Re: [pbs-devel] [PATCH proxmox{, -backup} v2 0/6] add user specific rate-limits

[Christian Ebner <c.ebner@proxmox.com>]

On 11/7/25 2:23 PM, Hannes Laimer wrote:
> When a connection is accepted we create a shared tag handle for its
> rate-limited stream. The REST layer clears that handle before every
> request. Once a request authenticates successfully, we push a
> User(...) tag with the auth ID. Failed or unauthenticated requests
> leave the tag list empty. RateLimitedStream watches that handle and
> forces an immediate limiter refresh whenever the tag set changes so
> user-specific throttles take effect right away.
> 
> Currently rules with a user specified take priority over others. So:
> user > IP only > neither, in case two rules match.
> 
> If users and networks are specified, the rule only applies if both
> match. So, Any of the specified user connect from any of the specified
> network.
> 
> And all of this ofc still only if the given timeframe matches.
> 
> v2, thanks @Chris!:
>   - fix problem with tag staying on connection after request finishes,
>     and with when it would be set in first place
>   - use a more generic tag-list on the connection, this is more general
>   - tag is now an enum, like chris suggested, this should make it
>     somewhat easy to extend if we at some point should want to

In general this series looks good already, but one thing which IMO 
should be checked is how this behaves with reverse proxies which might 
use connection pools to reuse TCP connections. Did you already do some 
testing with respect to that?


_______________________________________________
pbs-devel mailing list
pbs-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pbs-devel