From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 39AFA1FF179 for ; Wed, 12 Nov 2025 11:34:59 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 7B3871E65B; Wed, 12 Nov 2025 11:35:46 +0100 (CET) From: Hannes Laimer To: pbs-devel@lists.proxmox.com Date: Wed, 12 Nov 2025 11:34:59 +0100 Message-ID: <20251112103505.122844-1-h.laimer@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1762943688583 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.046 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [proxmox-backup-proxy.rs, lib.rs, connection.rs, rest.rs] Subject: [pbs-devel] [PATCH proxmox{, -backup} v4 0/6] add user specific rate-limits X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Backup Server development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pbs-devel-bounces@lists.proxmox.com Sender: "pbs-devel" When a connection is accepted we create a shared tag handle for its rate-limited stream. The REST layer clears that handle before every request. Once a request authenticates successfully, we push a User(...) tag with the auth ID. Failed or unauthenticated requests leave the tag list empty. RateLimitedStream watches that handle and forces an immediate limiter refresh whenever the tag set changes so user-specific throttles take effect right away. Currently rules with a user specified take priority over others. So: user > IP only > neither, in case two rules match. If users and networks are specified, the rule only applies if both match. So, Any of the specified user connect from any of the specified network. And all of this ofc still only if the given timeframe matches. I did also test this with a basic nginx reverse proxy configured with `keepalive 32`, I didn't run into problems using this setup. Reviewed-by: Christian Ebner Tested-by: Christian Ebner v4, thanks @Chris: - format - added and reordered trailers - improve commit message - no code changes from v3 v3, thanks @Chris!: - simplify code by passing the taglist to the callback, as sugested by Chris - mention potential future use-case in commit message - created documented type for 3-tuple and inlined var for printing v2, thanks @Chris!: - fix problem with tag staying on connection after request finishes, and with when it would be set in first place - use a more generic tag-list on the connection, this is more general - tag is now an enum, like chris suggested, this should make it somewhat easy to extend if we at some point should want to proxmox: Hannes Laimer (3): pbs-api-types: allow traffic-control rules to match users http: track user tag updates on rate-limited streams rest-server: propagate rate-limit tags from authenticated users pbs-api-types/src/traffic_control.rs | 9 ++ proxmox-http/src/lib.rs | 2 +- proxmox-http/src/rate_limited_stream.rs | 46 +++++++- proxmox-rest-server/src/connection.rs | 11 +- proxmox-rest-server/src/rest.rs | 137 +++++++++++++++++++++++- 5 files changed, 192 insertions(+), 13 deletions(-) proxmox-backup: Hannes Laimer (3): api: taffic-control: update/delete users on rule correctly traffic-control: add user-specific rule matching and precedence ui: traffic-control: add users field in edit form and list src/api2/config/traffic_control.rs | 8 +++ src/bin/proxmox-backup-proxy.rs | 12 +++- src/traffic_control_cache.rs | 105 +++++++++++++++++++++++++---- www/config/TrafficControlView.js | 7 ++ www/window/TrafficControlEdit.js | 18 +++++ 5 files changed, 136 insertions(+), 14 deletions(-) Summary over all repositories: 10 files changed, 328 insertions(+), 27 deletions(-) -- Generated by git-murpp 0.8.1 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel