Prevent streaming API denial-of-service (resolves #1019)

What does this MR do?

Patches multiple potential DoS vectors in the streaming API:

• Use a bucket limiter instead of sliding-scale.
• Limit the number of active connections per client.
• Automatically close the connection when a rate limit is hit.
• Automatically evict note cache when a connection closes.
• Automatically cancel note subscriptions when a connection closes.
• Limit the number of note subscriptions to 256 per connection. Excess subscriptions will be automatically canceled in LIFO order.
• Limit UPGRADE requests by user ID instead of request IP, when applicable.
• Fix Channel leak when two channels share the same ID.
• Optimize storage, index, and lookup for cached notes and channels.

Contribution Guidelines

By submitting this merge request, you agree to follow our Contribution Guidelines

• I agree to follow this project's Contribution Guidelines
• I have made sure to test this merge request

added bugbackend performance security labels

requested review from @Marie, @dakkar, @julia, and @CenTdemeern1

changed the description

added 1 commit

• b31bcda2 - limit the number of active connections per client, and limit upgrade requests by user

Compare with previous version

changed the description

added 50 commits

• b31bcda2...920bf71e - 40 commits from branch develop
• 18655386 - convert streaming rate limit to bucket
• bf1c9b67 - close websocket when rate limit exceeded
• 83132949 - limit the number of note subscriptions per connection
• b8fd9d0b - clear subscriptions when connection closes
• 045ff5d2 - make sure that note subscriptions can't stay above limit
• 14a7309c - avoid leaking cached notes in WS connection
• eff73218 - avoid duplicate channels in WS connection
• c41d617e - limit the number of active connections per client, and limit upgrade requests by user
• 86e34175 - SkRateLimiterService revision 3: cache lockouts in memory to avoid redis calls
• fafb8113 - increase limits on WS note subscriptions and cached notes

Compare with previous version

marked this merge request as draft

added 2 commits

• 47ea8527 - fix wsmessage rate limit definition
• 922a7ba1 - track the number of concurrent requests to redis, and bypass if the request is guaranteed to reject

Compare with previous version

resolved all threads

marked this merge request as ready

marked this merge request as draft

Marked as draft until I have time to test on enby.life

marked this merge request as ready

marked the checklist item I have made sure to test this merge request as completed

resolved all threads

approved this merge request

approved this merge request