Struct H2FloodConfig

Source

pub struct H2FloodConfig { /* private fields */ }

Expand description

Configurable thresholds for H2 flood detection.

All values have safe defaults matching the compile-time constants. When configured via listener config, None values fall back to these defaults.

Implementations§

Source §

impl H2FloodConfig

Source

pub fn new( max_rst_stream_per_window: u32, max_ping_per_window: u32, max_settings_per_window: u32, max_empty_data_per_window: u32, max_window_update_stream0_per_window: u32, max_continuation_frames: u32, max_glitch_count: u32, max_rst_stream_lifetime: u64, max_rst_stream_abusive_lifetime: u64, max_rst_stream_emitted_lifetime: u64, max_header_list_size: u32, max_header_table_size: u32, max_header_fields: u32, stream_refusal_percent: u32, ) -> Self

Create a validated config, clamping all thresholds to at least 1. Zero thresholds would cause immediate flood detection on any frame.

With Self::from_optional, this is the only way to build an H2FloodConfig: the fields above are private, so the clamp below cannot be routed around by a raw struct literal the way lib/src/http.rs and lib/src/https.rs used to route around it (sozu-proxy/sozu#1418).

Source

pub fn from_optional( max_rst_stream_per_window: Option<u32>, max_ping_per_window: Option<u32>, max_settings_per_window: Option<u32>, max_empty_data_per_window: Option<u32>, max_window_update_stream0_per_window: Option<u32>, max_continuation_frames: Option<u32>, max_glitch_count: Option<u32>, max_rst_stream_lifetime: Option<u64>, max_rst_stream_abusive_lifetime: Option<u64>, max_rst_stream_emitted_lifetime: Option<u64>, max_header_list_size: Option<u32>, max_header_table_size: Option<u32>, max_header_fields: Option<u32>, stream_refusal_percent: Option<u32>, ) -> Self

Build a validated config from a listener’s per-knob overrides: each None takes the compile-time default, then Self::new clamps. Mirrors super::h2::H2ConnectionConfig::from_optional, which the adjacent get_h2_connection_config already uses for the connection knobs read out of the very same listener config.

This is what lib/src/http.rs and lib/src/https.rs call. They used to spell the same unwrap_or(default) table into a raw struct literal, which skipped new and therefore skipped the clamp on the one production path that carries operator-set thresholds (sozu-proxy/sozu#1418). A zero that survives to here does not disable a check, it makes the first event its counter sees a violation, and how far that reaches depends on the knob: max_header_list_size and max_header_fields are also the HPACK decode budget pkawa::decode_headers_with_budget enforces, so 0 refuses every request on the listener with ENHANCE_YOUR_CALM — per stream for a header block that fits one HEADERS frame, and as a connection GOAWAY for one that spans CONTINUATION frames, where H2FloodDetector::record_continuation_frame lifts accumulated_header_size above the zero threshold and h2.rs’s check_flood_or_return! fires before the explicit size test. max_rst_stream_per_window = 0 (and every other per-window or lifetime frame counter) is inert until a client actually sends the frame it counts — check_flood compares count > threshold, and 0 > 0 is false.

Every door that STATES a listener configuration now rejects an out-of-range knob outright — the configuration file and sozu ctl add listener via ConfigError::H2ThresholdBelowMinimum (command/src/config.rs), UpdateHttp(s)Listener and a raw protobuf Add{Http,Https}Listener via command/src/state.rs’s four validate_h2_flood_knobs_* — so the operator is told which key to fix rather than having their stated value silently rewritten. The clamp reached through here is the backstop for the one path that deliberately does NOT reject: replay of a state file saved before those gates existed, where dropping the listener would be a worse outcome than clamping one threshold (bin/src/command/requests.rs’s RequestOrigin::Replayed).

Source