Fix #8067 Use nanotime for DosFilter rate tracker

Use nano time to avoid false positives when wall clock changes.
jetty · May 31, 2022 · 437b45c · 437b45c
1 parent ee404b6
commit 437b45c
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/DoSFilter.java b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/DoSFilter.java
@@ -326,7 +326,7 @@ protected void doFilter(HttpServletRequest request, HttpServletResponse response
         tracker = getRateTracker(request);
 
         // Calculate the rate and check if it is over the allowed limit
-        final OverLimit overLimit = tracker.isRateExceeded(System.currentTimeMillis());
+        final OverLimit overLimit = tracker.isRateExceeded(System.nanoTime());
 
         // Pass it through if we are not currently over the rate limit.
         if (overLimit == null)
@@ -1235,7 +1235,7 @@ public OverLimit isRateExceeded(long now)
             }
 
             long rate = (now - last);
-            if (rate < 1000L)
+            if (TimeUnit.NANOSECONDS.toSeconds(rate) < 1L)
             {
                 return new Overage(Duration.ofMillis(rate), _maxRequestsPerSecond);
             }
@@ -1326,7 +1326,7 @@ public void run()
 
             int latestIndex = _next == 0 ? (_timestamps.length - 1) : (_next - 1);
             long last = _timestamps[latestIndex];
-            boolean hasRecentRequest = last != 0 && (System.currentTimeMillis() - last) < 1000L;
+            boolean hasRecentRequest = last != 0 && TimeUnit.NANOSECONDS.toSeconds(System.nanoTime() - last) < 1L;
 
             DoSFilter filter = (DoSFilter)_context.getAttribute(_filterName);
 

diff --git a/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/DoSFilterTest.java b/jetty-servlets/src/test/java/org/eclipse/jetty/servlets/DoSFilterTest.java
@@ -21,7 +21,6 @@
 import java.net.InetSocketAddress;
 import java.util.Collections;
 import java.util.Enumeration;
-import java.util.concurrent.TimeUnit;
 import javax.servlet.FilterConfig;
 import javax.servlet.ServletContext;
 import javax.servlet.ServletException;
@@ -179,7 +178,7 @@ private boolean hitRateTracker(DoSFilter doSFilter, int sleep) throws Interrupte
         for (int i = 0; i < 5; i++)
         {
             Thread.sleep(sleep);
-            if (rateTracker.isRateExceeded(TimeUnit.NANOSECONDS.toMillis(System.nanoTime())) != null)
+            if (rateTracker.isRateExceeded(System.nanoTime()) != null)
                 exceeded = true;
         }
         return exceeded;