feat: Anura Rate Limiter

[kelindi]

Summary

This pull request makes the following changes:

• Adds new separate routes for Anura
• Creates a Rate Limitting middleware that only allows Anura to interface with these endpoints providing a valid signature

[bgins]

A few places where we have references to the exemption code that can be removed:

lilypad/pkg/http/types.go

Line 26 in 0fd6304

ExemptedIPs []string

lilypad/pkg/options/server.go

Lines 98 to 104 in 0fd6304

	if len(options.RateLimiter.ExemptedIPs) > 0 {
	for _, ip := range options.RateLimiter.ExemptedIPs {
	if net.ParseIP(ip) == nil {
	return fmt.Errorf("invalid IP address: %s", ip)
	}
	}
	}

lilypad/pkg/solver/server.go

Lines 73 to 91 in 0fd6304

	exemptIPs := solverServer.options.RateLimiter.ExemptedIPs
	// TODO: re-enable exempt IP rate limiting
	// subrouter.Use(httprate.Limit(
	// solverServer.options.RateLimiter.RequestLimit,
	// time.Duration(solverServer.options.RateLimiter.WindowLength)*time.Second,
	// httprate.WithKeyFuncs(
	// exemptIPKeyFunc(exemptIPs),
	// httprate.KeyByEndpoint,
	// ),
	// httprate.WithLimitHandler(func(w corehttp.ResponseWriter, r *corehttp.Request) {
	// key, _ := exemptIPKeyFunc(exemptIPs)(r)
	// if strings.HasPrefix(key, "exempt-") {
	// return
	// }
	// corehttp.Error(w, "Too Many Requests", corehttp.StatusTooManyRequests)
	// }),
	// ))

lilypad/pkg/solver/server.go

Line 99 in 0fd6304

log.Info().Strs("exemptIPs", exemptIPs).Msg("Loaded rate limit exemptions")

lilypad/pkg/solver/server.go

Lines 237 to 254 in 0fd6304

	func exemptIPKeyFunc(exemptIPs []string) func(r *corehttp.Request) (string, error) {
	return func(r *corehttp.Request) (string, error) {
	ip, err := httprate.KeyByRealIP(r)
	if err != nil {
	log.Error().Err(err).Msg("error getting real ip")
	return "", err
	}
	// Check if the IP is in the exempt list
	for _, exemptIP := range exemptIPs {
	if http.CanonicalizeIP(exemptIP) == ip {
	return "exempt-" + ip, nil
	}
	}
	return ip, nil
	}
	}

We can probably also get rid of this canonicalize helper we added for the exemption handler:

lilypad/pkg/http/utils.go

Lines 506 to 531 in 0fd6304

	func CanonicalizeIP(ip string) string {
	isIPv6 := false
	// This is how net.ParseIP decides if an address is IPv6
	// https://cs.opensource.google/go/go/+/refs/tags/go1.17.7:src/net/ip.go;l=704
	for i := 0; !isIPv6 && i < len(ip); i++ {
	switch ip[i] {
	case '.':
	// IPv4
	return ip
	case ':':
	// IPv6
	isIPv6 = true
	break
	}
	}
	if !isIPv6 {
	// Not an IP address at all
	return ip
	}
	ipv6 := net.ParseIP(ip)
	if ipv6 == nil {
	return ip
	}
	return ipv6.Mask(net.CIDRMask(64, 128)).String()
	}

[bgins]

Looks good! 🎉