pub struct HostOptions { /* private fields */ }Expand description
Host-side transport options, passed to host_with_options. HostOptions::default()
is what host uses.
Implementations§
Source§impl HostOptions
impl HostOptions
pub fn new() -> Self
Sourcepub fn max_pipe_instances(self, n: u32) -> Self
pub fn max_pipe_instances(self, n: u32) -> Self
Cap on simultaneous instances of the Windows named pipe: live connections plus the
one instance waiting for the next client. A client that arrives when the cap is
reached gets “pipe busy” and retries, so a flood of connections cannot grow the
host without bound. Default DEFAULT_MAX_PIPE_INSTANCES (16); clamped to
1..=254 (255 is “unlimited” to Win32 and is never used). Ignored on Unix, where
there is no pipe.
Sourcepub fn get_max_pipe_instances(&self) -> u32
pub fn get_max_pipe_instances(&self) -> u32
The effective (clamped) cap.
Sourcepub fn write_timeout(self, bound: Option<Duration>) -> Self
pub fn write_timeout(self, bound: Option<Duration>) -> Self
Longest one frame (hello, event, or response) may take to write and flush to a client.
A client that stops reading fills the transport buffer and would otherwise block the
writing thread, and the connection with it, forever; when the bound passes the host closes
that connection (the client sees connection_closed, never a partial frame it could
mistake for a reply), and the connection’s connection_closed handler hook runs. The
bound is per frame, so a slow but progressing reader of a stream of events is not cut off
unless a single frame stalls. Default DEFAULT_WRITE_TIMEOUT (120 s); None restores
the earlier unbounded write. A zero duration is raised to 1 ms.
Sourcepub fn get_write_timeout(&self) -> Option<Duration>
pub fn get_write_timeout(&self) -> Option<Duration>
The effective write bound (None = unbounded).
Sourcepub fn max_message(self, bytes: usize) -> Self
pub fn max_message(self, bytes: usize) -> Self
Largest message the host assembles from chunks, or hands out in chunks (see the chunk
module). The frame limit (ServiceConfig::frame_limit) stays the cap on any one frame;
this is the second, separate cap on a whole chunked request or result, held in memory per
connection. Default 0: chunking is off, the host refuses rk.upload and never
announces a chunked result (it was 256 MiB earlier in the unpublished 0.2.7; see issue #323).
A service that takes large calls opts in with a size (see
SUGGESTED_MAX_MESSAGE). A connection holds at most one
assembly of at most this many bytes; the first piece is authorised before it is buffered,
and the assembled text is bounded in nesting and value count before it is parsed.
Sourcepub fn get_max_message(&self) -> usize
pub fn get_max_message(&self) -> usize
The effective message bound.
Sourcepub fn max_connections(self, n: usize) -> Self
pub fn max_connections(self, n: usize) -> Self
Cap on simultaneous connections on Unix (the counterpart of the Windows pipe-instance
cap, which this does not replace there): a connection that arrives over the cap is closed
at once, before any frame is read, so a flood cannot grow the host’s threads and buffers
without bound. Default DEFAULT_MAX_CONNECTIONS (64); at least 1. Unlike Windows “pipe
busy”, the refused client sees the connection close rather than a retryable busy status.
Ignored on Windows.
Sourcepub fn get_max_connections(&self) -> usize
pub fn get_max_connections(&self) -> usize
The effective connection cap.
Sourcepub fn reserved_slots(self, n: usize) -> Self
pub fn reserved_slots(self, n: usize) -> Self
Connections the host admits beyond max_connections for the
supervising owner only (see supervisor_pid). A host whose table
is full of stalled or busy clients would otherwise close the supervisor’s own health probe
and be judged dead while it is alive; these slots keep the probe able to connect. A
connection from any other peer, or from the supervisor once every reserved slot is in use,
is refused as before. Default DEFAULT_RESERVED_SLOTS (2); 0 reserves nothing. The
peer’s pid only decides who may use the spare capacity: hello, the allowlist and the
private secret still gate every connection. Ignored on Windows, where the pipe-instance cap
bounds the table.
Sourcepub fn get_reserved_slots(&self) -> usize
pub fn get_reserved_slots(&self) -> usize
The effective number of reserved slots.
Sourcepub fn supervisor_pid(self, pid: Option<u32>) -> Self
pub fn supervisor_pid(self, pid: Option<u32>) -> Self
The process that may use the reserved slots: the kernel-reported pid of a connecting peer
must equal it. Some(pid) names it, None lets nobody use them. When this is never
called the supervisor is the host process’s parent, read when the host starts, which is
the supervisor of a child it spawned (see the supervisor module). Ignored on Windows.
Sourcepub fn get_supervisor_pid(&self) -> Option<u32>
pub fn get_supervisor_pid(&self) -> Option<u32>
The pid that may use the reserved slots, as the host would resolve it now. None when
nobody may (or, off Unix, when there is no parent to name).
Sourcepub fn handshake_timeout(self, bound: Option<Duration>) -> Self
pub fn handshake_timeout(self, bound: Option<Duration>) -> Self
Longest a new connection may take to complete hello. A connection that connects and then
sends nothing (or too little) holds a table slot and a thread; when the bound passes the
host closes it (the client sees the connection close) and records a
ServiceEvent::ConnectionRejected with an empty app and the reason
handshake deadline <n> ms passed. The bound ends when hello is accepted, so it never
limits an established connection, whose frames are bounded by
write_timeout and the client’s own deadline. Default
DEFAULT_HANDSHAKE_TIMEOUT (5 s); None restores the earlier unbounded wait. A zero
duration is raised to 1 ms. Applies on Unix and Windows.
Sourcepub fn get_handshake_timeout(&self) -> Option<Duration>
pub fn get_handshake_timeout(&self) -> Option<Duration>
The effective handshake bound (None = unbounded).