Hacktoberfest 2026: die Issues, die Maintainer für den Oktober markiert haben – offen und einsteigerfreundlich. Hacktoberfest-Issues durchsuchen

Rate-limit expensive RPCs to prevent resource exhaustion

Offen
  • Stimmt etwas nicht?
#1,273 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Anfängerfreundlichkeit
35/100
Issue-Typ
Feature
Klarheit
Muss geklärt werden
Aktivitätsstatus
Aktiv
Tech-Stack
rust
Bereich
api, backend-api-design, security

Rechercherichtung

Start by tracing the named RPC entry points: KMS key issuance/SignCert, Gateway RegisterCvm, and Verify. Define how anonymous, authenticated, shared-resource, and replica-spread requests should be limited, then validate floods and expensive invalid requests against early rejection, service preservation, retry guidance, bounded state, and exposed counters.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Problem

Repeated calls to expensive RPCs—such as KMS key issuance / SignCert, Gateway RegisterCvm, and Verify—can exhaust CPU, disk, subprocess, or external-service resources and degrade service for other users.

Abuse can come from unauthenticated callers, invalid requests that are expensive to reject, or authenticated clients making otherwise valid requests. Authentication and concurrency limits alone do not bound sustained resource consumption.

Proposed direction

Introduce low-overhead, server-side rate limiting for expensive RPC paths:

  • Configurable token buckets with sustained-rate and burst limits.
  • A coarse limit before expensive authentication, attestation verification, or request processing.
  • Additional per-client limits using verified instance/app identity where available. For anonymous callers, define an appropriate source-based policy; never trust arbitrary identity headers.
  • Shared service/resource budgets to contain aggregate load, including requests spread across identities or endpoints.
  • Reject excess requests early with a distinguishable rate-limit error and retry guidance.
  • Bound limiter state and cleanup cost. Start process-local and document how limits behave across replicas.

Limits should accommodate normal boot, registration refresh, and certificate renewal bursts.

Validation

Test floods from anonymous callers, expensive invalid requests, and authenticated clients. Verify that limits bound accepted request rates, reject excess work early, and preserve service for unrelated clients. Expose rate-limit counters for tuning.

Related: #1258, #1259. Separate from concurrency/admission control in #1096.

Vorherrschende Sprache
Rust
Sterne
555
Forks
97
Ø Merge
1 T. 3 Std.
Gemergte PRs (30 T.)
199

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus Dstack-TEE/dstack

Alle Issues in Dstack-TEE/dstack

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.