Struct TimeSyncPolicy 

pub struct TimeSyncPolicy {
    pub enabled: bool,
    pub source_restriction: Option<TimeSyncSourceRestriction>,
    pub max_step: Option<Duration>,
    pub per_source_rate: Option<TimeSyncRateLimit>,
    pub global_rate: Option<TimeSyncRateLimit>,
    pub coalesce_window: Duration,
    pub global_coalesce_window: Duration,
    pub max_sources: usize,
}

Default-allow inbound TimeSynchronization / UTCTimeSynchronization policy.

Every restriction is opt-in and independent. No default step cap is imposed: a controller booting with an incorrect clock may need a large initial sync. Operators should configure trusted claimed sources (not authentication), and choose a cap only when their boot/recovery process can tolerate rejection. This is local policy, not a change to the unconfirmed wire behavior (16.7/16.8). Denials send no response and do not change the clock or invoke its observer. Decoding/validation precedes source and rate policy, then step-check and clock update are serialized. The observer runs afterwards outside the limiter lock; a concurrent accepted request may already have advanced the clock again.

Fields

enabled: bool

Accept inbound time sync by default. False disables clock touch and callback.

source_restriction: Option<TimeSyncSourceRestriction>

Optional exact-source allowlist; Some(empty) denies all, None allows all.

max_step: Option<Duration>

Optional absolute step cap, inclusive at the boundary, for forward/backward corrections. Zero allows only an exact match. No readable clock means a configured cap fails closed; without a cap, boot synchronization still works.

per_source_rate: Option<TimeSyncRateLimit>

Optional per-source token bucket, shared across local and UTC requests.

global_rate: Option<TimeSyncRateLimit>

Optional server-wide token bucket, including all sources and both services.

coalesce_window: Duration

Minimum spacing between accepted requests from one source, regardless of value or local/UTC form. Zero disables coalescing. Drops do not extend it.

global_coalesce_window: Duration

Minimum spacing between accepted requests globally, across all sources and both services. Zero disables global coalescing. Drops do not extend it.

max_sources: usize

Bound on rate/coalescing source state (1..=65536, default 256). A full table rejects new sources until an entry is fully refilled and outside its coalescing window; active entries are never evicted to reset their budget.

Implementations

impl TimeSyncPolicy

pub fn validate(&self) -> Result<(), Error>

Validate before transport startup/dialing, even when acceptance is disabled.

Trait Implementations

impl Clone for TimeSyncPolicy

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for TimeSyncPolicy

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for TimeSyncPolicy

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for TimeSyncPolicy

fn eq(&self, other: &Self) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for TimeSyncPolicy