Struct ConfigBuilder 

pub struct ConfigBuilder { /* private fields */ }

Builder for Config. See each setter for defaults.

Implementations

impl ConfigBuilder

pub fn mtu(self, mtu: usize) -> Self

Set the max transmission unit (MTU).

The largest size UDP packets we will produce. Defaults to 1150.

pub fn max_queue_rx(self, max_queue_rx: usize) -> Self

Set the max amount of incoming packets to buffer before rejecting more input.

Defaults to 30.

pub fn max_queue_tx(self, max_queue_tx: usize) -> Self

Set the max amount of outgoing packets to buffer.

Defaults to 10.

pub fn require_client_certificate(self, require: bool) -> Self

Set whether to require a client certificate (for servers).

This will cause the server to send a CertificateRequest message. Makes the server fail if the client does not send a certificate. Defaults to true.

Applies only to certificate-authenticated cipher suites. For RFC 4279 PSK suites the client never sends a certificate, so this flag has no effect on a negotiated PSK handshake; no opt-out is required when combining this builder with with_psk_server.

pub fn use_server_cookie(self, use_cookie: bool) -> Self

Set whether the server sends a cookie exchange before the handshake.

When true (the default), the server requires a stateless cookie roundtrip for DoS protection: HelloVerifyRequest in DTLS 1.2, HelloRetryRequest with a cookie in DTLS 1.3.

When false, the server proceeds directly to ServerHello without a cookie exchange.

pub fn flight_start_rto(self, rto: Duration) -> Self

Set the time of first retry.

Every flight restarts with this value. Doubled for every retry with a ±25% jitter. Defaults to 1 second.

pub fn flight_retries(self, retries: usize) -> Self

Set the max number of retries per flight.

Defaults to 4.

pub fn handshake_timeout(self, timeout: Duration) -> Self

Set the timeout for the entire handshake, regardless of flights.

Defaults to 40 seconds.

pub fn with_crypto_provider(self, provider: CryptoProvider) -> Self

Set a custom crypto provider.

If not set, the default aws-lc-rs provider will be used, if the feature flag aws-lc-rs is enabled.

pub fn dangerously_set_rng_seed(self, seed: u64) -> Self

Set a seed for deterministic random number generation.

When set, most non-cryptographic randomness (backoff jitter, TLS random bytes, AEAD nonces, cookie secrets) will be deterministic based on this seed.

This is useful for testing and reproducibility.

Note: Cryptographic operations (key exchange, signatures) always use secure system randomness regardless of this setting.

pub fn aead_encryption_limit(self, limit: u64) -> Self

Set the maximum number of AEAD encryptions before triggering a KeyUpdate.

Defaults to 2^23 (8,388,608).

pub fn dtls12_cipher_suites(self, suites: &[Dtls12CipherSuite]) -> Self

Restrict which DTLS 1.2 cipher suites are offered and accepted.

Only cipher suites present in both this list and the provider will be used. Passing an empty slice disables DTLS 1.2 (as long as DTLS 1.3 suites remain).

By default all provider-supported DTLS 1.2 cipher suites are used.

pub fn dtls13_cipher_suites(self, suites: &[Dtls13CipherSuite]) -> Self

Restrict which DTLS 1.3 cipher suites are offered and accepted.

Only cipher suites present in both this list and the provider will be used. Passing an empty slice disables DTLS 1.3 (as long as DTLS 1.2 suites remain).

By default all provider DTLS 1.3 cipher suites are used.

pub fn kx_groups(self, groups: &[NamedGroup]) -> Self

Restrict which key exchange groups are offered and accepted.

Only groups present in both this list and the provider will be used. Order determines preference (first = most preferred).

By default all provider-supported key exchange groups are used.

pub fn with_psk_client( self, identity: Vec<u8>, resolver: Arc<dyn PskResolver>, ) -> Self

Configure PSK for a client endpoint.

The identity is sent to the server during the handshake. The resolver looks up the shared secret by identity.

pub fn with_psk_server( self, hint: Option<Vec<u8>>, resolver: Arc<dyn PskResolver>, ) -> Self

Configure PSK for a server endpoint.

The optional hint is sent to the client in ServerKeyExchange. The resolver looks up the shared secret by client identity.

pub fn build(self) -> Result<Config, Error>

Build the configuration.

This validates the crypto provider before returning the configuration. Returns Error::ConfigError if the provider is invalid.

The crypto provider is selected in the following priority order:

1. Explicit provider set via with_crypto_provider()
2. Default provider installed via CryptoProvider::install_default()
3. AWS-LC provider (if aws-lc-rs feature is enabled)
4. RustCrypto provider (if rust-crypto feature is enabled)
5. Panic if no provider is available

Trait Implementations

impl Debug for ConfigBuilder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.