Separate statically- and dynamically-configured rate limiters

service/src/main/java/org/whispersystems/textsecuregcm/limits/DynamicRateLimiters.java

@@ -0,0 +1,189 @@
+/*
+ * Copyright 2013-2021 Signal Messenger, LLC
+ * SPDX-License-Identifier: AGPL-3.0-only
+ */
+
+package org.whispersystems.textsecuregcm.limits;
+
+import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration.CardinalityRateLimitConfiguration;
+import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration.RateLimitConfiguration;
+import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
+import org.whispersystems.textsecuregcm.redis.FaultTolerantRedisCluster;
+import org.whispersystems.textsecuregcm.storage.DynamicConfigurationManager;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.BiFunction;
+
+public class DynamicRateLimiters {
+
+  private final FaultTolerantRedisCluster cacheCluster;
+  private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager;
+
+  private final AtomicReference<CardinalityRateLimiter> unsealedSenderCardinalityLimiter;
+  private final AtomicReference<RateLimiter> unsealedIpLimiter;
+  private final AtomicReference<RateLimiter> rateLimitResetLimiter;
+  private final AtomicReference<RateLimiter> recaptchaChallengeAttemptLimiter;
+  private final AtomicReference<RateLimiter> recaptchaChallengeSuccessLimiter;
+  private final AtomicReference<RateLimiter> pushChallengeAttemptLimiter;
+  private final AtomicReference<RateLimiter> pushChallengeSuccessLimiter;
+  private final AtomicReference<RateLimiter> dailyPreKeysLimiter;
+
+  public DynamicRateLimiters(final FaultTolerantRedisCluster rateLimitCluster,
+      final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager) {
+
+    this.cacheCluster = rateLimitCluster;
+    this.dynamicConfigurationManager = dynamicConfigurationManager;
+
+    this.dailyPreKeysLimiter = new AtomicReference<>(
+        createDailyPreKeysLimiter(this.cacheCluster,
+            this.dynamicConfigurationManager.getConfiguration().getLimits().getDailyPreKeys()));
+
+    this.unsealedSenderCardinalityLimiter = new AtomicReference<>(createUnsealedSenderCardinalityLimiter(
+        this.cacheCluster,
+        this.dynamicConfigurationManager.getConfiguration().getLimits().getUnsealedSenderNumber()));
+
+    this.unsealedIpLimiter = new AtomicReference<>(
+        createUnsealedIpLimiter(this.cacheCluster,
+            this.dynamicConfigurationManager.getConfiguration().getLimits().getUnsealedSenderIp()));
+
+    this.rateLimitResetLimiter = new AtomicReference<>(
+        createRateLimitResetLimiter(this.cacheCluster,
+            this.dynamicConfigurationManager.getConfiguration().getLimits().getRateLimitReset()));
+
+    this.recaptchaChallengeAttemptLimiter = new AtomicReference<>(createRecaptchaChallengeAttemptLimiter(
+        this.cacheCluster,
+        this.dynamicConfigurationManager.getConfiguration().getLimits().getRecaptchaChallengeAttempt()));
+
+    this.recaptchaChallengeSuccessLimiter = new AtomicReference<>(createRecaptchaChallengeSuccessLimiter(
+        this.cacheCluster,
+        this.dynamicConfigurationManager.getConfiguration().getLimits().getRecaptchaChallengeSuccess()));
+
+    this.pushChallengeAttemptLimiter = new AtomicReference<>(createPushChallengeAttemptLimiter(this.cacheCluster,
+        this.dynamicConfigurationManager.getConfiguration().getLimits().getPushChallengeAttempt()));
+
+    this.pushChallengeSuccessLimiter = new AtomicReference<>(createPushChallengeSuccessLimiter(this.cacheCluster,
+        this.dynamicConfigurationManager.getConfiguration().getLimits().getPushChallengeSuccess()));
+  }
+
+  public CardinalityRateLimiter getUnsealedSenderCardinalityLimiter() {
+    CardinalityRateLimitConfiguration currentConfiguration = dynamicConfigurationManager.getConfiguration().getLimits()
+        .getUnsealedSenderNumber();
+
+    return this.unsealedSenderCardinalityLimiter.updateAndGet(rateLimiter -> {
+      if (rateLimiter.hasConfiguration(currentConfiguration)) {
+        return rateLimiter;
+      } else {
+        return createUnsealedSenderCardinalityLimiter(cacheCluster, currentConfiguration);
+      }
+    });
+  }
+
+  public RateLimiter getUnsealedIpLimiter() {
+    return updateAndGetRateLimiter(
+        unsealedIpLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getUnsealedSenderIp(),
+        this::createUnsealedIpLimiter);
+  }
+
+  public RateLimiter getRateLimitResetLimiter() {
+    return updateAndGetRateLimiter(
+        rateLimitResetLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getRateLimitReset(),
+        this::createRateLimitResetLimiter);
+  }
+
+  public RateLimiter getRecaptchaChallengeAttemptLimiter() {
+    return updateAndGetRateLimiter(
+        recaptchaChallengeAttemptLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getRecaptchaChallengeAttempt(),
+        this::createRecaptchaChallengeAttemptLimiter);
+  }
+
+  public RateLimiter getRecaptchaChallengeSuccessLimiter() {
+    return updateAndGetRateLimiter(
+        recaptchaChallengeSuccessLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getRecaptchaChallengeSuccess(),
+        this::createRecaptchaChallengeSuccessLimiter);
+  }
+
+  public RateLimiter getPushChallengeAttemptLimiter() {
+    return updateAndGetRateLimiter(
+        pushChallengeAttemptLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getPushChallengeAttempt(),
+        this::createPushChallengeAttemptLimiter);
+  }
+
+  public RateLimiter getPushChallengeSuccessLimiter() {
+    return updateAndGetRateLimiter(
+        pushChallengeSuccessLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getPushChallengeSuccess(),
+        this::createPushChallengeSuccessLimiter);
+  }
+
+  public RateLimiter getDailyPreKeysLimiter() {
+    return updateAndGetRateLimiter(
+        dailyPreKeysLimiter,
+        dynamicConfigurationManager.getConfiguration().getLimits().getDailyPreKeys(),
+        this::createDailyPreKeysLimiter);
+  }
+
+  private RateLimiter updateAndGetRateLimiter(final AtomicReference<RateLimiter> rateLimiter,
+      RateLimitConfiguration currentConfiguration,
+      BiFunction<FaultTolerantRedisCluster, RateLimitConfiguration, RateLimiter> rateLimitFactory) {
+
+    return rateLimiter.updateAndGet(limiter -> {
+      if (limiter.hasConfiguration(currentConfiguration)) {
+        return limiter;
+      } else {
+        return rateLimitFactory.apply(cacheCluster, currentConfiguration);
+      }
+    });
+  }
+
+  private CardinalityRateLimiter createUnsealedSenderCardinalityLimiter(FaultTolerantRedisCluster cacheCluster,
+      CardinalityRateLimitConfiguration configuration) {
+    return new CardinalityRateLimiter(cacheCluster, "unsealedSender", configuration.getTtl(),
+        configuration.getMaxCardinality());
+  }
+
+  private RateLimiter createUnsealedIpLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "unsealedIp");
+  }
+
+  public RateLimiter createRateLimitResetLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "rateLimitReset");
+  }
+
+  public RateLimiter createRecaptchaChallengeAttemptLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "recaptchaChallengeAttempt");
+  }
+
+  public RateLimiter createRecaptchaChallengeSuccessLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "recaptchaChallengeSuccess");
+  }
+
+  public RateLimiter createPushChallengeAttemptLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "pushChallengeAttempt");
+  }
+
+  public RateLimiter createPushChallengeSuccessLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "pushChallengeSuccess");
+  }
+
+  public RateLimiter createDailyPreKeysLimiter(FaultTolerantRedisCluster cacheCluster,
+      RateLimitConfiguration configuration) {
+    return createLimiter(cacheCluster, configuration, "dailyPreKeys");
+  }
+
+  private RateLimiter createLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration,
+      String name) {
+    return new RateLimiter(cacheCluster, name,
+        configuration.getBucketSize(),
+        configuration.getLeakRatePerMinute());
+  }
+}

service/src/main/java/org/whispersystems/textsecuregcm/limits/PreKeyRateLimiter.java

@@ -28,11 +28,11 @@ public class PreKeyRateLimiter {
   private static final String RATE_LIMITED_ACCOUNTS_UNENFORCED_HLL_KEY = "PreKeyRateLimiter::rateLimitedAccounts::unenforced";
   private static final long RATE_LIMITED_ACCOUNTS_HLL_TTL_SECONDS = Duration.days(1).toSeconds();
 
-  private final RateLimiters rateLimiters;
+  private final DynamicRateLimiters rateLimiters;
   private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager;
   private final RateLimitResetMetricsManager metricsManager;
 
-  public PreKeyRateLimiter(final RateLimiters rateLimiters,
+  public PreKeyRateLimiter(final DynamicRateLimiters rateLimiters,
       final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager,
       final RateLimitResetMetricsManager metricsManager) {
     this.rateLimiters = rateLimiters;

service/src/main/java/org/whispersystems/textsecuregcm/limits/RateLimitChallengeManager.java

@@ -26,7 +26,7 @@ public class RateLimitChallengeManager {
   private final PreKeyRateLimiter preKeyRateLimiter;
   private final UnsealedSenderRateLimiter unsealedSenderRateLimiter;
 
-  private final RateLimiters rateLimiters;
+  private final DynamicRateLimiters rateLimiters;
   private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager;
 
   public static final String OPTION_RECAPTCHA = "recaptcha";
@@ -43,7 +43,7 @@ public class RateLimitChallengeManager {
       final RecaptchaClient recaptchaClient,
       final PreKeyRateLimiter preKeyRateLimiter,
       final UnsealedSenderRateLimiter unsealedSenderRateLimiter,
-      final RateLimiters rateLimiters,
+      final DynamicRateLimiters rateLimiters,
       final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager) {
 
     this.pushChallengeManager = pushChallengeManager;

service/src/main/java/org/whispersystems/textsecuregcm/limits/RateLimiters.java

@@ -5,14 +5,8 @@
 package org.whispersystems.textsecuregcm.limits;
 
 
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.BiFunction;
 import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration;
-import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration.CardinalityRateLimitConfiguration;
-import org.whispersystems.textsecuregcm.configuration.RateLimitsConfiguration.RateLimitConfiguration;
-import org.whispersystems.textsecuregcm.configuration.dynamic.DynamicConfiguration;
 import org.whispersystems.textsecuregcm.redis.FaultTolerantRedisCluster;
-import org.whispersystems.textsecuregcm.storage.DynamicConfigurationManager;
 
 public class RateLimiters {
 
@@ -41,22 +35,7 @@ public class RateLimiters {
 
   private final RateLimiter checkAccountExistenceLimiter;
 
-  private final AtomicReference<CardinalityRateLimiter> unsealedSenderCardinalityLimiter;
-  private final AtomicReference<RateLimiter> unsealedIpLimiter;
-  private final AtomicReference<RateLimiter> rateLimitResetLimiter;
-  private final AtomicReference<RateLimiter> recaptchaChallengeAttemptLimiter;
-  private final AtomicReference<RateLimiter> recaptchaChallengeSuccessLimiter;
-  private final AtomicReference<RateLimiter> pushChallengeAttemptLimiter;
-  private final AtomicReference<RateLimiter> pushChallengeSuccessLimiter;
-  private final AtomicReference<RateLimiter> dailyPreKeysLimiter;
-
-  private final FaultTolerantRedisCluster   cacheCluster;
-  private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfig;
-
-  public RateLimiters(RateLimitsConfiguration config, DynamicConfigurationManager<DynamicConfiguration> dynamicConfig, FaultTolerantRedisCluster cacheCluster) {
-    this.cacheCluster  = cacheCluster;
-    this.dynamicConfig = dynamicConfig;
-
+  public RateLimiters(RateLimitsConfiguration config, FaultTolerantRedisCluster cacheCluster) {
     this.smsDestinationLimiter = new RateLimiter(cacheCluster, "smsDestination",
                                                  config.getSmsDestination().getBucketSize(),
                                                  config.getSmsDestination().getLeakRatePerMinute());
@@ -132,93 +111,6 @@ public class RateLimiters {
     this.checkAccountExistenceLimiter = new RateLimiter(cacheCluster, "checkAccountExistence",
         config.getCheckAccountExistence().getBucketSize(),
         config.getCheckAccountExistence().getLeakRatePerMinute());
-
-    this.dailyPreKeysLimiter = new AtomicReference<>(createDailyPreKeysLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getDailyPreKeys()));
-
-    this.unsealedSenderCardinalityLimiter = new AtomicReference<>(createUnsealedSenderCardinalityLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getUnsealedSenderNumber()));
-    this.unsealedIpLimiter     = new AtomicReference<>(createUnsealedIpLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getUnsealedSenderIp()));
-
-    this.rateLimitResetLimiter = new AtomicReference<>(
-        createRateLimitResetLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getRateLimitReset()));
-
-    this.recaptchaChallengeAttemptLimiter = new AtomicReference<>(createRecaptchaChallengeAttemptLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getRecaptchaChallengeAttempt()));
-    this.recaptchaChallengeSuccessLimiter = new AtomicReference<>(createRecaptchaChallengeSuccessLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getRecaptchaChallengeSuccess()));
-    this.pushChallengeAttemptLimiter = new AtomicReference<>(createPushChallengeAttemptLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getPushChallengeAttempt()));
-    this.pushChallengeSuccessLimiter = new AtomicReference<>(createPushChallengeSuccessLimiter(cacheCluster, dynamicConfig.getConfiguration().getLimits().getPushChallengeSuccess()));
-  }
-
-  public CardinalityRateLimiter getUnsealedSenderCardinalityLimiter() {
-    CardinalityRateLimitConfiguration currentConfiguration = dynamicConfig.getConfiguration().getLimits().getUnsealedSenderNumber();
-
-    return this.unsealedSenderCardinalityLimiter.updateAndGet(rateLimiter -> {
-      if (rateLimiter.hasConfiguration(currentConfiguration)) {
-        return rateLimiter;
-      } else {
-        return createUnsealedSenderCardinalityLimiter(cacheCluster, currentConfiguration);
-      }
-    });
-  }
-
-  public RateLimiter getUnsealedIpLimiter() {
-    return updateAndGetRateLimiter(
-        unsealedIpLimiter,
-        dynamicConfig.getConfiguration().getLimits().getUnsealedSenderIp(),
-        this::createUnsealedIpLimiter);
-  }
-
-  public RateLimiter getRateLimitResetLimiter() {
-    return updateAndGetRateLimiter(
-        rateLimitResetLimiter,
-        dynamicConfig.getConfiguration().getLimits().getRateLimitReset(),
-        this::createRateLimitResetLimiter);
-  }
-
-  public RateLimiter getRecaptchaChallengeAttemptLimiter() {
-    return updateAndGetRateLimiter(
-        recaptchaChallengeAttemptLimiter,
-        dynamicConfig.getConfiguration().getLimits().getRecaptchaChallengeAttempt(),
-        this::createRecaptchaChallengeAttemptLimiter);
-  }
-
-  public RateLimiter getRecaptchaChallengeSuccessLimiter() {
-    return updateAndGetRateLimiter(
-        recaptchaChallengeSuccessLimiter,
-        dynamicConfig.getConfiguration().getLimits().getRecaptchaChallengeSuccess(),
-        this::createRecaptchaChallengeSuccessLimiter);
-  }
-
-  public RateLimiter getPushChallengeAttemptLimiter() {
-    return updateAndGetRateLimiter(
-        pushChallengeAttemptLimiter,
-        dynamicConfig.getConfiguration().getLimits().getPushChallengeAttempt(),
-        this::createPushChallengeAttemptLimiter);
-  }
-
-  public RateLimiter getPushChallengeSuccessLimiter() {
-    return updateAndGetRateLimiter(
-        pushChallengeSuccessLimiter,
-        dynamicConfig.getConfiguration().getLimits().getPushChallengeSuccess(),
-        this::createPushChallengeSuccessLimiter);
-  }
-
-  public RateLimiter getDailyPreKeysLimiter() {
-    return updateAndGetRateLimiter(
-        dailyPreKeysLimiter,
-        dynamicConfig.getConfiguration().getLimits().getDailyPreKeys(),
-        this::createDailyPreKeysLimiter);
-  }
-
-  private RateLimiter updateAndGetRateLimiter(final AtomicReference<RateLimiter> rateLimiter,
-      RateLimitConfiguration currentConfiguration,
-      BiFunction<FaultTolerantRedisCluster, RateLimitConfiguration, RateLimiter> rateLimitFactory) {
-
-    return rateLimiter.updateAndGet(limiter -> {
-      if (limiter.hasConfiguration(currentConfiguration)) {
-        return limiter;
-      } else {
-        return rateLimitFactory.apply(cacheCluster, currentConfiguration);
-      }
-    });
   }
 
   public RateLimiter getAllocateDeviceLimiter() {
@@ -296,43 +188,4 @@ public class RateLimiters {
   public RateLimiter getCheckAccountExistenceLimiter() {
     return checkAccountExistenceLimiter;
   }
-
-  private CardinalityRateLimiter createUnsealedSenderCardinalityLimiter(FaultTolerantRedisCluster cacheCluster, CardinalityRateLimitConfiguration configuration) {
-    return new CardinalityRateLimiter(cacheCluster, "unsealedSender", configuration.getTtl(), configuration.getMaxCardinality());
-  }
-
-  private RateLimiter createUnsealedIpLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration)
-  {
-    return createLimiter(cacheCluster, configuration, "unsealedIp");
-  }
-
-  public RateLimiter createRateLimitResetLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "rateLimitReset");
-  }
-
-  public RateLimiter createRecaptchaChallengeAttemptLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "recaptchaChallengeAttempt");
-  }
-
-  public RateLimiter createRecaptchaChallengeSuccessLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "recaptchaChallengeSuccess");
-  }
-
-  public RateLimiter createPushChallengeAttemptLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "pushChallengeAttempt");
-  }
-
-  public RateLimiter createPushChallengeSuccessLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "pushChallengeSuccess");
-  }
-
-  public RateLimiter createDailyPreKeysLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration) {
-    return createLimiter(cacheCluster, configuration, "dailyPreKeys");
-  }
-
-  private RateLimiter createLimiter(FaultTolerantRedisCluster cacheCluster, RateLimitConfiguration configuration, String name) {
-    return new RateLimiter(cacheCluster, name,
-                           configuration.getBucketSize(),
-                           configuration.getLeakRatePerMinute());
-  }
 }

service/src/main/java/org/whispersystems/textsecuregcm/limits/UnsealedSenderRateLimiter.java

@@ -20,7 +20,7 @@ import org.whispersystems.textsecuregcm.util.Util;
 
 public class UnsealedSenderRateLimiter {
 
-  private final RateLimiters rateLimiters;
+  private final DynamicRateLimiters rateLimiters;
   private final FaultTolerantRedisCluster rateLimitCluster;
   private final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager;
   private final RateLimitResetMetricsManager metricsManager;
@@ -37,7 +37,7 @@ public class UnsealedSenderRateLimiter {
   private static final long RATE_LIMITED_ACCOUNTS_HLL_TTL_SECONDS = Duration.days(1).toSeconds();
 
 
-  public UnsealedSenderRateLimiter(final RateLimiters rateLimiters,
+  public UnsealedSenderRateLimiter(final DynamicRateLimiters rateLimiters,
       final FaultTolerantRedisCluster rateLimitCluster,
       final DynamicConfigurationManager<DynamicConfiguration> dynamicConfigurationManager,
       final RateLimitResetMetricsManager metricsManager) {