[pbs-devel] [PATCH proxmox{, -backup} 0/6] add user specific rate-limits

[Hannes Laimer]

ping

On 9/9/25 10:53, Hannes Laimer wrote:
> This adds support for specifying user specific rate-limits.
> We add a user-tag to every rate-limited connection, with this present we
> can limit the connection based on the authenticated user assiciated with
> it.
> 
> Authentication happens after accept, so we can't set this right when we
> accept a connection. Currently we initialize the handle on accept, we
> then give this handle to the rate_limiter callback function. And on
> completed authentication we set the user using this handle.
> I did consider using a Peer -> User map in the cache, and just adding
> entries on auth, but there isn't really a good way to clean those
> entries. And peers(so IP:port) may end up being reused, and that would
> be a problem. With the current approach we don't have this problem.
> 
> Currently rules with a user specified take priority over others. So:
> user > IP only > neither, in case two rules match.
> 
> If users and networks are specified, the rule only applies if both
> match. So, Any of the specified user connect from any of the specified
> network.
> 
> And all of this ofc still only if the given timeframe matches.
> 
> Note: this is only for users, you can't specify individual tokens. But I
> don't think that is much of a problem, it is probably even better like
> this.
> 
> (I did look through BZ if there is an issue for this, I feel like there
> should be, but did not find one)
> 
> proxmox:
> 
> Hannes Laimer (3):
>    pbs-api-types: add users to traffic-control rule
>    http: add user tag to rate-limited streams
>    rest-server: add use tag field to RateLimitedStreams
> 
>   pbs-api-types/src/traffic_control.rs    |  9 ++++
>   proxmox-http/src/rate_limited_stream.rs | 30 ++++++++++-
>   proxmox-rest-server/src/connection.rs   | 16 +++++-
>   proxmox-rest-server/src/rest.rs         | 72 ++++++++++++++++++++++++-
>   4 files changed, 123 insertions(+), 4 deletions(-)
> 
> 
> proxmox-backup:
> 
> Hannes Laimer (3):
>    api: taffic-control: update/delete users on rule correctly
>    traffic-control: handle users specified in a rule correctly
>    ui: traffic-control: add users field in edit form and list
> 
>   src/api2/config/traffic_control.rs |   8 +++
>   src/bin/proxmox-backup-proxy.rs    |   7 +-
>   src/traffic_control_cache.rs       | 100 +++++++++++++++++++++++++----
>   www/config/TrafficControlView.js   |   7 ++
>   www/window/TrafficControlEdit.js   |  18 ++++++
>   5 files changed, 126 insertions(+), 14 deletions(-)
> 
> 
> Summary over all repositories:
>    9 files changed, 249 insertions(+), 18 deletions(-)
>