[pbs-devel] [PATCH proxmox{, -backup} v4 0/6] add user specific rate-limits

[Hannes Laimer <h.laimer@proxmox.com>]

When a connection is accepted we create a shared tag handle for its
rate-limited stream. The REST layer clears that handle before every
request. Once a request authenticates successfully, we push a
User(...) tag with the auth ID. Failed or unauthenticated requests
leave the tag list empty. RateLimitedStream watches that handle and
forces an immediate limiter refresh whenever the tag set changes so
user-specific throttles take effect right away.

Currently rules with a user specified take priority over others. So:
user > IP only > neither, in case two rules match.

If users and networks are specified, the rule only applies if both
match. So, Any of the specified user connect from any of the specified
network.

And all of this ofc still only if the given timeframe matches.

I did also test this with a basic nginx reverse proxy configured with
`keepalive 32`, I didn't run into problems using this setup.

Reviewed-by: Christian Ebner <c.ebner@proxmox.com>
Tested-by: Christian Ebner <c.ebner@proxmox.com>


v4, thanks @Chris:
 - format
 - added and reordered trailers
 - improve commit message
 - no code changes from v3

v3, thanks @Chris!:
 - simplify code by passing the taglist to the callback, as sugested by
   Chris
 - mention potential future use-case in commit message
 - created documented type for 3-tuple and inlined var for printing

v2, thanks @Chris!:
 - fix problem with tag staying on connection after request finishes,
   and with when it would be set in first place
 - use a more generic tag-list on the connection, this is more general
 - tag is now an enum, like chris suggested, this should make it
   somewhat easy to extend if we at some point should want to


proxmox:

Hannes Laimer (3):
  pbs-api-types: allow traffic-control rules to match users
  http: track user tag updates on rate-limited streams
  rest-server: propagate rate-limit tags from authenticated users

 pbs-api-types/src/traffic_control.rs    |   9 ++
 proxmox-http/src/lib.rs                 |   2 +-
 proxmox-http/src/rate_limited_stream.rs |  46 +++++++-
 proxmox-rest-server/src/connection.rs   |  11 +-
 proxmox-rest-server/src/rest.rs         | 137 +++++++++++++++++++++++-
 5 files changed, 192 insertions(+), 13 deletions(-)


proxmox-backup:

Hannes Laimer (3):
  api: taffic-control: update/delete users on rule correctly
  traffic-control: add user-specific rule matching and precedence
  ui: traffic-control: add users field in edit form and list

 src/api2/config/traffic_control.rs |   8 +++
 src/bin/proxmox-backup-proxy.rs    |  12 +++-
 src/traffic_control_cache.rs       | 105 +++++++++++++++++++++++++----
 www/config/TrafficControlView.js   |   7 ++
 www/window/TrafficControlEdit.js   |  18 +++++
 5 files changed, 136 insertions(+), 14 deletions(-)


Summary over all repositories:
  10 files changed, 328 insertions(+), 27 deletions(-)

-- 
Generated by git-murpp 0.8.1


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel