Rate-limit expensive RPCs to prevent resource exhaustion

Aperta
#1,273 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
35/100
Tipo di issue
Funzionalità
Chiarezza
Da chiarire
Stato di attività
Attiva
Stack tecnologico
rust
Ambito
api, backend-api-design, security

Direzione di ricerca

Start by tracing the named RPC entry points: KMS key issuance/SignCert, Gateway RegisterCvm, and Verify. Define how anonymous, authenticated, shared-resource, and replica-spread requests should be limited, then validate floods and expensive invalid requests against early rejection, service preservation, retry guidance, bounded state, and exposed counters.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Problem

Repeated calls to expensive RPCs—such as KMS key issuance / SignCert, Gateway RegisterCvm, and Verify—can exhaust CPU, disk, subprocess, or external-service resources and degrade service for other users.

Abuse can come from unauthenticated callers, invalid requests that are expensive to reject, or authenticated clients making otherwise valid requests. Authentication and concurrency limits alone do not bound sustained resource consumption.

Proposed direction

Introduce low-overhead, server-side rate limiting for expensive RPC paths:

  • Configurable token buckets with sustained-rate and burst limits.
  • A coarse limit before expensive authentication, attestation verification, or request processing.
  • Additional per-client limits using verified instance/app identity where available. For anonymous callers, define an appropriate source-based policy; never trust arbitrary identity headers.
  • Shared service/resource budgets to contain aggregate load, including requests spread across identities or endpoints.
  • Reject excess requests early with a distinguishable rate-limit error and retry guidance.
  • Bound limiter state and cleanup cost. Start process-local and document how limits behave across replicas.

Limits should accommodate normal boot, registration refresh, and certificate renewal bursts.

Validation

Test floods from anonymous callers, expensive invalid requests, and authenticated clients. Verify that limits bound accepted request rates, reject excess work early, and preserve service for unrelated clients. Expose rate-limit counters for tuning.

Related: #1258, #1259. Separate from concurrency/admission control in #1096.

Lingua principale
Rust
Stelle
546
Fork
96
Merge medio
19h 22m
PR unite (30g)
109

Guida per i contributori

Apri la guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di Dstack-TEE/dstack

Tutte le issue di Dstack-TEE/dstack

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.