[pbs-devel] superseded: [PATCH proxmox{, -backup} v4 0/6] add user specific rate-limits

[Hannes Laimer]

superseded-by: 
https://lore.proxmox.com/pbs-devel/20251121135043.97142-1-h.laimer@proxmox.com/T/#t

On 11/12/25 11:35, Hannes Laimer wrote:
> When a connection is accepted we create a shared tag handle for its
> rate-limited stream. The REST layer clears that handle before every
> request. Once a request authenticates successfully, we push a
> User(...) tag with the auth ID. Failed or unauthenticated requests
> leave the tag list empty. RateLimitedStream watches that handle and
> forces an immediate limiter refresh whenever the tag set changes so
> user-specific throttles take effect right away.
> 
> Currently rules with a user specified take priority over others. So:
> user > IP only > neither, in case two rules match.
> 
> If users and networks are specified, the rule only applies if both
> match. So, Any of the specified user connect from any of the specified
> network.
> 
> And all of this ofc still only if the given timeframe matches.
> 
> I did also test this with a basic nginx reverse proxy configured with
> `keepalive 32`, I didn't run into problems using this setup.
> 
> Reviewed-by: Christian Ebner <c.ebner at proxmox.com>
> Tested-by: Christian Ebner <c.ebner at proxmox.com>
> 
> 
> v4, thanks @Chris:
>   - format
>   - added and reordered trailers
>   - improve commit message
>   - no code changes from v3
> 
> v3, thanks @Chris!:
>   - simplify code by passing the taglist to the callback, as sugested by
>     Chris
>   - mention potential future use-case in commit message
>   - created documented type for 3-tuple and inlined var for printing
> 
> v2, thanks @Chris!:
>   - fix problem with tag staying on connection after request finishes,
>     and with when it would be set in first place
>   - use a more generic tag-list on the connection, this is more general
>   - tag is now an enum, like chris suggested, this should make it
>     somewhat easy to extend if we at some point should want to
> 
> 
> proxmox:
> 
> Hannes Laimer (3):
>    pbs-api-types: allow traffic-control rules to match users
>    http: track user tag updates on rate-limited streams
>    rest-server: propagate rate-limit tags from authenticated users
> 
>   pbs-api-types/src/traffic_control.rs    |   9 ++
>   proxmox-http/src/lib.rs                 |   2 +-
>   proxmox-http/src/rate_limited_stream.rs |  46 +++++++-
>   proxmox-rest-server/src/connection.rs   |  11 +-
>   proxmox-rest-server/src/rest.rs         | 137 +++++++++++++++++++++++-
>   5 files changed, 192 insertions(+), 13 deletions(-)
> 
> 
> proxmox-backup:
> 
> Hannes Laimer (3):
>    api: taffic-control: update/delete users on rule correctly
>    traffic-control: add user-specific rule matching and precedence
>    ui: traffic-control: add users field in edit form and list
> 
>   src/api2/config/traffic_control.rs |   8 +++
>   src/bin/proxmox-backup-proxy.rs    |  12 +++-
>   src/traffic_control_cache.rs       | 105 +++++++++++++++++++++++++----
>   www/config/TrafficControlView.js   |   7 ++
>   www/window/TrafficControlEdit.js   |  18 +++++
>   5 files changed, 136 insertions(+), 14 deletions(-)
> 
> 
> Summary over all repositories:
>    10 files changed, 328 insertions(+), 27 deletions(-)
>