envoyproxy/envoy

Http local ratelimiter support for silent drop

Open

#29,822 opened on Sep 26, 2023

View on GitHub
 (7 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
enhancementhelp wantedstale

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Title: Http local rate limiter support for silent drop

Description: There is a scenario in which a malicious client continues to bombard the server with requests despite receiving a 429 response. Is there a way to close the connection without returning the response? Temporarily blocking the bad IP may also be helpful in preventing the server from wasting resources.

[optional Relevant Links:]

Any extra documentation required to understand the issue.

Contributor guide

Research direction
Investigate Envoy's HTTP rate limiter implementation and the possibility of silently dropping requests by closing the connection instead of returning 429. Look into the configuration options for local rate limiting and see if there is a way to block IPs temporarily.
Tech stack
cpp
Domain
backendinfrastructuresecurity
Issue type
Feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-2 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Mostly clear
Prerequisites
C++HTTPRate Limiting
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40