From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 1F1D11FF1A6 for ; Fri, 5 Dec 2025 14:26:11 +0100 (CET) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 35A7C1D40E; Fri, 5 Dec 2025 14:26:39 +0100 (CET) From: Samuel Rufinatscha To: pbs-devel@lists.proxmox.com Date: Fri, 5 Dec 2025 14:25:59 +0100 Message-ID: <20251205132559.197434-7-s.rufinatscha@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20251205132559.197434-1-s.rufinatscha@proxmox.com> References: <20251205132559.197434-1-s.rufinatscha@proxmox.com> MIME-Version: 1.0 X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1764941117117 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.273 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Subject: [pbs-devel] [PATCH proxmox 3/3] proxmox-access-control: add TTL window to token secret cache X-BeenThere: pbs-devel@lists.proxmox.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Proxmox Backup Server development discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Proxmox Backup Server development discussion Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: pbs-devel-bounces@lists.proxmox.com Sender: "pbs-devel" Verify_secret() currently calls refresh_cache_if_file_changed() on every request, which performs a metadata() call on token.shadow each time. Under load this adds unnecessary overhead, considering also the file should rarely change. This patch introduces a TTL boundary, controlled by TOKEN_SECRET_CACHE_TTL_SECS. File metadata is only re-loaded once the TTL has expired. Signed-off-by: Samuel Rufinatscha --- proxmox-access-control/src/token_shadow.rs | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/proxmox-access-control/src/token_shadow.rs b/proxmox-access-control/src/token_shadow.rs index d08fb06a..885e629d 100644 --- a/proxmox-access-control/src/token_shadow.rs +++ b/proxmox-access-control/src/token_shadow.rs @@ -9,6 +9,7 @@ use serde_json::{from_value, Value}; use proxmox_auth_api::types::Authid; use proxmox_product_config::{open_api_lockfile, replace_config, ApiLockGuard}; +use proxmox_time::epoch_i64; use crate::init::impl_feature::{token_shadow, token_shadow_lock}; @@ -18,6 +19,8 @@ use crate::init::impl_feature::{token_shadow, token_shadow_lock}; /// subsequent authentications for the same token+secret combination, avoiding /// recomputing the password hash on every request. static TOKEN_SECRET_CACHE: OnceLock> = OnceLock::new(); +/// Max age in seconds of the token secret cache before checking for file changes. +const TOKEN_SECRET_CACHE_TTL_SECS: i64 = 60; // Get exclusive lock fn lock_config() -> Result { @@ -44,6 +47,15 @@ fn write_file(data: HashMap) -> Result<(), Error> { fn refresh_cache_if_file_changed() -> Result<(), Error> { let mut cache = token_secret_cache().write().unwrap(); + let now = epoch_i64(); + + // Fast path: Within TTL boundary + if let Some(last) = cache.last_checked { + if now - last < TOKEN_SECRET_CACHE_TTL_SECS { + return Ok(()); + } + } + // Fetch the current token.shadow metadata let (new_mtime, new_len) = match fs::metadata(token_shadow().as_path()) { Ok(meta) => (meta.modified().ok(), Some(meta.len())), @@ -60,6 +72,7 @@ fn refresh_cache_if_file_changed() -> Result<(), Error> { cache.secrets.clear(); cache.file_mtime = new_mtime; cache.file_len = new_len; + cache.last_checked = Some(now); Ok(()) } @@ -150,6 +163,8 @@ struct ApiTokenSecretCache { file_mtime: Option, // shadow file length to detect changes file_len: Option, + // last time the file metadata was checked + last_checked: Option, } fn token_secret_cache() -> &'static RwLock { @@ -158,6 +173,7 @@ fn token_secret_cache() -> &'static RwLock { secrets: HashMap::new(), file_mtime: None, file_len: None, + last_checked: None, }) }) } -- 2.47.3 _______________________________________________ pbs-devel mailing list pbs-devel@lists.proxmox.com https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel