Check the two pre-authentication login rate-limit buckets. Both `login_ip:{addr}` and `login_user:{username}` are consulted. Each failed attempt ALWAYS consumes a token from the IP bucket (the username may be unknown or wrong, but the IP is always real). The user bucket is only consumed when a username is provided. Capacities come from the values set via [`set_login_capacities`]. Each bucket ref
(&self, peer_addr: &str, username: &str)
| 118 | /// |
| 119 | /// Returns [`LoginRateLimitOutcome::Allowed`] when both buckets have tokens. |
| 120 | pub fn check_login(&self, peer_addr: &str, username: &str) -> LoginRateLimitOutcome { |
| 121 | let ip_cap = self.login_ip_cap.load(std::sync::atomic::Ordering::Relaxed); |
| 122 | let user_cap = self |
| 123 | .login_user_cap |
| 124 | .load(std::sync::atomic::Ordering::Relaxed); |
| 125 | |
| 126 | // 0-cap means the bucket type is disabled. |
| 127 | if ip_cap > 0 { |
| 128 | let ip_key = format!("login_ip:{peer_addr}"); |
| 129 | let ip_rate = (ip_cap as f64) / 60.0; |
| 130 | if !self.check_login_bucket(&ip_key, ip_cap, ip_rate) { |
| 131 | return LoginRateLimitOutcome::IpExceeded; |
| 132 | } |
| 133 | } |
| 134 | |
| 135 | if user_cap > 0 && !username.is_empty() { |
| 136 | let user_key = format!("login_user:{username}"); |
| 137 | let user_rate = (user_cap as f64) / 60.0; |
| 138 | if !self.check_login_bucket(&user_key, user_cap, user_rate) { |
| 139 | return LoginRateLimitOutcome::UserExceeded; |
| 140 | } |
| 141 | } |
| 142 | |
| 143 | LoginRateLimitOutcome::Allowed |
| 144 | } |
| 145 | |
| 146 | /// Check a login-specific bucket with an explicit refill rate. |
| 147 | /// |