Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rate limit: configuration/filter enhancements #179

Closed
mattklein123 opened this issue Oct 28, 2016 · 8 comments
Closed

rate limit: configuration/filter enhancements #179

mattklein123 opened this issue Oct 28, 2016 · 8 comments
Labels
enhancement Feature requests. Not bugs or questions.
Milestone

Comments

@mattklein123
Copy link
Member

We are considering a number of enhancements/changes to how rate limiting can be configured on a per virtual host / route basis for HTTP requests. This will include a shift in configuration from the filter to the route/vhost, as well as new rules (potentially logical and/or, etc.) for setting descriptors.

@ccaraman when we have a better idea of what we are planning please post a summary here.

cc @chowchow316 @mandarjog let's discuss here if you have any requests since I think this issue will be relevant to what you are working on.

@mattklein123 mattklein123 added the enhancement Feature requests. Not bugs or questions. label Oct 28, 2016
@mattklein123 mattklein123 added this to the 1.2.0 milestone Dec 1, 2016
@ccaraman
Copy link
Contributor

Envoy HTTP Rate Limit Configuration Proposal

What we are trying to solve?

With our current configuration, Envoy is limited to simple rate limit rules that can only be configured per route.

Going forward, we want to provide a flexible rate limit configuration to allow for more complex rate limiting scenarios such as rate limiting based on IP tags and IP address prior to authentication by the Auth filters in Front Envoy or allowing a virtual host to have a global rate limit for all traffic and have a more restrictive rate limit for a particular endpoint.

HTTP Rate Limits

In an envoy config, there are two parts to enable HTTP rate limits. The first part is installing the Rate Limit filter in the HTTP Connection Manager. The second part is to configure the rate limit settings within the virtual host.

HTTP Rate Limit Filter

{
  "type": "decoder",
  "name": "rate_limit",
  "config": {
     // domain (required, string)
     // The rate limit domain to use when calling the rate limit service.
     "domain": "my_domain_name",
     // stage (optional, integer)
     // If set, rate limit configurations will only be applied with the same stage
     // number.
     // If not set, all rate limit configurations will be applied. 
     "stage": 1 
  }
}

Specifying Rate Limits Configurations Scope

A rate limit configuration can be specified at the virtual host level and at the per route level. For a request, all virtual host level configurations that match the filter stage setting will be applied. If there are route specific configurations that match the filter stage setting, those will be applied in addition. More than one configuration can apply to a request. Each configuration results in a descriptor being sent to the rate limit service. Rate limits are enacted based on the result of logically ‘or’-ing the response from each descriptor.

Virtual Host

Rate limit configurations to be applied for the virtual host.

{
  "name": "...",
  "domains":[
    "..."
  ],
  "routes" : [],
  ...
  // rate_limits (optional, array)
  // A list of rate limit configurations to be applied for all requests for this virtual
  // hosts. Order of configurations does not matter. 
  "rate_limits": []
}

Per Route

Rate limit configurations to be applied for the route within a virtual host.

{
  "name": "...", 
  "domains": [
    "..."
  ], 
  "routes": [
    {
      ...
      // rate_limits (optional, array)
      // A list of rate limit configurations to be applied for all requests for this route
      // Order of configurations does not matter. 
      "rate_limits": []
      ...
    }
  ]
}

HTTP rate limit configuration

{
  // stage (optional, integer)
  // Refers to the stage set in the filter.
  // If set, the rate limit configuration only applies to filters with the same stage number 
  // and for filters set to default. If not set, the rate limit configuration will apply for 
  // all rate limit filters set to default.
  "stage": ...,
  // kill_switch_key (optional, string)
  // The key to be set in runtime to disable this rate limit configuration. 
  "kill_switch_key": "...",
  // action (required, array)
  // A list of actions that are to be applied for this rate limit configurations. Order 
  // matters as the actions are processed sequentially and the descriptors will be composed 
  // in that sequence.
  "actions": []
}

Actions

There are several existing action types:

  • Service To Service
  • Request Headers
  • Remote Address

For more information on these actions, please refer to the documentation.

In addition, we will be adding the following types:

Rate Limit Key Action

This action is to replace the existing ‘route key’ value in the rate limit configuration.

{
  "type" : "rate_limit_key",
  // descriptor_value (required, string)
  // The value to send in the descriptor.
  "descriptor_value": "..."
}

The following descriptor will be sent for this action type

  • (“rate_limit_key”, “<descriptor_value>”)

Header Value Matching Action

{
  "type": "header_value_match",
  // headers (required, array)
  // Specifies a list of headers that the request should match on.
  "headers" : []
  // descriptor_value (required, string)
  // The value to use in the descriptor if there is a match. 
  "descriptor_value": "..."
}

The following descriptor will be sent for this action type:

  • (“header_match”, “<descriptor_value>”)

Headers

{ 
  // name (required, string)
  // Specifies the name of the header in the request
  "name" : "...", 
  // value (optional, string)
  // Specifies the value of the header. The value to match on can be a regex. If the value 
  // is absent a request that has the name header will match, regardless of the header’s 
  // value.
  "value": "...",
  // regex_matching (optional, boolean)
  // If set to true, regex matching will be used when comparing the value from the header     
  // to 'value'. If set to false, a direct comparison will be made. Defaults to 
  // false.
  "regex_matching": "..."
}

Example 1

{
  "type": "header_value_match",
  "headers": [
    {
      "name": ":path",
      "value": "/v1/random",
    }
  ]
  "descriptor_value": "endpointmatch"
}

The above action type will match for this request:

  • ”:path” : “/v1/random”

And will populate the descriptor with this value:

  • (“header_match”, “endpointmatch”)

It will not match this request:

  • ”:path” : “/v1/random/test”

And will not populate a descriptor.

Example 2

{
  "type": "header_value_match",
  "headers": [
    {
      "name": ":method",
      "value": "POST",
    },
    {
      "name": ":path",
      "value": "\/v1\/.*\/rides",
      "regex_matching": true
    }
  ]
  "descriptor_value": "rides_post_request"
}

The above action type will match these requests:

  • ”:path” : “/v1/myuserid/rides”, “:method” : “POST”

  • “:path” : “/v1//rides, “:method”: “POST”

And will populate the descriptor with this value:

  • (“header_match”, “rides_post_request”)

It will not match these requests:

  • “:path”, “/v1/myuserid/rides”, “:method” : “GET”

  • “:path” : “/rides”, “:method” : “POST”

And it will not populate a descriptor.

IP Tag Action

IP Tags will be implemented to populate a header value. To support rate limiting based on IP tags, the header value will be pulled from the request and forwarded to the rate limit service. This will be done using the Request Header Action.

Example of Applying Rate Limit Configurations

This example is to demonstrate how a rate limit configuration within the virtual hosts and routes will be applied.

Sample Filter Configuration

{
  "filters": [
    {
      "type": "decoder",
      "name": "rate_limit",
      "config": {
        "domain": "envoy_front",
        "stage": 1
      }
    },
    {
      "type": "decoder",
      "name": "lyft_bearer_token_auth",
      "config": {
        "cluster_name": "auth"
      }
    },
    {
      "type": "decoder", 
      "name": "rate_limit", 
      "config": {
        "domain": "envoy_front"
        "stage" : 2
      }
    }, 
    {
      "type": "decoder", 
      "name": "router", 
      "config": {}
    }
  ]
}

Sample Virtual Host Configuration

{
  "name": "users",
  "domains": [
    "users"
  ],
  “rate_limits” : [
    {
      "stage": 1,
      "actions": [
        {
          "type": "remote_address"
        }
      ]
    }
  ],
  "routes": [
    {
      "prefix": "/bob",
      "rate_limits":[ {
        "stage": 2,
        "actions": [
          {
            "type": "request_headers",
            "header_name": "x-lyft-user-id",
            "descriptor_key": "user_id"
          }
        ]
      }],
      "cluster": "users"
    },
    {
      "prefix": "*",
      "cluster": "users"
    }
  ]
}

Note: Filters are applied in sequential order.
Assume a Users request is being processed.

The first rate limit has a stage value of ‘1’. When this filter is processing, it will only apply the rate limit specified at the virtual host layer since it has the same stage value.

The second rate limit has a stage value of ‘2’. If the prefix matches /bob, the route rate limit configuration will be applied. If not, no rate limit configurations are applicable and no rate limiting will occur.

@mattklein123
Copy link
Member Author

@chowchow316 @mandarjog please look at ^ depending on which implementation option you decide on for rate limiting.

FYI @junr03 and @twoism are working on open sourcing our ratelimit service. Probably 3-4 weeks out.

cc @louiscryan

@chowchow316
Copy link

LGTM

@CarsarSky
Copy link

Any updates?

@mattklein123
Copy link
Member Author

The only two thing that haven't been implemented in the above doc is a generic header matching rate limit rule as well as IP tagging. The public docs are up to date.

@ccaraman is on vacation this week. She will finish header matching rule next week, then we will close this GH issue out, and track IP tagging as a different issue as that is a larger and more complicated project.

@mattklein123
Copy link
Member Author

complete other than ip tagging so closing this.

@crazyproger
Copy link

Is there any possibility to use Network layer rate limit filter with auto filled client IP descriptor? Like remote_address action in http route rate limit configuration.
This is mainly to limit number of connections from same IP.

rshriram pushed a commit to rshriram/envoy that referenced this issue Oct 30, 2018
…nvoyproxy#179)

* Modify mixer filter

* Swap defaults

* Make the filter decoder only

* cache mixer disabled decision
rshriram pushed a commit to rshriram/envoy that referenced this issue Oct 30, 2018
* Point to googleapi in service control client. (envoyproxy#91)

* Point to googleapi in service control client.

* Use git repository for service-control-client.

* Merge latest changes from master (envoyproxy#104)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Extract quota config from service config. (envoyproxy#101)

* Add metric_cost in config.

* Remove group rules.

* Call loadQuotaConfig in config::create.

* Update latest update from master branch (envoyproxy#106)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Added quota contoll without the service control client library (envoyproxy#93)

* Added quota contoll without the service control client library

* Applied code review

* Applied code review

* Resolve conflicts

* Resolve conflicts

* Fixed format error reported by script/check-style

* Fixed a bug at Aggregated::GetAuthToken that causes Segmentation Fault

* Changed usage of template funcion

* Applied latest changes from the repo

* Applied latest changes from the repo

* Applied latest changes from the repo

* Adde comments

* Updated log information

* Applied envoyproxy#101

* Changed metric_cost_map to metric_cost_vector

* Fixed test case compilation error

* Fixed test case compilation error

* Add unit test for quota config. (envoyproxy#108)

* Add unit test for quota config.

* Add comments.

* Update test specifics.

* Merge latest changes from master branch (envoyproxy#112)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Not to use api_key if its service is not actived. (envoyproxy#109)

* If QuotaControl service is not available, return utils::Status::OK (envoyproxy#113)

* If QuotaControl service is not available, return utils::Status::OK

* Updated comment

* Return HTTP status code 429 on google.rpc.Code.RESOURCE_EXHAUSTED (envoyproxy#119)

* Fixed incorrectly resolved conflicts (envoyproxy#123)

* Added unit test cases for rate limiting (envoyproxy#124)

* Fixed incorrectly resolved conflicts

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Rename response.http.code (envoyproxy#125) (envoyproxy#128)

* Added handling of error code QUOTA_SYSTEM_UNAVAILABLE (envoyproxy#148)

* Integrated service control client library with quota cache aggregation (envoyproxy#149)

* Fixed error on merge (envoyproxy#151)

* Integrated service control client library with quota cache aggregation

* Fixed error on merge

* Fixed the compatibility issue with the latest update on esp (envoyproxy#152)

* Removed copied proto files (envoyproxy#208)

* Set default allocate quota request timeout to 1sec and applied latest service control client library change (envoyproxy#211)

* Merged key_restriction related changes from master (envoyproxy#213)

* Merge latest changes from master branch (envoyproxy#217)

* Not call report if decodeHeaders is not called. (envoyproxy#150)

* Update mixerclient with sync-ed grpc write and fail-fast. (envoyproxy#155)

* Update mixerclient with sync-ed write and fail-fast.

* Update to latest test.

* Update again

* Update envoy to PR553 (envoyproxy#156)

* Update envoy to PR553

* Update libevent to 2.1.8

* Uses a specific version of the Shared Pipeline lib (envoyproxy#158)

* Update lyft/envoy commit Id to latest. (envoyproxy#161)

* Update lyft/envoy commit Id to latest.

* Remove the comment about pull request

* Add new line - will delete in next commit.

* Update repositories.bzl (envoyproxy#169)

* Always set response latency (envoyproxy#172)

* Update mixerclient to sync_transport change. (envoyproxy#178)

* Use opaque config to turn on/off forward attribute and mixer filter (envoyproxy#179)

* Modify mixer filter

* Swap defaults

* Make the filter decoder only

* cache mixer disabled decision

* Fix a bug in opaque config change and test it out (envoyproxy#182)

* Fix a bug and test it out

* Update filter type

* Update README.md

* Update mixer client to mixer api with gogoproto. (envoyproxy#184)

* Move .bazelrc to tools/bazel.rc (envoyproxy#186)

* Move .bazelrc to tools/bazel.rc

* Update Jenkinsfile with latest version of pipeline

* Support apikey based traffic restriction (envoyproxy#189)

* b/36368559 support apikey based traffic restriction

* Fixed code formatting

* Fix crash in unreachable/overloaded RDS (envoyproxy#190)

* Add mixer client end to end integration test. (envoyproxy#177)

* Add mixer client end to end integration test.

* Split some repositories into a separate file.

* use real mixer for fake mixer_server.

* Test repository

* use mixer bzl file.

* Use mixer repositories

* Not to use mixer repository.

* Add return line at the end of WORKSPACE.

* Fix broken link (envoyproxy#193)

* Make quota call (envoyproxy#192)

* hookup quota call

* Make quota call.

* Update indent.

* Update envoy and update configs (envoyproxy#195)

* Update envoy and update configs

* Use gcc-4.9 for travis

* Use bazel 0.4.5

* Fix SHA of lightstep-tracer-common

* Enable check cache and refactory mixer config loading  (envoyproxy#197)

* Refactory the mixer config loading.

* fix format

* Add integration test.

* updated README.md

* s/send/sent/

* Split into separate tests. (envoyproxy#201)

* Update README on how to enable check cache. (envoyproxy#204)

* Update README on how to enable check cache.

* Update the comment.

* build: support Envoy native Bazel build. (envoyproxy#210)

* build: support Envoy native Bazel build.

This patch switches the Envoy build from src/envoy/repositories.bzl to
using the upstream native build.

See envoyproxy#663 for the corresponding changes
on the Envoy side.

* Use Envoy master with BUILD.wip rename merged.

* Fix clang-format issues.

* Fixes bazel.rc issues (envoyproxy#212)

* Fixes bazel rc issues

* Update Jenkins to latest pipeline version

* Updated the commit id of cloudendpoints/service-control-client-cxx (envoyproxy#218)

* Update commitid of cloudendpoints/service-control-client-cxx repo (envoyproxy#220)
rshriram pushed a commit to rshriram/envoy that referenced this issue Oct 30, 2018
* Created check security rules file and a few dummy/helper functions. (envoyproxy#40)

* Created check security rules file and a few dummy/helper functions.

And added it to check work flow.

* Fix format.

* Firebase: Merge from master. (envoyproxy#53)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect (envoyproxy#38)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect

* Fixed style.

* Rebase Envoy (envoyproxy#41)

* Update prototype to use iptables (envoyproxy#42)

* Rebase to fixed Envoy (envoyproxy#43)

* Handle HEAD request. (envoyproxy#34)

* Handle HEAD request.

* Try with GET if HEAD fails.

* Address comments.

* Format file.

* Expose bazel target (envoyproxy#48)

* Try again (envoyproxy#49)

* Enable ESP to invoke Firebase Security rules. (envoyproxy#54)

* Enable ESP to invoke Firebase Security rules.

* Address code review comments.

* Remove some debug logs

* Add proto file to capture TestRulesetRequest.

* clang-format files

* Resolve a merge issue with previous commit

* Allow security rules to disabled via serverconfig

* format file

* Addressed Wayne's review comments.

* Add firebase server to Server Config.

* Address Lizan's review comments

* Address review comments.

* Disable check rules service by default.

* Address more review comments.

* Fix a check.

* Delete unwanted constant.

* Address Wayne's comments and add a simple config test.

* Address a review comment.

* Add negative test case for config

* Address code review

* Remove unwanted const std::string

* Merge from master into firebase (envoyproxy#65)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect (envoyproxy#38)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect

* Fixed style.

* Rebase Envoy (envoyproxy#41)

* Update prototype to use iptables (envoyproxy#42)

* Rebase to fixed Envoy (envoyproxy#43)

* Handle HEAD request. (envoyproxy#34)

* Handle HEAD request.

* Try with GET if HEAD fails.

* Address comments.

* Format file.

* Expose bazel target (envoyproxy#48)

* Try again (envoyproxy#49)

* Integrate with mixer client. (envoyproxy#55)

* Integrate with mixer client.

* Restore  repositories.bzl back.

* Add originIp and originHost attributes. (envoyproxy#56)

* Add uuid-dev dependency in README.md (envoyproxy#45)

* Extract originIp and OriginHost. (envoyproxy#57)

* Extract originIp and OriginHost.

* Make header x-forwarded-host const.

* Update buckets for UI. (envoyproxy#58)

* Update buckets for UI.

* Only update time_distribution.

* Add targetService attribute. (envoyproxy#59)

* Use envoy new access_log handler for sending Report. (envoyproxy#60)

* use access_log handler.

* Not to use Loggable base class.

* Update to the latest envoy with envoyproxy#396. (envoyproxy#61)

* Fix tclap dependency fetching error (envoyproxy#62)

* Update the auth checke to use service.experimental.authorization.providerwq!

* Update the auth check to use service.experimental.authorization.provider

* Update the auth check to use service.experimental.authorization.provider (envoyproxy#67)

* Update the auth check to use service.experimental.authorization.provider

* Address comments and revert accidental change.

* Remove unnecessary added accidentally.

* Another patch

* fix the logic

* fix lint

* Fix broken test and add unit tests

* Fix comments

* Fix style check

* revert style for raw string

* fix small lint

* fix small lint

* fix small lint

* Unit tests for check security rules. (envoyproxy#75)

* Unit tests for check security rules.

* format

* Address review comments.

* Fix typos

* Merge from master to firebase (envoyproxy#143)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect (envoyproxy#38)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect

* Fixed style.

* Rebase Envoy (envoyproxy#41)

* Update prototype to use iptables (envoyproxy#42)

* Rebase to fixed Envoy (envoyproxy#43)

* Handle HEAD request. (envoyproxy#34)

* Handle HEAD request.

* Try with GET if HEAD fails.

* Address comments.

* Format file.

* Expose bazel target (envoyproxy#48)

* Try again (envoyproxy#49)

* Integrate with mixer client. (envoyproxy#55)

* Integrate with mixer client.

* Restore  repositories.bzl back.

* Add originIp and originHost attributes. (envoyproxy#56)

* Add uuid-dev dependency in README.md (envoyproxy#45)

* Extract originIp and OriginHost. (envoyproxy#57)

* Extract originIp and OriginHost.

* Make header x-forwarded-host const.

* Update buckets for UI. (envoyproxy#58)

* Update buckets for UI.

* Only update time_distribution.

* Add targetService attribute. (envoyproxy#59)

* Use envoy new access_log handler for sending Report. (envoyproxy#60)

* use access_log handler.

* Not to use Loggable base class.

* Update to the latest envoy with envoyproxy#396. (envoyproxy#61)

* Fix tclap dependency fetching error (envoyproxy#62)

* Integrate mixer client directly with envoy. (envoyproxy#66)

* Integrate mixer client directly with envoy.

* Send response header in Report.

* rename filter name from esp to mixer.

* add README.

* Add release binary script. (envoyproxy#68)

* Push tar.gz to GCS (envoyproxy#69)

* Push tar.gz to GCS

* Rename envoy_esp

* Remove mixer_client from api_manager. (envoyproxy#72)

* Update mixer client SHA. (envoyproxy#74)

* Update readme. (envoyproxy#73)

* Adds Jenkinsfile and updates release-binary to create a SHA. (envoyproxy#71)

* Adds Jenkinsfile and update release-binary
* Update Jenkinsfile and gitignore
* Fixes typo and use normal build Node
* Uses default bazel config
* Using batch mode
* Update bazel memory settings
* Do not use Jenkins bazel env
* Set .bazelrc for postsubmit

* Update grpc and protobuf (envoyproxy#70)

* protobuf v3.2.0
* grpc v1.1.1
* Align auth lib with grpc 1.1.1

* Add sourceService. (envoyproxy#78)

* Add script to build docker image. (envoyproxy#77)

* Add script to build docker image.

* Add start_envoy for docker image.

* Use official attribute names (envoyproxy#80)

* Use official attribute names

* fix format

* Creates a KEY for mixer client dep. Updates release-binary (envoyproxy#79)

* Updated mixer repo to use a key for commit

* release-binary skip build if file exists.

* Update src/envoy/mixer/README. (envoyproxy#82)

* Fix src/envoy/mixer/README.md (envoyproxy#85)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Not to use api_key if its service is not actived. (envoyproxy#109)

* Update envoy and add c-ares (envoyproxy#107)

* Update envoy and add c-ares depedencies

* Update release script with debug and normal binary

* remove debug ls

* formatting

* Send StatusCode Attributes to Mixer. (envoyproxy#110)

* Add send_attribute filter. (envoyproxy#115)

* Add send_attribute filter.

* Fix format

* rename variable serialized_attributes_

* Address the comments.

* Fail request if api_key is not valid. (envoyproxy#116)

* Fail request if api_key is not valid.

* Format code.

* Update comments.

* Address comment.

* Rename response.http.code (envoyproxy#125)

* Send headers as string map. (envoyproxy#129)

* Send headers as string map.

* Remove origin.ip and origin.host.

* Fix format

* unify bazel's docker build targets with other istio repos (envoyproxy#127)

* update base debug docker image reference (envoyproxy#133)

* Update postsubmit to create docker images (envoyproxy#132)

* Adding config release for bazel build (envoyproxy#135)

* Fix mixer client crash. (envoyproxy#136)

* Get mixerclient with response parsing. (envoyproxy#138)

* Update nghttp2 to sync with envoy (envoyproxy#140)

* Fix src/envoy/mixer/README.md

* Update nghttp2 to sync with envoy

* update

* fix typo

* Merge from master to firebase (envoyproxy#159)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect (envoyproxy#38)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect

* Fixed style.

* Rebase Envoy (envoyproxy#41)

* Update prototype to use iptables (envoyproxy#42)

* Rebase to fixed Envoy (envoyproxy#43)

* Handle HEAD request. (envoyproxy#34)

* Handle HEAD request.

* Try with GET if HEAD fails.

* Address comments.

* Format file.

* Expose bazel target (envoyproxy#48)

* Try again (envoyproxy#49)

* Integrate with mixer client. (envoyproxy#55)

* Integrate with mixer client.

* Restore  repositories.bzl back.

* Add originIp and originHost attributes. (envoyproxy#56)

* Add uuid-dev dependency in README.md (envoyproxy#45)

* Extract originIp and OriginHost. (envoyproxy#57)

* Extract originIp and OriginHost.

* Make header x-forwarded-host const.

* Update buckets for UI. (envoyproxy#58)

* Update buckets for UI.

* Only update time_distribution.

* Add targetService attribute. (envoyproxy#59)

* Use envoy new access_log handler for sending Report. (envoyproxy#60)

* use access_log handler.

* Not to use Loggable base class.

* Update to the latest envoy with envoyproxy#396. (envoyproxy#61)

* Fix tclap dependency fetching error (envoyproxy#62)

* Integrate mixer client directly with envoy. (envoyproxy#66)

* Integrate mixer client directly with envoy.

* Send response header in Report.

* rename filter name from esp to mixer.

* add README.

* Add release binary script. (envoyproxy#68)

* Push tar.gz to GCS (envoyproxy#69)

* Push tar.gz to GCS

* Rename envoy_esp

* Remove mixer_client from api_manager. (envoyproxy#72)

* Update mixer client SHA. (envoyproxy#74)

* Update readme. (envoyproxy#73)

* Adds Jenkinsfile and updates release-binary to create a SHA. (envoyproxy#71)

* Adds Jenkinsfile and update release-binary
* Update Jenkinsfile and gitignore
* Fixes typo and use normal build Node
* Uses default bazel config
* Using batch mode
* Update bazel memory settings
* Do not use Jenkins bazel env
* Set .bazelrc for postsubmit

* Update grpc and protobuf (envoyproxy#70)

* protobuf v3.2.0
* grpc v1.1.1
* Align auth lib with grpc 1.1.1

* Add sourceService. (envoyproxy#78)

* Add script to build docker image. (envoyproxy#77)

* Add script to build docker image.

* Add start_envoy for docker image.

* Use official attribute names (envoyproxy#80)

* Use official attribute names

* fix format

* Creates a KEY for mixer client dep. Updates release-binary (envoyproxy#79)

* Updated mixer repo to use a key for commit

* release-binary skip build if file exists.

* Update src/envoy/mixer/README. (envoyproxy#82)

* Fix src/envoy/mixer/README.md (envoyproxy#85)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Not to use api_key if its service is not actived. (envoyproxy#109)

* Update envoy and add c-ares (envoyproxy#107)

* Update envoy and add c-ares depedencies

* Update release script with debug and normal binary

* remove debug ls

* formatting

* Send StatusCode Attributes to Mixer. (envoyproxy#110)

* Add send_attribute filter. (envoyproxy#115)

* Add send_attribute filter.

* Fix format

* rename variable serialized_attributes_

* Address the comments.

* Fail request if api_key is not valid. (envoyproxy#116)

* Fail request if api_key is not valid.

* Format code.

* Update comments.

* Address comment.

* Rename response.http.code (envoyproxy#125)

* Send headers as string map. (envoyproxy#129)

* Send headers as string map.

* Remove origin.ip and origin.host.

* Fix format

* unify bazel's docker build targets with other istio repos (envoyproxy#127)

* update base debug docker image reference (envoyproxy#133)

* Update postsubmit to create docker images (envoyproxy#132)

* Adding config release for bazel build (envoyproxy#135)

* Fix mixer client crash. (envoyproxy#136)

* Get mixerclient with response parsing. (envoyproxy#138)

* Update nghttp2 to sync with envoy (envoyproxy#140)

* Fix src/envoy/mixer/README.md

* Update nghttp2 to sync with envoy

* update

* fix typo

* Populate origin.user attribute from the SAN field of client cert (envoyproxy#142)

* Test

* test

* test

* revert file

* address comments

* test

* fix typo

* fix format

* fix format

* Update to latest mixer_client. (envoyproxy#145)

* Update to latest mixer_client.

* Updated the sha.

* Not call report if decodeHeaders is not called. (envoyproxy#150)

* Update mixerclient with sync-ed grpc write and fail-fast. (envoyproxy#155)

* Update mixerclient with sync-ed write and fail-fast.

* Update to latest test.

* Update again

* Update envoy to PR553 (envoyproxy#156)

* Update envoy to PR553

* Update libevent to 2.1.8

* Update the Commit id for envoy

* Allow for HTTP based function from Firebase rules (envoyproxy#202)

* Allow for HTTP based function from Firebase rules

* Fix code style check

* Added more comments.

* Fix style issues.

* Address code review comments from Limin and Lizan.

* Add more comments and address CR comments.

* Fix a typo.

* Address Wayne's CR comments.

* Merge from master to firebase (envoyproxy#237)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect (envoyproxy#38)

* Simple TCP server to show how to retrieve original dest IP:port after an iptables redirect

* Fixed style.

* Rebase Envoy (envoyproxy#41)

* Update prototype to use iptables (envoyproxy#42)

* Rebase to fixed Envoy (envoyproxy#43)

* Handle HEAD request. (envoyproxy#34)

* Handle HEAD request.

* Try with GET if HEAD fails.

* Address comments.

* Format file.

* Expose bazel target (envoyproxy#48)

* Try again (envoyproxy#49)

* Integrate with mixer client. (envoyproxy#55)

* Integrate with mixer client.

* Restore  repositories.bzl back.

* Add originIp and originHost attributes. (envoyproxy#56)

* Add uuid-dev dependency in README.md (envoyproxy#45)

* Extract originIp and OriginHost. (envoyproxy#57)

* Extract originIp and OriginHost.

* Make header x-forwarded-host const.

* Update buckets for UI. (envoyproxy#58)

* Update buckets for UI.

* Only update time_distribution.

* Add targetService attribute. (envoyproxy#59)

* Use envoy new access_log handler for sending Report. (envoyproxy#60)

* use access_log handler.

* Not to use Loggable base class.

* Update to the latest envoy with envoyproxy#396. (envoyproxy#61)

* Fix tclap dependency fetching error (envoyproxy#62)

* Integrate mixer client directly with envoy. (envoyproxy#66)

* Integrate mixer client directly with envoy.

* Send response header in Report.

* rename filter name from esp to mixer.

* add README.

* Add release binary script. (envoyproxy#68)

* Push tar.gz to GCS (envoyproxy#69)

* Push tar.gz to GCS

* Rename envoy_esp

* Remove mixer_client from api_manager. (envoyproxy#72)

* Update mixer client SHA. (envoyproxy#74)

* Update readme. (envoyproxy#73)

* Adds Jenkinsfile and updates release-binary to create a SHA. (envoyproxy#71)

* Adds Jenkinsfile and update release-binary
* Update Jenkinsfile and gitignore
* Fixes typo and use normal build Node
* Uses default bazel config
* Using batch mode
* Update bazel memory settings
* Do not use Jenkins bazel env
* Set .bazelrc for postsubmit

* Update grpc and protobuf (envoyproxy#70)

* protobuf v3.2.0
* grpc v1.1.1
* Align auth lib with grpc 1.1.1

* Add sourceService. (envoyproxy#78)

* Add script to build docker image. (envoyproxy#77)

* Add script to build docker image.

* Add start_envoy for docker image.

* Use official attribute names (envoyproxy#80)

* Use official attribute names

* fix format

* Creates a KEY for mixer client dep. Updates release-binary (envoyproxy#79)

* Updated mixer repo to use a key for commit

* release-binary skip build if file exists.

* Update src/envoy/mixer/README. (envoyproxy#82)

* Fix src/envoy/mixer/README.md (envoyproxy#85)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Not to use api_key if its service is not actived. (envoyproxy#109)

* Update envoy and add c-ares (envoyproxy#107)

* Update envoy and add c-ares depedencies

* Update release script with debug and normal binary

* remove debug ls

* formatting

* Send StatusCode Attributes to Mixer. (envoyproxy#110)

* Add send_attribute filter. (envoyproxy#115)

* Add send_attribute filter.

* Fix format

* rename variable serialized_attributes_

* Address the comments.

* Fail request if api_key is not valid. (envoyproxy#116)

* Fail request if api_key is not valid.

* Format code.

* Update comments.

* Address comment.

* Rename response.http.code (envoyproxy#125)

* Send headers as string map. (envoyproxy#129)

* Send headers as string map.

* Remove origin.ip and origin.host.

* Fix format

* unify bazel's docker build targets with other istio repos (envoyproxy#127)

* update base debug docker image reference (envoyproxy#133)

* Update postsubmit to create docker images (envoyproxy#132)

* Adding config release for bazel build (envoyproxy#135)

* Fix mixer client crash. (envoyproxy#136)

* Get mixerclient with response parsing. (envoyproxy#138)

* Update nghttp2 to sync with envoy (envoyproxy#140)

* Fix src/envoy/mixer/README.md

* Update nghttp2 to sync with envoy

* update

* fix typo

* Populate origin.user attribute from the SAN field of client cert (envoyproxy#142)

* Test

* test

* test

* revert file

* address comments

* test

* fix typo

* fix format

* fix format

* Update to latest mixer_client. (envoyproxy#145)

* Update to latest mixer_client.

* Updated the sha.

* Not call report if decodeHeaders is not called. (envoyproxy#150)

* Update mixerclient with sync-ed grpc write and fail-fast. (envoyproxy#155)

* Update mixerclient with sync-ed write and fail-fast.

* Update to latest test.

* Update again

* Update envoy to PR553 (envoyproxy#156)

* Update envoy to PR553

* Update libevent to 2.1.8

* Uses a specific version of the Shared Pipeline lib (envoyproxy#158)

* Update lyft/envoy commit Id to latest. (envoyproxy#161)

* Update lyft/envoy commit Id to latest.

* Remove the comment about pull request

* Add new line - will delete in next commit.

* Update repositories.bzl (envoyproxy#169)

* Always set response latency (envoyproxy#172)

* Update mixerclient to sync_transport change. (envoyproxy#178)

* Use opaque config to turn on/off forward attribute and mixer filter (envoyproxy#179)

* Modify mixer filter

* Swap defaults

* Make the filter decoder only

* cache mixer disabled decision

* Fix a bug in opaque config change and test it out (envoyproxy#182)

* Fix a bug and test it out

* Update filter type

* Update README.md

* Update mixer client to mixer api with gogoproto. (envoyproxy#184)

* Move .bazelrc to tools/bazel.rc (envoyproxy#186)

* Move .bazelrc to tools/bazel.rc

* Update Jenkinsfile with latest version of pipeline

* Support apikey based traffic restriction (envoyproxy#189)

* b/36368559 support apikey based traffic restriction

* Fixed code formatting

* Fix crash in unreachable/overloaded RDS (envoyproxy#190)

* Add mixer client end to end integration test. (envoyproxy#177)

* Add mixer client end to end integration test.

* Split some repositories into a separate file.

* use real mixer for fake mixer_server.

* Test repository

* use mixer bzl file.

* Use mixer repositories

* Not to use mixer repository.

* Add return line at the end of WORKSPACE.

* Fix broken link (envoyproxy#193)

* Make quota call (envoyproxy#192)

* hookup quota call

* Make quota call.

* Update indent.

* Update envoy and update configs (envoyproxy#195)

* Update envoy and update configs

* Use gcc-4.9 for travis

* Use bazel 0.4.5

* Fix SHA of lightstep-tracer-common

* Enable check cache and refactory mixer config loading  (envoyproxy#197)

* Refactory the mixer config loading.

* fix format

* Add integration test.

* updated README.md

* s/send/sent/

* Split into separate tests. (envoyproxy#201)

* Update README on how to enable check cache. (envoyproxy#204)

* Update README on how to enable check cache.

* Update the comment.

* build: support Envoy native Bazel build. (envoyproxy#210)

* build: support Envoy native Bazel build.

This patch switches the Envoy build from src/envoy/repositories.bzl to
using the upstream native build.

See envoyproxy#663 for the corresponding changes
on the Envoy side.

* Use Envoy master with BUILD.wip rename merged.

* Fix clang-format issues.

* Fixes bazel.rc issues (envoyproxy#212)

* Fixes bazel rc issues

* Update Jenkins to latest pipeline version

* Fix go build (envoyproxy#224)

* Use TranscoderInputStream to reduce confusion around ByteCount() (envoyproxy#225)

* Add TranscoderInputStream to reduce confusion

* fix_format

* Merge latest changes from rate_limiting to master (envoyproxy#221)

* Point to googleapi in service control client. (envoyproxy#91)

* Point to googleapi in service control client.

* Use git repository for service-control-client.

* Merge latest changes from master (envoyproxy#104)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Extract quota config from service config. (envoyproxy#101)

* Add metric_cost in config.

* Remove group rules.

* Call loadQuotaConfig in config::create.

* Update latest update from master branch (envoyproxy#106)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Added quota contoll without the service control client library (envoyproxy#93)

* Added quota contoll without the service control client library

* Applied code review

* Applied code review

* Resolve conflicts

* Resolve conflicts

* Fixed format error reported by script/check-style

* Fixed a bug at Aggregated::GetAuthToken that causes Segmentation Fault

* Changed usage of template funcion

* Applied latest changes from the repo

* Applied latest changes from the repo

* Applied latest changes from the repo

* Adde comments

* Updated log information

* Applied envoyproxy#101

* Changed metric_cost_map to metric_cost_vector

* Fixed test case compilation error

* Fixed test case compilation error

* Add unit test for quota config. (envoyproxy#108)

* Add unit test for quota config.

* Add comments.

* Update test specifics.

* Merge latest changes from master branch (envoyproxy#112)

* Get attributes from envoy config. (envoyproxy#87)

* Send all attributes.

* Remove unused const strings.

* Address comment.

* updated SHA to point to newer envoy with RDS API feature (envoyproxy#94)

* Disable travis on stable branches (envoyproxy#96)

* Publish debug binaries (no release yet) (envoyproxy#98)

* Copies the binary instead of linking for release (envoyproxy#102)

* Not to use api_key if its service is not actived. (envoyproxy#109)

* If QuotaControl service is not available, return utils::Status::OK (envoyproxy#113)

* If QuotaControl service is not available, return utils::Status::OK

* Updated comment

* Return HTTP status code 429 on google.rpc.Code.RESOURCE_EXHAUSTED (envoyproxy#119)

* Fixed incorrectly resolved conflicts (envoyproxy#123)

* Added unit test cases for rate limiting (envoyproxy#124)

* Fixed incorrectly resolved conflicts

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Added unit test cases for rate limiting

* Rename response.http.code (envoyproxy#125) (envoyproxy#128)

* Added handling of error code QUOTA_SYSTEM_UNAVAILABLE (envoyproxy#148)

* Integrated service control client library with quota cache aggregation (envoyproxy#149)

* Fixed error on merge (envoyproxy#151)

* Integrated service control client library with quota cache aggregation

* Fixed error on merge

* Fixed the compatibility issue with the latest update on esp (envoyproxy#152)

* Removed copied proto files (envoyproxy#208)

* Set default allocate quota request timeout to 1sec and applied latest service control client library change (envoyproxy#211)

* Merged key_restriction related changes from master (envoyproxy#213)

* Merge latest changes from master branch (envoyproxy#217)

* Not call report if decodeHeaders is not called. (envoyproxy#150)

* Update mixerclient with sync-ed grpc write and fail-fast. (envoyproxy#155)

* Update mixerclient with sync-ed write and fail-fast.

* Update to latest test.

* Update again

* Update envoy to PR553 (envoyproxy#156)

* Update envoy to PR553

* Update libevent to 2.1.8

* Uses a specific version of the Shared Pipeline lib (envoyproxy#158)

* Update lyft/envoy commit Id to latest. (envoyproxy#161)

* Update lyft/envoy commit Id to latest.

* Remove the comment about pull request

* Add new line - will delete in next commit.

* Update repositories.bzl (envoyproxy#169)

* Always set response latency (envoyproxy#172)

* Update mixerclient to sync_transport change. (envoyproxy#178)

* Use opaque config to turn on/off forward attribute and mixer filter (envoyproxy#179)

* Modify mixer filter

* Swap defaults

* Make the filter decoder only

* cache mixer disabled decision

* Fix a bug in opaque config change and test it out (envoyproxy#182)

* Fix a bug and test it out

* Update filter type

* Update README.md

* Update mixer client to mixer api with gogoproto. (envoyproxy#184)

* Move .bazelrc to tools/bazel.rc (envoyproxy#186)

* Move .bazelrc to tools/bazel.rc

* Update Jenkinsfile with latest version of pipeline

* Support apikey based traffic restriction (envoyproxy#189)

* b/36368559 support apikey based traffic restriction

* Fixed code formatting

* Fix crash in unreachable/overloaded RDS (envoyproxy#190)

* Add mixer client end to end integration test. (envoyproxy#177)

* Add mixer client end to end integration test.

* Split some repositories into a separate file.

* use real mixer for fake mixer_server.

* Test repository

* use mixer bzl file.

* Use mixer repositories

* Not to use mixer repository.

* Add return line at the end of WORKSPACE.

* Fix broken link (envoyproxy#193)

* Make quota call (envoyproxy#192)

* hookup quota call

* Make quota call.

* Update indent.

* Update envoy and update configs (envoyproxy#195)

* Update envoy and update configs

* Use gcc-4.9 for travis

* Use bazel 0.4.5

* Fix SHA of lightstep-tracer-common

* Enable check cache and refactory mixer config loading  (envoyproxy#197)

* Refactory the mixer config loading.

* fix format

* Add integration test.

* updated README.md

* s/send/sent/

* Split into separate tests. (envoyproxy#201)

* Update README on how to enable check cache. (envoyproxy#204)

* Update README on how to enable check cache.

* Update the comment.

* build: support Envoy native Bazel build. (envoyproxy#210)

* build: support Envoy native Bazel build.

This patch switches the Envoy build from src/envoy/repositories.bzl to
using the upstream native build.

See envoyproxy#663 for the corresponding changes
on the Envoy side.

* Use Envoy master with BUILD.wip rename merged.

* Fix clang-format issues.

* Fixes bazel.rc issues (envoyproxy#212)

* Fixes bazel rc issues

* Update Jenkins to latest pipeline version

* Updated the commit id of cloudendpoints/service-control-client-cxx (envoyproxy#218)

* Update commitid of cloudendpoints/service-control-client-cxx repo (envoyproxy#220)

* Send delta metrics for intermediate reports. (envoyproxy#219)

* Send delta metrics for intermediate reports.

* Move last_request_bytes/last_response_bytes to RequestContext.

* Handle final report.

* Address comment.

* Update attributes to match the canonical attribute list. (envoyproxy#232)

* Update response.http.code to response.code and response.latency to response.duration to line up with the canonical attributes in istio/istio.github.io/docs/concepts/attributes.md

* Format according to clang-format

* Add envoy Buffer based TranscoderInputStream (envoyproxy#231)

* Add envoy Buffer based TranscoderInputStream

* fix format

* A few doc changes for consistency across repos. (envoyproxy#235)

* Add repositories.bzl

* Added missing export setting in bazel configuration (envoyproxy#236)

* Added export missing in bazel configuration

* Added export missing in bazel configuration

* Allow HTTP functions in firebase rules to specify audience (envoyproxy#244)

* Allow HTTP functions in firebase rules to specify audience

* Allow GetAuthToken to ignore cache and fix style checks.

* Fix GetAuthToken

* Address Wayne's comment

* Check for empty response body

* Remove .bazelrc.jenkins file not present in the master branch.

* Remove forward_attribute_filter.cc not present in master.
@0521ak47
Copy link

i use https but ratelimit not work

PiotrSikora pushed a commit to PiotrSikora/envoy that referenced this issue Oct 10, 2019
* use filter state

Signed-off-by: Kuat Yessenov <kuat@google.com>
PiotrSikora added a commit to PiotrSikora/envoy that referenced this issue Mar 4, 2020
…) (envoyproxy#179)

Signed-off-by: Alyssa Wilk <alyssar@chromium.org>

Co-authored-by: Lizan Zhou <lizan@tetrate.io>
wolfguoliang pushed a commit to wolfguoliang/envoy that referenced this issue Jan 23, 2021
arminabf pushed a commit to arminabf/envoy that referenced this issue Jun 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement Feature requests. Not bugs or questions.
Projects
None yet
Development

No branches or pull requests

6 participants