Struct HttpsListener 

pub struct HttpsListener { /* private fields */ }

Implementations

impl HttpsListener

pub fn is_http11_disabled(&self) -> bool

Whether this listener rejects clients that do not negotiate h2 via TLS ALPN (including those that omit ALPN). Reads the disable_http11 knob; defaults to false to preserve the historical behavior where a missing ALPN silently downgrades to HTTP/1.1.

pub fn resolver(&self) -> &Arc<MutexCertificateResolver>

Borrow the listener’s certificate resolver. Used by the TLS handshake path to snapshot the SAN set of the certificate Sōzu serves for a given SNI, so the H2 router can accept connection coalescing (RFC 7540 §9.1.1 / RFC 9113 §9.1.1) on every authority covered by that cert (RFC 6125 §6.4.3 wildcard handling).

pub fn try_new( config: HttpsListenerConfig, token: Token, ) -> Result<HttpsListener, ListenerError>

pub fn validate_config( config: &HttpsListenerConfig, ) -> Result<(), ListenerError>

Validate that a worker can build this HTTPS listener configuration — the rustls context and the answer templates — WITHOUT constructing the full listener or binding a socket. Runs the exact fallible steps of Self::try_new (via the shared Self::create_rustls_context / Self::build_answers helpers), so master-side validation is faithful to what the worker will do.

The main process calls this before committing an AddHttpsListener to its ConfigState and fanning it out, so an invalid listener never reserves its address and blocks a corrected reload (sozu#1301).

pub fn activate( &mut self, registry: &Registry, tcp_listener: Option<MioTcpListener>, ) -> Result<Token, ListenerError>

pub fn create_rustls_context( config: &HttpsListenerConfig, resolver: Arc<MutexCertificateResolver>, ) -> Result<RustlsServerConfig, ListenerError>

pub fn update_config( &mut self, patch: &UpdateHttpsListenerConfig, ) -> Result<(), ListenerError>

Apply a partial-update patch to this listener’s live configuration.

Fields absent in the patch (i.e. None) are preserved unchanged. If alpn_protocols is present the rustls ServerConfig is rebuilt — in-flight handshakes keep the old Arc; new ones see the new one. If http_answers is present only the listener-default templates are replaced; per-cluster overrides in cluster_custom_answers are kept.

pub fn add_https_front( &mut self, tls_front: HttpFrontend, ) -> Result<(), ListenerError>

pub fn add_https_front_with_hsts_origin( &mut self, tls_front: HttpFrontend, hsts_origin: HstsOrigin, ) -> Result<(), ListenerError>

Variant of Self::add_https_front that records the origin of tls_front.hsts so listener-default patches can reflow inheriting frontends without disturbing explicit per-frontend overrides. The caller passes [HstsOrigin::InheritedFromListenerDefault] when the value was filled in from self.config.hsts rather than from the operator’s per-frontend configuration.

pub fn remove_https_front( &mut self, tls_front: HttpFrontend, ) -> Result<(), ListenerError>

Trait Implementations

impl L7ListenerHandler for HttpsListener

fn get_sticky_name(&self) -> &str

fn get_sozu_id_header(&self) -> &str

Name of the correlation header Sozu injects into every request and response body. Default: "Sozu-Id". Operators can rebrand via the sozu_id_header listener config knob.

fn get_connect_timeout(&self) -> u32

fn frontend_from_request( &self, host: &str, uri: &str, method: &Method, ) -> Result<RouteResult, FrontendFromRequestError>

retrieve a frontend by parsing a request’s hostname, uri and method

fn get_answers(&self) -> &Rc<RefCell<HttpAnswers>>

retrieve the listener’s configured HTTP answers (templates)

fn get_h2_flood_config(&self) -> H2FloodConfig

H2 flood detection thresholds from the listener config. Returns the default config when the listener does not provide custom values.

fn get_h2_connection_config(&self) -> H2ConnectionConfig

H2 connection tuning from the listener config. Returns the default config when the listener does not provide custom values.

fn get_strict_sni_binding(&self) -> bool

Whether requests must have their :authority / Host exact-match the TLS SNI negotiated at handshake (CWE-346 / CWE-444).

fn get_elide_x_real_ip(&self) -> bool

Whether to strip any client-supplied X-Real-IP header from forwarded requests (anti-spoofing).

fn get_send_x_real_ip(&self) -> bool

Whether to append a proxy-generated X-Real-IP header carrying the connection peer IP (post-PROXY-v2 unwrap, i.e. the original client IP) to every forwarded request.

fn get_h2_stream_idle_timeout(&self) -> Duration

Per-stream idle timeout for H2 connections. An open stream that makes no forward progress for this duration is cancelled (RST_STREAM / CANCEL). Mitigates slow-multiplex Slowloris where a client keeps connection-level activity high (resetting the connection idle timer on every frame) while pinning streams for the full nominal connection timeout.

fn get_h2_graceful_shutdown_deadline(&self) -> Option<Duration>

Wall-clock budget granted to in-flight H2 streams after soft-stop sent the initial GOAWAY(NO_ERROR). Once the deadline elapses the mux transitions to a forced close (final GOAWAY + session teardown).

impl ListenerHandler for HttpsListener

fn get_addr(&self) -> &StdSocketAddr

fn get_tags(&self, key: &str) -> Option<&CachedTags>

fn set_tags(&mut self, key: String, tags: Option<BTreeMap<String, String>>)

fn protocol(&self) -> Protocol

fn public_address(&self) -> StdSocketAddr

fn get_concatenated_tags(&self, key: &str) -> Option<&str>