-RateLimit-* headers in ratelimit filter (#12410)
Adds support for X-RateLimit-* headers described in the draft RFC. The X-RateLimit-Limit header contains the quota-policy per RFC. The descriptor name is included in the quota policy under the name key. X-RateLimit-Reset header is emitted, but it would need a followup in the ratelimit service, which I will do once this is merged. Signed-off-by: Petr Pchelko <ppchelko@wikimedia.org>
- Loading branch information
Showing
28 changed files
with
683 additions
and
55 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
37 changes: 36 additions & 1 deletion
37
generated_api_shadow/envoy/extensions/filters/http/ratelimit/v3/rate_limit.proto
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
82 changes: 82 additions & 0 deletions
82
source/extensions/filters/http/ratelimit/ratelimit_headers.cc
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| #include "extensions/filters/http/ratelimit/ratelimit_headers.h" | ||
|
|
||
| #include "common/http/header_map_impl.h" | ||
|
|
||
| #include "absl/strings/substitute.h" | ||
|
|
||
| namespace Envoy { | ||
| namespace Extensions { | ||
| namespace HttpFilters { | ||
| namespace RateLimitFilter { | ||
|
|
||
| Http::ResponseHeaderMapPtr XRateLimitHeaderUtils::create( | ||
| Filters::Common::RateLimit::DescriptorStatusListPtr&& descriptor_statuses) { | ||
| Http::ResponseHeaderMapPtr result = Http::ResponseHeaderMapImpl::create(); | ||
| if (!descriptor_statuses || descriptor_statuses->empty()) { | ||
| descriptor_statuses = nullptr; | ||
| return result; | ||
| } | ||
|
|
||
| absl::optional<envoy::service::ratelimit::v3::RateLimitResponse_DescriptorStatus> | ||
| min_remaining_limit_status; | ||
| std::string quota_policy; | ||
| for (auto&& status : *descriptor_statuses) { | ||
| if (!status.has_current_limit()) { | ||
| continue; | ||
| } | ||
| if (!min_remaining_limit_status || | ||
| status.limit_remaining() < min_remaining_limit_status.value().limit_remaining()) { | ||
| min_remaining_limit_status.emplace(status); | ||
| } | ||
| const uint32_t window = convertRateLimitUnit(status.current_limit().unit()); | ||
| // Constructing the quota-policy per RFC | ||
| // https://tools.ietf.org/id/draft-polli-ratelimit-headers-02.html#name-ratelimit-limit | ||
| // Example of the result: `, 10;w=1;name="per-ip", 1000;w=3600` | ||
| if (window) { | ||
| // For each descriptor status append `<LIMIT>;w=<WINDOW_IN_SECONDS>` | ||
| absl::SubstituteAndAppend("a_policy, ", $0;$1=$2", | ||
| status.current_limit().requests_per_unit(), | ||
| XRateLimitHeaders::get().QuotaPolicyKeys.Window, window); | ||
| if (!status.current_limit().name().empty()) { | ||
| // If the descriptor has a name, append `;name="<DESCRIPTOR_NAME>"` | ||
| absl::SubstituteAndAppend("a_policy, ";$0=\"$1\"", | ||
| XRateLimitHeaders::get().QuotaPolicyKeys.Name, | ||
| status.current_limit().name()); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if (min_remaining_limit_status) { | ||
| const std::string rate_limit_limit = absl::StrCat( | ||
| min_remaining_limit_status.value().current_limit().requests_per_unit(), quota_policy); | ||
| result->addReferenceKey(XRateLimitHeaders::get().XRateLimitLimit, rate_limit_limit); | ||
| result->addReferenceKey(XRateLimitHeaders::get().XRateLimitRemaining, | ||
| min_remaining_limit_status.value().limit_remaining()); | ||
| result->addReferenceKey(XRateLimitHeaders::get().XRateLimitReset, | ||
| min_remaining_limit_status.value().duration_until_reset().seconds()); | ||
| } | ||
| descriptor_statuses = nullptr; | ||
| return result; | ||
| } | ||
|
|
||
| uint32_t XRateLimitHeaderUtils::convertRateLimitUnit( | ||
| const envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::Unit unit) { | ||
| switch (unit) { | ||
| case envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::SECOND: | ||
| return 1; | ||
| case envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::MINUTE: | ||
| return 60; | ||
| case envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::HOUR: | ||
| return 60 * 60; | ||
| case envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::DAY: | ||
| return 24 * 60 * 60; | ||
| case envoy::service::ratelimit::v3::RateLimitResponse::RateLimit::UNKNOWN: | ||
| default: | ||
| return 0; | ||
| } | ||
| } | ||
|
|
||
| } // namespace RateLimitFilter | ||
| } // namespace HttpFilters | ||
| } // namespace Extensions | ||
| } // namespace Envoy |
Oops, something went wrong.