Add vmod_h2 to control http rapid reset rate limits per session #3999
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nigoroll
force-pushed
the
vmod_builtin_http2
branch
2 times, most recently
from
1cb8b08
to
98c06b9
Compare
nigoroll
force-pushed
the
vmod_builtin_http2
branch
from
98c06b9
to
ffb421f
Compare
|
Agreed on irc. Will merge after issues with previous commits have been addressed in the interest of future bisects. |
nigoroll
changed the title
This will allow per-session adjustments and also significantly lower the risk of inconsistent calculations in the rate limit code during parameter changes. Ref varnishcache#3996
nigoroll
force-pushed
the
vmod_builtin_http2
branch
from
ffb421f
to
2cfb561
Compare
This was referenced Oct 18, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(edit: reduced to just two commits now that #3997 has been merged)
During bugwash on 2023-10-16, I suggested to support overrides of the rate limits from VCL, because nowadays many environments can provide friend/foe metrics like "has a valid session" or "has passed a Turing test".
Using tight rate limits is important to keep adversaries in check, but for (likely) known good clients, one might want to lift limits.
This patch adds such per-session controls in the form of vmod
h2.The implementation via a custom vmod was preferred during bugwash over adding session variables like
sess.h2_rapid_resetbecause they are transport specific. During the last VDD, we also agreed to move protocols into extensions with additional controls provided by vmods. This patch is a first step in this direction.Ref #3996