Skip to content

Commit a38d71b

Browse files
bohdebohde
committed
add middleware for request prioritization
This adds a middleware for overload protection, that is intended to help protect against malicious scrapers. It does this by via [`codel`](https://github.com/bohde/codel), which will perform the following: 1. Limit the number of in-flight requests to some user defined max 2. When in-flight requests have reached their max, begin queuing requests, with logged in requests having priority above logged out requests 3. Once a request has been queued for too long, it has a percentage chance to be rejected based upon how overloaded the entire system is. When a server experiences more traffic than it can handle, this has the effect of keeping latency low for logged in users, while rejecting just enough requests from logged out users to keep the service from being overloaded. Below are benchmarks showing a system at 100% capacity and 200% capacity in a few different configurations. The 200% capacity is shown to highlight an extreme case. I used [hey](https://github.com/rakyll/hey) to simulate the bot traffic: ``` hey -z 1m -c 10 "http://localhost:3000/rowan/demo/issues?state=open&type=all&labels=&milestone=0&project=0&assignee=0&poster=0&q=fix" ``` The concurrency of 10 was chosen from experiments where my local server began to experience higher latency. Results | Method | Concurrency | p95 latency | Successful RPS | Requests Dropped | |--------|--------|--------|--------|--------| | QoS Off | 10 | 0.2960s | 44 rps | 0% | | QoS Off | 20 | 0.5667s | 44 rps | 0%| | QoS On | 20 | 0.4409s | 48 rps | 10% | | QoS On 50% Logged In* | 10 | 0.3891s | 33 rps | 7% | | QoS On 50% Logged Out* | 10 | 2.0388s | 13 rps | 6% | Logged in users were given the additional parameter ` -H "Cookie: i_like_gitea=<session>`. Tests with `*` were run at the same time, representing a workload with mixed logged in & logged out users. Results are separated to show prioritization, and how logged in users experience a 100ms latency increase under load, compared to the 1.6 seconds logged out users see.
1 parent e45450b commit a38d71b

File tree

7 files changed

+160
-0
lines changed

7 files changed

+160
-0
lines changed

‎assets/go-licenses.json‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎custom/conf/app.example.ini‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -926,6 +926,16 @@ LEVEL = Info
926926
;USER_DELETE_WITH_COMMENTS_MAX_TIME = 0
927927
;; Valid site url schemes for user profiles
928928
;VALID_SITE_URL_SCHEMES=http,https
929+
;;
930+
;; Enable request quality of service and load shedding.
931+
; QOS_ENABLED = false
932+
;; The number of requests that are in flight to service before queuing
933+
;; begins. Default is 4 * number of CPUs
934+
; QOS_MAX_INFLIGHT =
935+
;; The maximum number of requests that can be enqueued before they will be dropped.
936+
; QOS_MAX_WAITING = 100
937+
;; The target time for a request to be enqueued before it might be dropped.
938+
; QOS_TARGET_WAIT_TIME = 50ms
929939

930940
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
931941
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ require (
3232
github.com/aws/aws-sdk-go-v2/service/codecommit v1.28.1
3333
github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb
3434
github.com/blevesearch/bleve/v2 v2.4.2
35+
github.com/bohde/codel v0.2.0
3536
github.com/buildkite/terminal-to-html/v3 v3.16.8
3637
github.com/caddyserver/certmagic v0.22.0
3738
github.com/charmbracelet/git-lfs-transfer v0.2.0

‎go.sum‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,9 @@ github.com/blevesearch/zapx/v16 v16.1.5 h1:b0sMcarqNFxuXvjoXsF8WtwVahnxyhEvBSRJi
179179
github.com/blevesearch/zapx/v16 v16.1.5/go.mod h1:J4mSF39w1QELc11EWRSBFkPeZuO7r/NPKkHzDCoiaI8=
180180
github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
181181
github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
182+
github.com/bmizerany/perks v0.0.0-20141205001514-d9a9656a3a4b/go.mod h1:ac9efd0D1fsDb3EJvhqgXRbFx7bs2wqZ10HQPeU8U/Q=
183+
github.com/bohde/codel v0.2.0 h1:fzF7ibgKmCfQbOzQCblmQcwzDRmV7WO7VMLm/hDvD3E=
184+
github.com/bohde/codel v0.2.0/go.mod h1:Idb1IRvTdwkRjIjguLIo+FXhIBhcpGl94o7xra6ggWk=
182185
github.com/boombuler/barcode v1.0.1-0.20190219062509-6c824513bacc/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
183186
github.com/boombuler/barcode v1.0.2 h1:79yrbttoZrLGkL/oOI8hBrUKucwOL0oOjUgEguGMcJ4=
184187
github.com/boombuler/barcode v1.0.2/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -881,6 +884,7 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ
881884
golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
882885
golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
883886
golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
887+
golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
884888
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
885889
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
886890
golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
@@ -1025,6 +1029,8 @@ modernc.org/token v1.0.1 h1:A3qvTqOwexpfZZeyI0FeGPDlSWX5pjZu9hF4lU+EKWg=
10251029
modernc.org/token v1.0.1/go.mod h1:UGzOrNV1mAFSEB63lOFHIpNRUVMvYTc6yu1SMY/XTDM=
10261030
mvdan.cc/xurls/v2 v2.6.0 h1:3NTZpeTxYVWNSokW3MKeyVkz/j7uYXYiMtXRUfmjbgI=
10271031
mvdan.cc/xurls/v2 v2.6.0/go.mod h1:bCvEZ1XvdA6wDnxY7jPPjEmigDtvtvPXAD/Exa9IMSk=
1032+
pgregory.net/rapid v0.4.2 h1:lsi9jhvZTYvzVpeG93WWgimPRmiJQfGFRNTEZh1dtY0=
1033+
pgregory.net/rapid v0.4.2/go.mod h1:UYpPVyjFHzYBGHIxLFoupi8vwk6rXNzRY9OMvVxFIOU=
10281034
strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251 h1:mUcz5b3FJbP5Cvdq7Khzn6J9OCUQJaBwgBkCR+MOwSs=
10291035
strk.kbt.io/projects/go/libravatar v0.0.0-20191008002943-06d1c002b251/go.mod h1:FJGmPh3vz9jSos1L/F91iAgnC/aejc0wIIrF2ZwJxdY=
10301036
xorm.io/builder v0.3.13 h1:a3jmiVVL19psGeXx8GIurTp7p0IIgqeDmwhcR6BAOAo=

‎modules/setting/service.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ package setting
55

66
import (
77
"regexp"
8+
"runtime"
89
"strings"
910
"time"
1011

@@ -98,6 +99,13 @@ var Service = struct {
9899
DisableOrganizationsPage bool `ini:"DISABLE_ORGANIZATIONS_PAGE"`
99100
DisableCodePage bool `ini:"DISABLE_CODE_PAGE"`
100101
} `ini:"service.explore"`
102+
103+
QoS struct {
104+
Enabled bool
105+
MaxInFlightRequests int
106+
MaxWaitingRequests int
107+
TargetWaitTime time.Duration
108+
}
101109
}{
102110
AllowedUserVisibilityModesSlice: []bool{true, true, true},
103111
}
@@ -254,6 +262,11 @@ func loadServiceFrom(rootCfg ConfigProvider) {
254262

255263
mustMapSetting(rootCfg, "service.explore", &Service.Explore)
256264

265+
Service.QoS.Enabled = sec.Key("QOS_ENABLED").MustBool(false)
266+
Service.QoS.MaxInFlightRequests = sec.Key("QOS_MAX_INFLIGHT").MustInt(4 * runtime.NumCPU())
267+
Service.QoS.MaxWaitingRequests = sec.Key("QOS_MAX_WAITING").MustInt(100)
268+
Service.QoS.TargetWaitTime = sec.Key("QOS_TARGET_WAIT_TIME").MustDuration(50 * time.Millisecond)
269+
257270
loadOpenIDSetting(rootCfg)
258271
}
259272

‎routers/common/qos.go‎

Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
// Copyright 2025 The Gitea Authors. All rights reserved.
2+
// SPDX-License-Identifier: MIT
3+
4+
package common
5+
6+
import (
7+
"fmt"
8+
"net/http"
9+
"strings"
10+
11+
user_model "code.gitea.io/gitea/models/user"
12+
"code.gitea.io/gitea/modules/setting"
13+
"code.gitea.io/gitea/modules/web/middleware"
14+
15+
"github.com/bohde/codel"
16+
)
17+
18+
type Priority int
19+
20+
func (p Priority) String() string {
21+
switch p {
22+
case HighPriority:
23+
return "high"
24+
case DefaultPriority:
25+
return "default"
26+
case LowPriority:
27+
return "low"
28+
default:
29+
return fmt.Sprintf("%d", p)
30+
}
31+
}
32+
33+
const (
34+
LowPriority = Priority(-10)
35+
DefaultPriority = Priority(0)
36+
HighPriority = Priority(10)
37+
)
38+
39+
// QoS implements quality of service for requests, based upon whether
40+
// or not the user is logged in. All traffic may get dropped, and
41+
// anonymous users are deprioritized.
42+
func QoS() func(next http.Handler) http.Handler {
43+
maxOutstanding := setting.Service.QoS.MaxInFlightRequests
44+
if maxOutstanding <= 0 {
45+
maxOutstanding = 10
46+
}
47+
48+
c := codel.NewPriority(codel.Options{
49+
// The maximum number of waiting requests.
50+
MaxPending: setting.Service.QoS.MaxWaitingRequests,
51+
// The maximum number of in-flight requests.
52+
MaxOutstanding: maxOutstanding,
53+
// The target latency that a blocked request should wait
54+
// for. After this, it might be dropped.
55+
TargetLatency: setting.Service.QoS.TargetWaitTime,
56+
})
57+
58+
return func(next http.Handler) http.Handler {
59+
return http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
60+
ctx := req.Context()
61+
62+
priority := DefaultPriority
63+
64+
// If the user is logged in, assign high priority.
65+
data := middleware.GetContextData(req.Context())
66+
if _, ok := data[middleware.ContextDataKeySignedUser].(*user_model.User); ok {
67+
priority = HighPriority
68+
} else if IsGitContents(req.URL.Path) {
69+
// Otherwise, if the path would is accessing git contents directly, mark as low priority
70+
priority = LowPriority
71+
}
72+
73+
// Check if the request can begin processing.
74+
err := c.Acquire(ctx, int(priority))
75+
if err != nil {
76+
// If it failed, the service is over capacity and should error
77+
http.Error(w, "Service Unavailable", http.StatusServiceUnavailable)
78+
return
79+
}
80+
81+
// Release long-polling immediately, so they don't always
82+
// take up an in-flight request
83+
if strings.Contains(req.URL.Path, "/user/events") {
84+
c.Release()
85+
} else {
86+
defer c.Release()
87+
}
88+
89+
next.ServeHTTP(w, req)
90+
})
91+
}
92+
}
93+
94+
func IsGitContents(path string) bool {
95+
parts := []string{
96+
"refs",
97+
"archive",
98+
"commit",
99+
"graph",
100+
"blame",
101+
"branches",
102+
"tags",
103+
"labels",
104+
"stars",
105+
"search",
106+
"activity",
107+
"wiki",
108+
"watchers",
109+
"compare",
110+
"raw",
111+
"src",
112+
"commits",
113+
}
114+
115+
for _, p := range parts {
116+
if strings.Contains(path, p) {
117+
return true
118+
}
119+
}
120+
return false
121+
}

‎routers/web/web.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,10 @@ func Routes() *web.Router {
272272
// Get user from session if logged in.
273273
mid = append(mid, webAuth(buildAuthGroup()))
274274

275+
if setting.Service.QoS.Enabled {
276+
mid = append(mid, common.QoS())
277+
}
278+
275279
// GetHead allows a HEAD request redirect to GET if HEAD method is not defined for that route
276280
mid = append(mid, chi_middleware.GetHead)
277281

0 commit comments

Comments
 (0)