Skip to content

Commit

Permalink
feat(cache) use a different shm for cache misses
Browse files Browse the repository at this point in the history
Following this mlcache patch:

  thibaultcha/lua-resty-mlcache#42

We can now specify a different shm for mlcache to cache L3 misses. This
is especially helpful in the context of Kong since client-triggered DB
lookups can have a very high cardinality of keys to fetch (e.g.
credentials such as API keys) and can make the cache turnover so high
that it can be rendered almost useless (filled with misses, thus
evicting actual hits from the cache shm). This is considered as a
potential attack vector.

The size of this shm (12MB) allows for roughly ~45,000 nil sentinel
values to be stored in the shm (depending on the size of the keys). This
value is aligned with that chosen for the rate-limiting shared dict in
PR #3311 (12MB and about ~48,000 simultaneous counters).
  • Loading branch information
thibaultcha committed Apr 24, 2018
1 parent 6f9096a commit 206433a
Show file tree
Hide file tree
Showing 5 changed files with 10 additions and 6 deletions.
5 changes: 3 additions & 2 deletions kong/cache.lua
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ local NOTICE = ngx.NOTICE
local DEBUG = ngx.DEBUG


local SHM_CACHE = "kong_cache"
local SHM_CACHE = "kong_db_cache"
--[[
Hypothesis
----------
Expand Down Expand Up @@ -69,7 +69,8 @@ function _M.new(opts)
return error("opts.resty_lock_opts must be a table")
end

local mlcache, err = resty_mlcache.new("kong_db_cache", SHM_CACHE, {
local mlcache, err = resty_mlcache.new(SHM_CACHE, SHM_CACHE, {
shm_miss = "kong_db_cache_miss",
lru_size = LRU_SIZE,
ttl = max(opts.ttl or 3600, 0),
neg_ttl = max(opts.neg_ttl or 300, 0),
Expand Down
3 changes: 2 additions & 1 deletion kong/constants.lua
Original file line number Diff line number Diff line change
Expand Up @@ -78,7 +78,8 @@ return {
},
DICTS = {
"kong",
"kong_cache",
"kong_db_cache",
"kong_db_cache_miss",
"kong_process_events",
"kong_cluster_events",
"kong_healthchecks",
Expand Down
3 changes: 2 additions & 1 deletion kong/templates/nginx_kong.lua
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,8 @@ lua_socket_pool_size ${{LUA_SOCKET_POOL_SIZE}};
lua_max_running_timers 4096;
lua_max_pending_timers 16384;
lua_shared_dict kong 5m;
lua_shared_dict kong_cache ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache_miss 12m;
lua_shared_dict kong_process_events 5m;
lua_shared_dict kong_cluster_events 5m;
lua_shared_dict kong_healthchecks 5m;
Expand Down
2 changes: 1 addition & 1 deletion spec/01-unit/003-prefix_handler_spec.lua
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ describe("NGINX conf compiler", function()
admin_listen = "127.0.0.1:8001"
}))
local kong_nginx_conf = prefix_handler.compile_kong_conf(conf)
assert.matches("lua_shared_dict kong_cache%s+128k;", kong_nginx_conf)
assert.matches("lua_shared_dict kong_db_cache%s+128k;", kong_nginx_conf)
assert.matches("listen 0.0.0.0:80;", kong_nginx_conf, nil, true)
assert.matches("listen 127.0.0.1:8001;", kong_nginx_conf, nil, true)
end)
Expand Down
3 changes: 2 additions & 1 deletion spec/fixtures/custom_nginx.template
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,8 @@ http {
lua_max_running_timers 4096;
lua_max_pending_timers 16384;
lua_shared_dict kong 5m;
lua_shared_dict kong_cache ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache ${{MEM_CACHE_SIZE}};
lua_shared_dict kong_db_cache_miss 12m;
lua_shared_dict kong_process_events 5m;
lua_shared_dict kong_cluster_events 5m;
lua_shared_dict kong_healthchecks 5m;
Expand Down

0 comments on commit 206433a

Please sign in to comment.