limits: allow block user by negative rate limit (#423)

* limits: allow block user by negative rate limit

* add proxy test cases

Author: tomershafir

config/README.md

@@ -262,7 +262,8 @@ max_concurrent_queries: <int> | optional | default = 0
 max_execution_time: <duration> | optional | default = 120s
 
 # Maximum number of requests per minute for user.
-# By default there are no per-minute limits
+# By default there are no per-minute limits.
+# A negative value would effectively block the user.
 requests_per_minute: <int> | optional | default = 0
 
 # The burst of request packet size token bucket for user

config/config.go

@@ -733,7 +733,8 @@ type User struct {
 
 	// Maximum number of requests per minute for user
 	// if omitted or zero - no limits would be applied
-	ReqPerMin uint32 `yaml:"requests_per_minute,omitempty"`
+	// if negative - the user is effectively blocked
+	ReqPerMin int32 `yaml:"requests_per_minute,omitempty"`
 
 	// The burst of request packet size token bucket for user
 	// if omitted or zero - no limits would be applied
@@ -1086,7 +1087,8 @@ type ClusterUser struct {
 
 	// Maximum number of requests per minute for user
 	// if omitted or zero - no limits would be applied
-	ReqPerMin uint32 `yaml:"requests_per_minute,omitempty"`
+	// if negative - the user is effectively blocked
+	ReqPerMin int32 `yaml:"requests_per_minute,omitempty"`
 
 	// The burst of request packet size token bucket for user
 	// if omitted or zero - no limits would be applied

config/examples/combined.yml

@@ -33,6 +33,12 @@ users:
     max_queue_time: 25s
     cache: "shortterm"
 
+  - name: "blocked"
+    password: "****"
+    to_cluster: "stats-raw"
+    to_user: "blocked"
+    requests_per_minute: -1
+
 clusters:
   - name: "stats-aggregate"
     nodes: [

proxy_test.go

@@ -415,6 +415,17 @@ func TestReverseProxy_ServeHTTP1(t *testing.T) {
 				return makeRequest(p)
 			},
 		},
+		{
+			cfg:           goodCfg,
+			name:          "max requests per minute negative for cluster user",
+			expResponse:   "rate limit for cluster user \"web\" is exceeded: requests_per_minute limit: -1",
+			expStatusCode: http.StatusTooManyRequests,
+			f: func(p *reverseProxy) *http.Response {
+				p.clusters["cluster"].users["web"].reqPerMin = -1
+				runHeavyRequestInGoroutine(p, 1, true)
+				return makeRequest(p)
+			},
+		},
 		{
 			cfg:           goodCfg,
 			name:          "max time for cluster user",
@@ -458,6 +469,17 @@ func TestReverseProxy_ServeHTTP1(t *testing.T) {
 				return makeRequest(p)
 			},
 		},
+		{
+			cfg:           goodCfg,
+			name:          "max requests per minute negative for user",
+			expResponse:   fmt.Sprintf("rate limit for user %q is exceeded: requests_per_minute limit: -1", defaultUsername),
+			expStatusCode: http.StatusTooManyRequests,
+			f: func(p *reverseProxy) *http.Response {
+				p.users[defaultUsername].reqPerMin = -1
+				runHeavyRequestInGoroutine(p, 1, true)
+				return makeRequest(p)
+			},
+		},
 		{
 			cfg:           goodCfg,
 			name:          "queuing queries for user",

scope.go

@@ -255,11 +255,11 @@ func (s *scope) checkTokenFreeRateLimiters() error {
 	// is decremented on error below after per-minute zeroing
 	// in rateLimiter.run.
 	// These races become innocent with the given check.
-	if s.user.reqPerMin > 0 && int32(uRPM) > 0 && uRPM > s.user.reqPerMin {
+	if (s.user.reqPerMin > 0 && int32(uRPM) > 0 && uRPM > uint32(s.user.reqPerMin)) || s.user.reqPerMin < 0 {
 		err = fmt.Errorf("rate limit for user %q is exceeded: requests_per_minute limit: %d",
 			s.user.name, s.user.reqPerMin)
 	}
-	if s.clusterUser.reqPerMin > 0 && int32(cRPM) > 0 && cRPM > s.clusterUser.reqPerMin {
+	if (s.clusterUser.reqPerMin > 0 && int32(cRPM) > 0 && cRPM > uint32(s.clusterUser.reqPerMin)) || s.clusterUser.reqPerMin < 0 {
 		err = fmt.Errorf("rate limit for cluster user %q is exceeded: requests_per_minute limit: %d",
 			s.clusterUser.name, s.clusterUser.reqPerMin)
 	}
@@ -525,7 +525,7 @@ type user struct {
 
 	maxExecutionTime time.Duration
 
-	reqPerMin   uint32
+	reqPerMin   int32
 	rateLimiter rateLimiter
 
 	reqPacketSizeTokenLimiter *rate.Limiter
@@ -635,7 +635,7 @@ type clusterUser struct {
 
 	maxExecutionTime time.Duration
 
-	reqPerMin   uint32
+	reqPerMin   int32
 	rateLimiter rateLimiter
 
 	queueCh      chan struct{}