Re: [pbs-devel] [PATCH proxmox{, -backup} v2 0/6] add user specific rate-limits

From: Hannes Laimer <h.laimer@proxmox.com>
To: Christian Ebner <c.ebner@proxmox.com>,
	Proxmox Backup Server development discussion
	<pbs-devel@lists.proxmox.com>
Subject: Re: [pbs-devel] [PATCH proxmox{, -backup} v2 0/6] add user specific rate-limits
Date: Mon, 10 Nov 2025 10:13:59 +0100	[thread overview]
Message-ID: <d34469d5-1d5e-417a-a09d-8ac71cc0dcd9@proxmox.com> (raw)
In-Reply-To: <88f55a25-b507-49f4-84cd-6a39625b73fc@proxmox.com>

On 11/10/25 10:03, Christian Ebner wrote:
> On 11/7/25 2:23 PM, Hannes Laimer wrote:
>> When a connection is accepted we create a shared tag handle for its
>> rate-limited stream. The REST layer clears that handle before every
>> request. Once a request authenticates successfully, we push a
>> User(...) tag with the auth ID. Failed or unauthenticated requests
>> leave the tag list empty. RateLimitedStream watches that handle and
>> forces an immediate limiter refresh whenever the tag set changes so
>> user-specific throttles take effect right away.
>>
>> Currently rules with a user specified take priority over others. So:
>> user > IP only > neither, in case two rules match.
>>
>> If users and networks are specified, the rule only applies if both
>> match. So, Any of the specified user connect from any of the specified
>> network.
>>
>> And all of this ofc still only if the given timeframe matches.
>>
>> v2, thanks @Chris!:
>>   - fix problem with tag staying on connection after request finishes,
>>     and with when it would be set in first place
>>   - use a more generic tag-list on the connection, this is more general
>>   - tag is now an enum, like chris suggested, this should make it
>>     somewhat easy to extend if we at some point should want to
> 
> In general this series looks good already, but one thing which IMO 
> should be checked is how this behaves with reverse proxies which might 
> use connection pools to reuse TCP connections. Did you already do some 
> testing with respect to that?

I did not test with a reverse proxy, the tags on a connection are reset
with every new request. So a reverse proxy shouldn't really impact rate
limiting other than ofc IP based rules. I'll prepare a v3 with your
proposed improvements to the code, with that I'll also test with a
reverse proxy setup.

And thanks for point out the group based rate limit, I didn't have that
on my radar at all!

_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel