Struct AdmissionConfig

pub struct AdmissionConfig { /* private fields */ }

Available on crate features quic and std only.

Expand description

How a server admits incoming connection attempts while it is under load.

An attempt is in progress from the moment it is admitted until its handshake completes, fails, times out or is abandoned, whether it waits for the application or is already being accepted. While few attempts are in progress every attempt is accepted at once. Past the retry threshold, an attempt from an address that has not proven it receives what is sent there (no valid Retry or NEW_TOKEN token) is answered with a Retry (RFC 9000 §8.1.2): it is stateless and cheap, so a flood from spoofed addresses costs no handshake work, while a real client returns the token one round trip later and is admitted. At the limit every attempt is refused with CONNECTION_REFUSED, so clients fall back at once.

The retry threshold follows what the endpoint actually completes: the handshakes it finished in about the last second, smoothed (quick to rise, slow to fall), kept between Self::set_retry_threshold_min and Self::set_retry_threshold_max. Once crossed, Retry stays on until the attempts in progress fall below three quarters of the threshold, so the endpoint does not flap at the boundary.

Implementations§

§

impl AdmissionConfig

pub fn with_retry_threshold_min(self, value: usize) -> AdmissionConfig

The retry threshold when the endpoint completes few handshakes.

Defaults to 256: a burst that large is accepted without an extra round trip even on an idle endpoint. A minimum and maximum of zero answer every unvalidated attempt with a Retry; a minimum above the maximum fixes the threshold at the minimum.

pub fn set_retry_threshold_min(&mut self, value: usize) -> &mut AdmissionConfig

The retry threshold when the endpoint completes few handshakes.

Defaults to 256: a burst that large is accepted without an extra round trip even on an idle endpoint. A minimum and maximum of zero answer every unvalidated attempt with a Retry; a minimum above the maximum fixes the threshold at the minimum.

pub fn with_retry_threshold_max(self, value: usize) -> AdmissionConfig

The highest the retry threshold rises, however many handshakes the endpoint completes.

Defaults to 4096. It bounds the handshake work a spoofed flood can cause before Retry starts, right after a busy period raised the threshold.

pub fn set_retry_threshold_max(&mut self, value: usize) -> &mut AdmissionConfig

The highest the retry threshold rises, however many handshakes the endpoint completes.

Defaults to 4096. It bounds the handshake work a spoofed flood can cause before Retry starts, right after a busy period raised the threshold.

pub fn with_max_in_progress(self, value: usize) -> AdmissionConfig

The most attempts in progress at once; beyond it every attempt is refused.

Defaults to 16384. Only attempts from validated addresses can reach it, since Retry holds the others at the threshold; it bounds what clients that complete address validation can make the endpoint hold. It also caps the retry threshold.

pub fn set_max_in_progress(&mut self, value: usize) -> &mut AdmissionConfig

The most attempts in progress at once; beyond it every attempt is refused.

Defaults to 16384. Only attempts from validated addresses can reach it, since Retry holds the others at the threshold; it bounds what clients that complete address validation can make the endpoint hold. It also caps the retry threshold.