Struct HttpsListenerConfig 

pub struct HttpsListenerConfig {

    pub address: SocketAddress,
    pub public_address: Option<SocketAddress>,
    pub expect_proxy: bool,
    pub sticky_name: String,
    pub front_timeout: u32,
    pub back_timeout: u32,
    pub connect_timeout: u32,
    pub request_timeout: u32,
    pub active: bool,
    pub versions: Vec<i32>,
    pub cipher_list: Vec<String>,
    pub cipher_suites: Vec<String>,
    pub signature_algorithms: Vec<String>,
    pub groups_list: Vec<String>,
    pub certificate: Option<String>,
    pub certificate_chain: Vec<String>,
    pub key: Option<String>,
    pub send_tls13_tickets: u64,
    pub http_answers: Option<CustomHttpAnswers>,
    pub alpn_protocols: Vec<String>,
    pub h2_max_rst_stream_per_window: Option<u32>,
    pub h2_max_ping_per_window: Option<u32>,
    pub h2_max_settings_per_window: Option<u32>,
    pub h2_max_empty_data_per_window: Option<u32>,
    pub h2_max_continuation_frames: Option<u32>,
    pub h2_max_glitch_count: Option<u32>,
    pub h2_initial_connection_window: Option<u32>,
    pub h2_max_concurrent_streams: Option<u32>,
    pub h2_stream_shrink_ratio: Option<u32>,
    pub h2_max_rst_stream_lifetime: Option<u64>,
    pub h2_max_rst_stream_abusive_lifetime: Option<u64>,
    pub h2_max_rst_stream_emitted_lifetime: Option<u64>,
    pub h2_max_header_list_size: Option<u32>,
    pub strict_sni_binding: Option<bool>,
    pub disable_http11: Option<bool>,
    pub h2_stream_idle_timeout_seconds: Option<u32>,
    pub h2_max_header_table_size: Option<u32>,
    pub h2_graceful_shutdown_deadline_seconds: Option<u32>,
    pub h2_max_window_update_stream0_per_window: Option<u32>,
    pub sozu_id_header: Option<String>,
    pub answers: BTreeMap<String, String>,
    pub elide_x_real_ip: Option<bool>,
    pub send_x_real_ip: Option<bool>,
    pub hsts: Option<HstsConfig>,
    pub h2_max_header_fields: Option<u32>,
    pub interface: Option<String>,
    pub forwarded_headers: Option<i32>,
    pub h2_stream_refusal_percent: Option<u32>,
    pub client_auth: Option<i32>,
    pub client_ca_certificates: Vec<String>,
    pub client_ca_crls: Vec<String>,
}

details of an HTTPS listener

Fields

address: SocketAddress

public_address: Option<SocketAddress>

expect_proxy: bool

sticky_name: String

front_timeout: u32

client inactive time, in seconds

back_timeout: u32

backend server inactive time, in seconds

connect_timeout: u32

time to connect to the backend, in seconds

request_timeout: u32

max time to send a complete request, in seconds

active: bool

wether the listener is actively listening on its socket

versions: Vec<i32>

TLS versions

cipher_list: Vec<String>

cipher_suites: Vec<String>

signature_algorithms: Vec<String>

groups_list: Vec<String>

certificate: Option<String>

certificate_chain: Vec<String>

key: Option<String>

send_tls13_tickets: u64

Number of TLS 1.3 tickets to send to a client when establishing a connection. The tickets allow the client to resume a session. This protects the client agains session tracking. Defaults to 4.

http_answers: Option<CustomHttpAnswers>

DEPRECATED: per-status answer message. Prefer the answers map at field 43. Kept on the wire so legacy state files round-trip cleanly; workers populate both fields and treat them as equivalent on read.

alpn_protocols: Vec<String>

ALPN protocols to advertise during TLS handshake, in order of preference. Valid values: “h2”, “http/1.1”. Defaults to [“h2”, “http/1.1”].

h2_max_rst_stream_per_window: Option<u32>

H2 flood detection thresholds (CVE mitigations). All are optional; when absent, built-in defaults are used. Maximum RST_STREAM frames per second window (CVE-2023-44487, CVE-2019-9514)

h2_max_ping_per_window: Option<u32>

Maximum PING frames per second window (CVE-2019-9512)

h2_max_settings_per_window: Option<u32>

Maximum SETTINGS frames per second window (CVE-2019-9515)

h2_max_empty_data_per_window: Option<u32>

Maximum empty DATA frames per second window (CVE-2019-9518)

h2_max_continuation_frames: Option<u32>

Maximum CONTINUATION frames per header block (CVE-2024-27316)

h2_max_glitch_count: Option<u32>

Maximum accumulated protocol anomalies before ENHANCE_YOUR_CALM

h2_initial_connection_window: Option<u32>

H2 connection tuning parameters. Connection-level receive window size in bytes (RFC 9113 §6.9.2). Default: 16777216 (16 MiB). Credit is returned per half window received.

h2_max_concurrent_streams: Option<u32>

Maximum concurrent H2 streams the proxy accepts (SETTINGS_MAX_CONCURRENT_STREAMS). Default: 100.

h2_stream_shrink_ratio: Option<u32>

Shrink threshold ratio for recycled stream slots. Vec is shrunk when total_slots > active_streams * ratio. Default: 2.

h2_max_rst_stream_lifetime: Option<u64>

Floor of the connection-lifetime cap on RST_STREAM frames received (CVE-2023-44487): trips once the count exceeds this value and the resets received after a response started or on a closed stream exceed the streams a backend answered on the connection. Default: 200000.

h2_max_rst_stream_abusive_lifetime: Option<u64>

Floor of the cap on “abusive” (pre-response-start) RST_STREAM frames received on a frontend H2 connection — the Rapid Reset signature: trips once the count exceeds this value and more than half of the backend-routed streams were reset before their response. Default: 1000.

h2_max_rst_stream_emitted_lifetime: Option<u64>

Floor of the cap on RST_STREAM frames emitted by the server that the peer provoked (CVE-2025-8671 “MadeYouReset”): trips once the count exceeds this value and more than half of the backend-routed streams were reset before their response. Covers the emission-direction-flipped sibling of Rapid Reset, where an attacker sends legitimate-looking frames (Content-Length mismatch, header parse error, rejected priority, zero-increment WINDOW_UPDATE on an open stream) that coerce the server into emitting RST_STREAM. Resets Sōzu decides on its own (idle CANCEL, REFUSED_STREAM, STREAM_CLOSED, backend-failure INTERNAL_ERROR) and NoError resets are not counted. Default: 10000.

h2_max_header_list_size: Option<u32>

Maximum accumulated HPACK-decoded header list size per request (SETTINGS_MAX_HEADER_LIST_SIZE, RFC 9113 §6.5.2). Default: 65536.

strict_sni_binding: Option<bool>

When true, every HTTP request served on this listener must have its :authority / Host host exact-match the TLS SNI that was negotiated at handshake (CWE-346 / CWE-444). Disabling this lifts the per-stream TLS trust boundary, so leave enabled unless an operational need requires cross-SNI routing. Default: true.

disable_http11: Option<bool>

When true, this listener only accepts HTTP/2 connections: clients that fail to negotiate h2 via TLS ALPN (including those that omit ALPN altogether) are dropped at handshake instead of silently falling back to HTTP/1.1. Default: false — preserves the historical “ALPN missing defaults to h1” behavior.

h2_stream_idle_timeout_seconds: Option<u32>

Per-stream idle timeout, in seconds. An open H2 stream that receives no meaningful application data (non-empty DATA or HEADERS frames) for this duration is cancelled (RST_STREAM / CANCEL). Active uploads that trickle DATA frames reset the timer on each non-empty frame. Defends against slow-multiplex Slowloris where a client keeps connection-level activity high (any frame resets the connection idle timer) while pinning up to h2_max_concurrent_streams streams. Unset, it inherits back_timeout, floored at 30 (so 30 with the default back_timeout); an explicit value wins, 0 meaning 1.

h2_max_header_table_size: Option<u32>

Maximum HPACK dynamic table size (SETTINGS_HEADER_TABLE_SIZE) accepted from the peer. Caps the peer-advertised value to prevent unbounded HPACK encoder memory growth. Default: 65536.

h2_graceful_shutdown_deadline_seconds: Option<u32>

Maximum wall-clock seconds to wait for in-flight H2 streams after GOAWAY(NO_ERROR) before forcibly closing the connection. Default: 5. Set to 0 to require streams to finish (no forced close).

h2_max_window_update_stream0_per_window: Option<u32>

Maximum unsolicited connection-level (stream 0) WINDOW_UPDATE frames per second window. Each DATA frame the proxy sends entitles the peer to two that are not counted; only the excess counts. Caps non-zero stream-0 WINDOW_UPDATE floods that would otherwise stay under the generic glitch counter (zero-increment stream-0 updates already trigger GOAWAY per RFC 9113 §6.9). Default: 2000.

sozu_id_header: Option<String>

Name of the correlation header Sozu injects into every request and response to carry the per-request ULID. Default: “Sozu-Id”. Operators who want to rebrand can set e.g. “X-Edge-Id” or “X-Request-Trace”.

answers: BTreeMap<String, String>

Per-status HTTP answer template bodies, keyed by HTTP status code (e.g. “404”, “503”). Replaces the per-field shape of CustomHttpAnswers (field 21). The new field is populated alongside http_answers so legacy state files round-trip; new code should read this map.

elide_x_real_ip: Option<bool>

When true, any client-supplied X-Real-IP header is stripped from requests before forwarding (anti-spoofing). Independently combinable with send_x_real_ip. Default: false.

send_x_real_ip: Option<bool>

When true, a proxy-generated X-Real-IP header carrying the connection peer IP (post-PROXY-v2 unwrap, i.e. the original client IP) is appended to every forwarded request. Independently combinable with elide_x_real_ip. Default: false.

hsts: Option<HstsConfig>

Listener-default HSTS (HTTP Strict Transport Security, RFC 6797) policy. When set, every successful response on this listener gains a Strict-Transport-Security header derived from the materialised policy (RFC 6797 §6.1 single-header requirement, §7.2 HTTPS-only emission, §8.1 host scope, §11.4 max-age=0 kill-switch). A per-frontend RequestHttpFrontend.hsts overrides this default.

h2_max_header_fields: Option<u32>

Maximum number of materialized header fields per request — HPACK fields plus expanded cookie crumbs (RFC 9113 §8.2.3). Bounds the HPACK indexed-reference header bomb, where 1-byte indexed references are amplified into per-entry bookkeeping. Default: 128.

interface: Option<String>

Name of the network interface (e.g. “wg0”) the listening socket is bound to with SO_BINDTODEVICE, set before bind(). Linux only: the configuration loader refuses the key on any other platform. Part of the listener identity together with address, so two listeners may share an address on different interfaces. Absent = not bound to an interface (the historical behaviour). Not patchable: changing it needs a rebind, so it is absent from the Update*ListenerConfig patches.

forwarded_headers: Option<i32>

Which forwarding header family is added to every forwarded request: X-Forwarded-*, RFC 7239 Forwarded, both, or none. Independent of elide_x_real_ip and send_x_real_ip. Default: both.

h2_stream_refusal_percent: Option<u32>

Share, in percent, of the pre-response RST_STREAM cap’s floor (h2_max_rst_stream_abusive_lifetime) at which an H2 connection refuses new client streams with RST_STREAM(REFUSED_STREAM), retryable per RFC 9113 §8.7, and keeps serving its open streams. The cap itself still ends the connection with GOAWAY(ENHANCE_YOUR_CALM). 0 disables the soft state; 100 or more never engages it before the cap. Default: 50.

client_auth: Option<i32>

Mutual TLS (client certificate authentication) mode for this listener. Absent or CLIENT_AUTH_NONE (the field-0 default) keeps the current behavior: no CertificateRequest is sent and any client certificate is ignored. OPTIONAL requests a client certificate but still accepts connections that present none; REQUIRED aborts the handshake when the client does not present a certificate chaining to a trusted CA.

client_ca_certificates: Vec<String>

PEM-encoded trusted CA certificates a client certificate must chain to for OPTIONAL/REQUIRED modes. Ignored when client_auth is NONE. Multiple entries build a single root store; each entry may itself hold a concatenated PEM chain.

client_ca_crls: Vec<String>

Optional PEM-encoded certificate revocation lists (CRLs). When present, a presented client certificate is rejected if it (or an intermediate) appears revoked. Ignored when client_auth is NONE.

Implementations

impl HttpsListenerConfig

pub fn listener_key(&self) -> ListenerKey

The identity of the listener this message configures or targets.

impl HttpsListenerConfig

pub fn versions( &self, ) -> FilterMap<Cloned<Iter<'_, i32>>, fn(i32) -> Option<TlsVersion>>

Returns an iterator which yields the valid enum values contained in versions.

pub fn push_versions(&mut self, value: TlsVersion)

Appends the provided enum value to versions.

pub fn certificate(&self) -> &str

Returns the value of certificate, or the default value if certificate is unset.

pub fn key(&self) -> &str

Returns the value of key, or the default value if key is unset.

pub fn h2_max_rst_stream_per_window(&self) -> u32

Returns the value of h2_max_rst_stream_per_window, or the default value if h2_max_rst_stream_per_window is unset.

pub fn h2_max_ping_per_window(&self) -> u32

Returns the value of h2_max_ping_per_window, or the default value if h2_max_ping_per_window is unset.

pub fn h2_max_settings_per_window(&self) -> u32

Returns the value of h2_max_settings_per_window, or the default value if h2_max_settings_per_window is unset.

pub fn h2_max_empty_data_per_window(&self) -> u32

Returns the value of h2_max_empty_data_per_window, or the default value if h2_max_empty_data_per_window is unset.

pub fn h2_max_continuation_frames(&self) -> u32

Returns the value of h2_max_continuation_frames, or the default value if h2_max_continuation_frames is unset.

pub fn h2_max_glitch_count(&self) -> u32

Returns the value of h2_max_glitch_count, or the default value if h2_max_glitch_count is unset.

pub fn h2_initial_connection_window(&self) -> u32

Returns the value of h2_initial_connection_window, or the default value if h2_initial_connection_window is unset.

pub fn h2_max_concurrent_streams(&self) -> u32

Returns the value of h2_max_concurrent_streams, or the default value if h2_max_concurrent_streams is unset.

pub fn h2_stream_shrink_ratio(&self) -> u32

Returns the value of h2_stream_shrink_ratio, or the default value if h2_stream_shrink_ratio is unset.

pub fn h2_max_rst_stream_lifetime(&self) -> u64

Returns the value of h2_max_rst_stream_lifetime, or the default value if h2_max_rst_stream_lifetime is unset.

pub fn h2_max_rst_stream_abusive_lifetime(&self) -> u64

Returns the value of h2_max_rst_stream_abusive_lifetime, or the default value if h2_max_rst_stream_abusive_lifetime is unset.

pub fn h2_max_header_list_size(&self) -> u32

Returns the value of h2_max_header_list_size, or the default value if h2_max_header_list_size is unset.

pub fn strict_sni_binding(&self) -> bool

Returns the value of strict_sni_binding, or the default value if strict_sni_binding is unset.

pub fn disable_http11(&self) -> bool

Returns the value of disable_http11, or the default value if disable_http11 is unset.

pub fn h2_stream_idle_timeout_seconds(&self) -> u32

Returns the value of h2_stream_idle_timeout_seconds, or the default value if h2_stream_idle_timeout_seconds is unset.

pub fn h2_max_header_table_size(&self) -> u32

Returns the value of h2_max_header_table_size, or the default value if h2_max_header_table_size is unset.

pub fn h2_max_rst_stream_emitted_lifetime(&self) -> u64

Returns the value of h2_max_rst_stream_emitted_lifetime, or the default value if h2_max_rst_stream_emitted_lifetime is unset.

pub fn h2_graceful_shutdown_deadline_seconds(&self) -> u32

Returns the value of h2_graceful_shutdown_deadline_seconds, or the default value if h2_graceful_shutdown_deadline_seconds is unset.

pub fn h2_max_window_update_stream0_per_window(&self) -> u32

Returns the value of h2_max_window_update_stream0_per_window, or the default value if h2_max_window_update_stream0_per_window is unset.

pub fn sozu_id_header(&self) -> &str

Returns the value of sozu_id_header, or the default value if sozu_id_header is unset.

pub fn elide_x_real_ip(&self) -> bool

Returns the value of elide_x_real_ip, or the default value if elide_x_real_ip is unset.

pub fn send_x_real_ip(&self) -> bool

Returns the value of send_x_real_ip, or the default value if send_x_real_ip is unset.

pub fn h2_max_header_fields(&self) -> u32

Returns the value of h2_max_header_fields, or the default value if h2_max_header_fields is unset.

pub fn interface(&self) -> &str

Returns the value of interface, or the default value if interface is unset.

pub fn forwarded_headers(&self) -> ForwardedHeaders

Returns the enum value of forwarded_headers, or the default if the field is unset or set to an invalid enum value.

pub fn set_forwarded_headers(&mut self, value: ForwardedHeaders)

Sets forwarded_headers to the provided enum value.

pub fn h2_stream_refusal_percent(&self) -> u32

Returns the value of h2_stream_refusal_percent, or the default value if h2_stream_refusal_percent is unset.

pub fn client_auth(&self) -> ClientAuthMode

Returns the enum value of client_auth, or the default if the field is unset or set to an invalid enum value.

pub fn set_client_auth(&mut self, value: ClientAuthMode)

Sets client_auth to the provided enum value.

impl HttpsListenerConfig

pub fn requests_client_auth(&self) -> bool

True when the listener asks for a client certificate.

Any value other than CLIENT_AUTH_NONE counts, including one this build does not know: it must travel on the verb a pre-mTLS peer cannot decode, and the worker then rejects it when it builds the listener.

pub fn client_auth_policy(&self) -> ClientAuthPolicy

The listener’s client authentication policy, as a patch would carry it.

pub fn apply_client_auth_policy(&mut self, policy: &ClientAuthPolicy)

Replace the client authentication policy with policy, all three fields at once: a CA or CRL the policy leaves out is dropped. The main process and the workers both apply a patch through this, so their copies of the listener cannot diverge.

Trait Implementations

impl Clone for HttpsListenerConfig

fn clone(&self) -> HttpsListenerConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpsListenerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for HttpsListenerConfig

fn default() -> HttpsListenerConfig

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for HttpsListenerConfig

fn deserialize<__D>( __deserializer: __D, ) -> Result<HttpsListenerConfig, <__D as Deserializer<'de>>::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Display for HttpsListenerConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Eq for HttpsListenerConfig

impl Hash for HttpsListenerConfig

fn hash<__H>(&self, state: &mut __H)

where __H: Hasher,

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Message for HttpsListenerConfig

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl Ord for HttpsListenerConfig

fn cmp(&self, other: &HttpsListenerConfig) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

fn clamp_to<R>(self, range: R) -> Self

where Self: Sized, R: ClampBounds<Self>,

🔬This is a nightly-only experimental API. (clamp_to)

Restrict a value to a certain range.

impl PartialEq for HttpsListenerConfig

fn eq(&self, other: &HttpsListenerConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl PartialOrd for HttpsListenerConfig

fn partial_cmp(&self, other: &HttpsListenerConfig) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Serialize for HttpsListenerConfig

fn serialize<__S>( &self, __serializer: __S, ) -> Result<<__S as Serializer>::Ok, <__S as Serializer>::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for HttpsListenerConfig