Page MenuHomePhabricator

Introduce allowlists into the CDN (text) filtering
Closed, ResolvedPublic

Description

We want to be able to be flexible with what rules apply to what traffic. Specifically:

  • We want traffic in our web of trust to skip all filtering rules
  • We want known, identified bots to get their own rate-limiting on uncached requests, and skip any other filtering rules
  • We want users that are identified and making an api call to skip all rules (once things are implemented on the API side of things)
  • We want all of our traffic that is uncached to go through so-called "moat mode rules"

We need to be able to do so in both haproxy and varnish.

grading

  • Letter grades imply a total ordering that doesn't really exist, but it's more than close enough to be useful
    • There's some desire for more freeform tags, but also, some very real concerns about that introducing too much complexity or making combinations too hard to reason about.
  • Grades are also useful as a compact summary that's easy to pass down to the applayer to be reasoned about there.
  • Grade A:
    • Equivalent to the old wikimedia_trust of internal or otherwise-privileged IP spaces
    • Change in policy: moat mode rules will now apply to uncached requests.
  • Grade B:
    • Known, authenticated Bots.
  • Grade C:
    • Community: requests from real human browsers (verified session cookie etc)
    • This is the primary exception to the strict ordering: In the face of overwhelming traffic or limited resources, C should take priority over any other grade (definitely over B, and probably over A as well).
  • Grade D:
    • Reserved for future use.
  • Grade E:
    • Reserved for future use, but, the default grade.
  • Grade F:
    • Known abusers: requests are blocked or heavily throttled

Event Timeline

I should add - following up on what we already did with x-provenance, as much identification of traffic as we can should be done at the HAProxy layer; or at least up to the amount we need in order to discern traffic at that layer.

The introduction of the X-Trusted-Request header (T399058) allows us to implement the filtering logic by mapping trust levels (AF) to specific behaviors:

  • Trust level A:
    • Represents traffic in our web of trust: skips all filtering rules, including requestctl, bandwidth limits, and silent-drops.
    • (planned) Also includes authenticated API calls when session tokens are present and verified at the edge.
  • Trust level B (planned):
    • Intended for known, identified bots: allows applying custom rate-limiting for uncached requests while skipping other generic filtering rules.
  • Trust level C:
    • Reserved for future use.
  • Trust levels D–E (planned):
    • Represent unauthenticated or less trusted clients: general requestctl filtering and moat-mode protections apply, especially for uncached traffic.
  • Trust level F (planned):
    • Represents known abusers: requests are blocked by default.

This score-based model provides a flexible and extensible framework for differentiating between traffic classes at the CDN edge across both HAProxy and Varnish.

We discussed this -- both the overall structure and some of the finer points -- on IRC this week, and again at the WE4.3.1 kickoff.

Approx diffs as compared to before:

  • Moat mode rules will apply to all uncached requests, regardless of the grade.
  • Changed some of the distinctions

Have moved the new normative text to the issue description, so it is group-editable.

I thought about this a bit, and I think we need to distinguish between the grading system (which should express trust levels) and request feature (like bearing a valid session cookie, being identified as a bot...).

So we should probably think of the grades more in terms of a general level of trust we grant to a request, rather than a specific category of requests. I think this model is useful to set the default rate-limits for various levels of trust, and allowing us as operators to change said default rate-limits; but we might need to decide some rules apply to a subset of things that get rated "C".

Joe claimed this task.