Documentation
¶
Overview ¶
Package throttle slows an endpoint that answers anyone and costs something to answer: a recovery proof, which spends memory on a digest or a call to the cluster's API server.
It counts refusals per SOURCE and, beside that, across all sources. The per-source count is what protects the endpoint from one noisy caller; the global ceiling is what protects the process from many, and it is set well above what one source may do. A single global counter alone -- the first version of this -- is a lock somebody else holds: ten wrong proofs from anywhere shut the door on the one operator who has the right one, which for a break-glass path is the attack.
Index ¶
Constants ¶
const ( DefaultPerSource = 5 DefaultGlobal = 100 DefaultWindow = time.Minute // DefaultSources is how many sources are told apart. Beyond it, new // sources share one count, so a caller who can vary its address cannot // grow the process. DefaultSources = 4096 )
Defaults for a recovery endpoint: five refusals a source may spend in a window, and a ceiling across every source at twenty times that.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Limiter ¶
type Limiter struct {
// contains filtered or unexported fields
}
Limiter is a fixed-window count of refusals. The zero value is not ready: use New.
func New ¶
New returns a Limiter allowing perSource refusals from one source, and global across all, per window, telling apart at most sources sources. A non-positive value takes the default. now is the clock; nil is time.Now.
func (*Limiter) Accepted ¶
Accepted clears source's refusals: the right proof from a source that fumbled one is not a source to go on slowing. The global count is not cleared; it measures work, not people.
func (*Limiter) Blocked ¶
Blocked reports whether source may not try: it has spent its refusals for the window, or every source together have.
func (*Limiter) RefusedBySource ¶ added in v1.77.1
RefusedBySource records a refusal against source alone, and not against the ceiling across every source: for an attempt that cost nothing to refuse, which must not be a way to use up everybody's share.
Source Files