├── .gitignore ├── README.md ├── lib └── resty │ └── rate │ └── limit.lua └── utils └── lua-releng /.gitignore: -------------------------------------------------------------------------------- 1 | .DS_Store 2 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | ## OpenResty Redis Backed Rate Limiter 2 | This is a OpenResty Lua and Redis powered rate limiter. You can specify the number of requests to allow within a certain timespan, ie. 40 requests within 10 seconds. With this setting (as an example), you can burst to 40 requests in a single second if you wanted, but would have to wait 9 more seconds before being allowed to issue another. 3 | 4 | One of the key reasons we built this was to be able to share the rate limit across our entire API fleet as opposed to individually on each instance. We've tested this to be stable with a single Redis instance processing over 20,000 requests per second. 5 | 6 | lua-resty-rate-limit is considered production ready and is currently being used to power our rate limiting at [The Movie Database (TMDb)](https://www.themoviedb.org). 7 | 8 | ### OpenResty Prerequisite 9 | You have to compile OpenResty with the `--with-http_realip_module` option. 10 | 11 | ### Needed in your nginx.conf 12 | ``` 13 | http { 14 | # http://serverfault.com/questions/331531/nginx-set-real-ip-from-aws-elb-load-balancer-address 15 | # http://serverfault.com/questions/331697/ip-range-for-internal-private-ip-of-amazon-elb 16 | set_real_ip_from 127.0.0.1; 17 | set_real_ip_from 10.0.0.0/8; 18 | set_real_ip_from 172.16.0.0/12; 19 | set_real_ip_from 192.168.0.0/16; 20 | real_ip_header X-Forwarded-For; 21 | real_ip_recursive on; 22 | } 23 | ``` 24 | 25 | ### Example OpenResty Site Config 26 | ``` 27 | # Location of this Lua package 28 | lua_package_path "/opt/lua-resty-rate-limit/lib/?.lua;;"; 29 | 30 | upstream api { 31 | server unix:/run/api.sock; 32 | } 33 | 34 | server { 35 | listen 80; 36 | server_name api.dev; 37 | 38 | access_log /var/log/openresty/api_access.log; 39 | error_log /var/log/openresty/api_error.log; 40 | 41 | location / { 42 | access_by_lua ' 43 | local request = require "resty.rate.limit" 44 | request.limit { key = ngx.var.remote_addr, 45 | rate = 40, 46 | interval = 10, 47 | log_level = ngx.NOTICE, 48 | redis_config = { host = "127.0.0.1", port = 6379, timeout = 1, pool_size = 100 }, 49 | whitelisted_api_keys = { ["XXX"] = true, ["ZZZ"] = true } } 50 | '; 51 | 52 | proxy_set_header Host $host; 53 | proxy_set_header X-Server-Scheme $scheme; 54 | proxy_set_header X-Real-IP $remote_addr; 55 | proxy_set_header X-Forwarded-For $remote_addr; 56 | proxy_set_header X-Forwarded-Proto $x_forwarded_proto; 57 | 58 | proxy_connect_timeout 1s; 59 | proxy_read_timeout 30s; 60 | 61 | proxy_pass http://api; 62 | } 63 | } 64 | ``` 65 | 66 | ### Config Values 67 | You can customize the rate limiting options by changing the following values: 68 | 69 | * key: The value to use as a unique identifier in Redis 70 | * rate: The number of requests to allow within the specified interval 71 | * interval: The number of seconds before the bucket expires 72 | * log_level: Set an Nginx log level. All errors from this plugin will be dumped here 73 | * redis_config: The Redis host, port, timeout and pool size 74 | * whitelisted_api_keys: A lua table of API keys to skip the rate limit checks for 75 | 76 | ### License 77 | 78 | MIT License 79 | 80 | Copyright (c) 2016 Travis Bell 81 | 82 | Permission is hereby granted, free of charge, to any person obtaining a copy 83 | of this software and associated documentation files (the "Software"), to deal 84 | in the Software without restriction, including without limitation the rights 85 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 86 | copies of the Software, and to permit persons to whom the Software is 87 | furnished to do so, subject to the following conditions: 88 | 89 | The above copyright notice and this permission notice shall be included in all 90 | copies or substantial portions of the Software. 91 | 92 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 93 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 94 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 95 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 96 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 97 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 98 | SOFTWARE. -------------------------------------------------------------------------------- /lib/resty/rate/limit.lua: -------------------------------------------------------------------------------- 1 | _M = { _VERSION = "1.0" } 2 | 3 | local reset = 0 4 | 5 | local function expire_key(redis_connection, key, interval, log_level) 6 | local expire, error = redis_connection:expire(key, interval) 7 | if not expire then 8 | ngx.log(log_level, "failed to get ttl: ", error) 9 | return 10 | end 11 | end 12 | 13 | local function bump_request(redis_connection, redis_pool_size, ip_key, rate, interval, current_time, log_level) 14 | local key = "RL:" .. ip_key 15 | 16 | local count, error = redis_connection:incr(key) 17 | if not count then 18 | ngx.log(log_level, "failed to incr count: ", error) 19 | return 20 | end 21 | 22 | if tonumber(count) == 1 then 23 | reset = (current_time + interval) 24 | expire_key(redis_connection, key, interval, log_level) 25 | else 26 | local ttl, error = redis_connection:pttl(key) 27 | if not ttl then 28 | ngx.log(log_level, "failed to get ttl: ", error) 29 | return 30 | end 31 | if ttl == -1 then 32 | ttl = interval 33 | expire_key(redis_connection, key, interval, log_level) 34 | end 35 | reset = (current_time + (ttl * 0.001)) 36 | end 37 | 38 | local ok, error = redis_connection:set_keepalive(60000, redis_pool_size) 39 | if not ok then 40 | ngx.log(log_level, "failed to set keepalive: ", error) 41 | end 42 | 43 | local remaining = rate - count 44 | 45 | return { count = count, remaining = remaining, reset = reset } 46 | end 47 | 48 | function _M.limit(config) 49 | local uri_parameters = ngx.req.get_uri_args() 50 | local enforce_limit = true 51 | local whitelisted_api_keys = config.whitelisted_api_keys or {} 52 | 53 | if config.whitelisted_api_keys[uri_parameters.api_key] then 54 | enforce_limit = false 55 | end 56 | 57 | if enforce_limit then 58 | local log_level = config.log_level or ngx.ERR 59 | 60 | if not config.connection then 61 | local ok, redis = pcall(require, "resty.redis") 62 | if not ok then 63 | ngx.log(log_level, "failed to require redis") 64 | return 65 | end 66 | 67 | local redis_config = config.redis_config or {} 68 | redis_config.timeout = redis_config.timeout or 1 69 | redis_config.host = redis_config.host or "127.0.0.1" 70 | redis_config.port = redis_config.port or 6379 71 | redis_config.pool_size = redis_config.pool_size or 100 72 | 73 | local redis_connection = redis:new() 74 | redis_connection:set_timeout(redis_config.timeout * 1000) 75 | 76 | local ok, error = redis_connection:connect(redis_config.host, redis_config.port) 77 | if not ok then 78 | ngx.log(log_level, "failed to connect to redis: ", error) 79 | return 80 | end 81 | 82 | config.redis_config = redis_config 83 | config.connection = redis_connection 84 | end 85 | 86 | local current_time = ngx.now() 87 | local connection = config.connection 88 | local redis_pool_size = config.redis_config.pool_size 89 | local key = config.key or ngx.var.remote_addr 90 | local rate = config.rate or 10 91 | local interval = config.interval or 1 92 | 93 | local response, error = bump_request(connection, redis_pool_size, key, rate, interval, current_time, log_level) 94 | if not response then 95 | return 96 | end 97 | 98 | if response.count > rate then 99 | local retry_after = math.floor(response.reset - current_time) 100 | if retry_after < 0 then 101 | retry_after = 0 102 | end 103 | 104 | ngx.header["Content-Type"] = "application/json; charset=utf-8" 105 | ngx.header["Retry-After"] = retry_after 106 | ngx.status = 429 107 | ngx.say('{"status_code":25,"status_message":"Your request count (' .. response.count .. ') is over the allowed limit of ' .. rate .. '."}') 108 | ngx.exit(ngx.HTTP_OK) 109 | else 110 | ngx.header["X-RateLimit-Limit"] = rate 111 | ngx.header["X-RateLimit-Remaining"] = math.floor(response.remaining) 112 | ngx.header["X-RateLimit-Reset"] = math.floor(response.reset) 113 | end 114 | else 115 | return 116 | end 117 | end 118 | 119 | return _M 120 | -------------------------------------------------------------------------------- /utils/lua-releng: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env perl 2 | 3 | use strict; 4 | use warnings; 5 | 6 | use Getopt::Std; 7 | 8 | my (@luas, @tests); 9 | 10 | my %opts; 11 | getopts('Lse', \%opts) or die "Usage: lua-releng [-L] [-s] [-e] [files]\n"; 12 | 13 | my $silent = $opts{s}; 14 | my $stop_on_error = $opts{e}; 15 | my $no_long_line_check = $opts{L}; 16 | 17 | if ($#ARGV != -1) { 18 | @luas = @ARGV; 19 | 20 | } else { 21 | @luas = map glob, qw{ *.lua lib/*.lua lib/*/*.lua lib/*/*/*.lua lib/*/*/*/*.lua lib/*/*/*/*/*.lua }; 22 | if (-d 't') { 23 | @tests = map glob, qw{ t/*.t t/*/*.t t/*/*/*.t }; 24 | } 25 | } 26 | 27 | for my $f (sort @luas) { 28 | process_file($f); 29 | } 30 | 31 | for my $t (@tests) { 32 | blank(qq{grep -H -n --color -E '\\--- ?(ONLY|LAST)' $t}); 33 | } 34 | # p: prints a string to STDOUT appending \n 35 | # w: prints a string to STDERR appending \n 36 | # Both respect the $silent value 37 | sub p { print "$_[0]\n" if (!$silent) } 38 | sub w { warn "$_[0]\n" if (!$silent) } 39 | 40 | # blank: runs a command and looks at the output. If the output is not 41 | # blank it is printed (and the program dies if stop_on_error is 1) 42 | sub blank { 43 | my ($command) = @_; 44 | if ($stop_on_error) { 45 | my $output = `$command`; 46 | if ($output ne '') { 47 | die $output; 48 | } 49 | } else { 50 | system($command); 51 | } 52 | } 53 | 54 | my $version; 55 | sub process_file { 56 | my $file = shift; 57 | # Check the sanity of each .lua file 58 | open my $in, $file or 59 | die "ERROR: Can't open $file for reading: $!\n"; 60 | my $found_ver; 61 | while (<$in>) { 62 | my ($ver, $skipping); 63 | if (/(?x) (?:_VERSION|version) \s* = .*? ([\d\.]*\d+) (.*? SKIP)?/) { 64 | my $orig_ver = $ver = $1; 65 | $found_ver = 1; 66 | $skipping = $2; 67 | $ver =~ s{^(\d+)\.(\d{3})(\d{3})$}{join '.', int($1), int($2), int($3)}e; 68 | w("$file: $orig_ver ($ver)"); 69 | last; 70 | 71 | } elsif (/(?x) (?:_VERSION|version) \s* = \s* ([a-zA-Z_]\S*)/) { 72 | w("$file: $1"); 73 | $found_ver = 1; 74 | last; 75 | } 76 | 77 | if ($ver and $version and !$skipping) { 78 | if ($version ne $ver) { 79 | die "$file: $ver != $version\n"; 80 | } 81 | } elsif ($ver and !$version) { 82 | $version = $ver; 83 | } 84 | } 85 | if (!$found_ver) { 86 | w("WARNING: No \"_VERSION\" or \"version\" field found in `$file`."); 87 | } 88 | close $in; 89 | 90 | p("Checking use of Lua global variables in file $file..."); 91 | p("\top no.\tline\tinstruction\targs\t; code"); 92 | blank("luac -p -l $file | grep -E '[GS]ETGLOBAL' | grep -vE '\\<(require|type|tostring|error|ngx|ndk|jit|setmetatable|getmetatable|string|table|io|os|print|tonumber|math|pcall|xpcall|unpack|pairs|ipairs|assert|module|package|coroutine|[gs]etfenv|next|rawget|rawset|rawlen)\\>'"); 93 | unless ($no_long_line_check) { 94 | p("Checking line length exceeding 80..."); 95 | blank("grep -H -n -E --color '.{81}' $file"); 96 | } 97 | } 98 | --------------------------------------------------------------------------------