I want to protect my nginx server under a safe concurrency request, so I had set the nginx server(nginx 1.6.2) limitted on 30000 qps by config like this:

limit_req_zone $server_port zone=perport:10m rate=30000r/s;
limit_req_status 597;
limit_req zone=perport burst=0 nodelay;

But the nginx server have just 6000 qps, I had got many limitted error.

I had tried to read the source code for the reason, and the I found this (https://github.com/nginx/nginx/blob/release-1.6.2/src/http/modules/ngx_http_limit_req_module.c#L379-L420):

379: tp = ngx_timeofday();
380: now = (ngx_msec_t) (tp->sec * 1000 + tp->msec);
...
409: ms = (ngx_msec_int_t) (now - lr->last);
410:
411: excess = lr->excess - ctx->rate * ngx_abs(ms) / 1000 + 1000;
...
419: if ((ngx_uint_t) excess > limit->burst) {
420: return NGX_BUSY;
...

I think there has a bug:

1. When the ngx_abs(ms) got 0, the rate value can not affect excess whatever it set to be.
2. When two request had same hash key and arrive at same time (same millisecond).
3. The excess will be 1000
4. The request would be NGX_BUSY when no burst set.

Cause I used the server_port as the hash key, or whatever other key which would take concurrency request，whatever I set the rate to 30000r/s,3000000r/s or 3000000000r/s, it make no sence.

I read the latest nginx(1.11.6) code , looks like no changes. (https://github.com/nginx/nginx/blob/release-1.11.6/src/http/modules/ngx_http_limit_req_module.c#L371-L411)



Edited 1 time(s). Last edit at 11/17/2016 11:19PM by guyzyl.