Conversation
…move code using certificatesPerName & newOrdersRL tables
|
@jprenken, this PR appears to contain configuration and/or SQL schema changes. Please ensure that a corresponding deployment ticket has been filed with the new values. |
|
IN-10906 |
aarongable
left a comment
aarongable
left a comment
There was a problem hiding this comment.
Just a few small nits, and one high-level question: can the PR description grow a paragraph describing how the deleted RA test cases are covered by WFE kv-limit test cases?
Addressed and added, thanks! I've added an explanation of test coverage to this PR's description. |
| // errors from this function to the Subscriber, spends against these limit are | ||
| // best effort. | ||
| func (ra *RegistrationAuthorityImpl) countCertificateIssued(ctx context.Context, regId int64, orderDomains []string, isRenewal bool) { | ||
| if ra.limiter == nil || ra.txnBuilder == nil { |
There was a problem hiding this comment.
This deletion should be accompanied by adding a check in NewRegistrationAuthorityImpl that neither of these fields is nil.
There was a problem hiding this comment.
(which can happen as a followup)
There was a problem hiding this comment.
(also as a followup) If we aren't already we should "require" the relevant configuration fields.
4 participants
Remove code using
certificatesPerName&newOrdersRLtables.Deprecate
DisableLegacyLimitWrites&UseKvLimitsForNewOrderflags.Remove legacy
ratelimitpackage.Delete these RA test cases:
TestAuthzFailedRateLimitingNewOrder(rl:FailedAuthorizationsPerDomainPerAccount)TestCheckCertificatesPerNameLimit(rl:CertificatesPerDomain)TestCheckExactCertificateLimit(rl:CertificatesPerFQDNSet)TestExactPublicSuffixCertLimit(rl:CertificatesPerDomain)Rate limits in NewOrder are now enforced by the WFE, starting here:
boulder/wfe2/wfe.go
Line 781 in 5a9b4c4
We collect a batch of transactions to check limits, check them all at once, go through and find which one(s) failed, and serve the failure with the Retry-After that's furthest in the future. All this code doesn't really need to be tested again; what needs to be tested is that we're returning the correct failure. That code is
NewOrderLimitTransactions, and theratelimitspackage's tests cover this.The public suffix handling behavior is tested by
TestFQDNsToETLDsPlusOne:boulder/ratelimits/utilities_test.go
Line 9 in 5a9b4c4
Some other RA rate limit tests were deleted earlier, in #7869.
Part of #7671.