Enforce per-IP rate limits

signalapp · Oct 7, 2024 · d550c69 · d550c69
1 parent 087e192
commit d550c69
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 15 deletions.
diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java b/service/src/main/java/org/whispersystems/textsecuregcm/WhisperServerService.java
@@ -1003,7 +1003,7 @@ protected void configureServer(final ServerBuilder<?> serverBuilder) {
 
     environment.jersey().register(new BufferingInterceptor());
     environment.jersey().register(new VirtualExecutorServiceProvider("managed-async-virtual-thread-"));
-    environment.jersey().register(new RateLimitByIpFilter(rateLimiters, true));
+    environment.jersey().register(new RateLimitByIpFilter(rateLimiters));
     environment.jersey().register(new RequestStatisticsFilter(TrafficSource.HTTP));
     environment.jersey().register(MultiRecipientMessageProvider.class);
     environment.jersey().register(new AuthDynamicFeature(accountAuthFilter));
@@ -1022,7 +1022,7 @@ protected void configureServer(final ServerBuilder<?> serverBuilder) {
             clientReleaseManager, messageDeliveryLoopMonitor));
     webSocketEnvironment.jersey()
         .register(new WebsocketRefreshApplicationEventListener(accountsManager, clientPresenceManager));
-    webSocketEnvironment.jersey().register(new RateLimitByIpFilter(rateLimiters, true));
+    webSocketEnvironment.jersey().register(new RateLimitByIpFilter(rateLimiters));
     webSocketEnvironment.jersey().register(new RequestStatisticsFilter(TrafficSource.WEBSOCKET));
     webSocketEnvironment.jersey().register(MultiRecipientMessageProvider.class);
     webSocketEnvironment.jersey().register(new MetricsApplicationEventListener(TrafficSource.WEBSOCKET, clientReleaseManager));

diff --git a/service/src/main/java/org/whispersystems/textsecuregcm/limits/RateLimitByIpFilter.java b/service/src/main/java/org/whispersystems/textsecuregcm/limits/RateLimitByIpFilter.java
@@ -41,15 +41,9 @@ public class RateLimitByIpFilter implements ContainerRequestFilter {
   private static final String NO_IP_COUNTER_NAME = MetricsUtil.name(RateLimitByIpFilter.class, "noIpAddress");
 
   private final RateLimiters rateLimiters;
-  private final boolean softEnforcement;
-
-  public RateLimitByIpFilter(final RateLimiters rateLimiters, final boolean softEnforcement) {
-    this.rateLimiters = requireNonNull(rateLimiters);
-    this.softEnforcement = softEnforcement;
-  }
 
   public RateLimitByIpFilter(final RateLimiters rateLimiters) {
-    this(rateLimiters, false);
+    this.rateLimiters = requireNonNull(rateLimiters);
   }
 
   @Override
@@ -87,9 +81,7 @@ public void filter(final ContainerRequestContext requestContext) throws IOExcept
         // checking if annotation is configured to fail when the most recent IP is not resolved
         if (annotation.failOnUnresolvedIp()) {
           logger.error("Remote address was null");
-          if (!softEnforcement) {
-            throw INVALID_HEADER_EXCEPTION;
-          }
+          throw INVALID_HEADER_EXCEPTION;
         }
         // otherwise, allow request
         return;
@@ -99,9 +91,7 @@ public void filter(final ContainerRequestContext requestContext) throws IOExcept
       rateLimiter.validate(remoteAddress.get());
     } catch (RateLimitExceededException e) {
       final Response response = EXCEPTION_MAPPER.toResponse(e);
-      if (!softEnforcement) {
-        throw new ClientErrorException(response);
-      }
+      throw new ClientErrorException(response);
     }
   }
 }