Struct ShadowMirrorManager 

pub struct ShadowMirrorManager { /* private fields */ }

Manager for shadow mirroring operations.

Coordinates mirror decisions, rate limiting, and async delivery to honeypots. Uses a bounded queue (semaphore) to prevent memory exhaustion from slow honeypots.

Implementations

impl ShadowMirrorManager

pub fn new( config: ShadowMirrorConfig, sensor_id: String, ) -> Result<Self, ShadowMirrorError>

Creates a new shadow mirror manager with default concurrency limit.

Errors

Returns ShadowMirrorError::ClientCreation if the HTTP client cannot be created.

pub fn with_max_concurrent( config: ShadowMirrorConfig, sensor_id: String, max_concurrent: usize, ) -> Result<Self, ShadowMirrorError>

Creates a new shadow mirror manager with a custom concurrency limit.

Arguments

• config - Shadow mirror configuration
• sensor_id - Sensor ID for payload attribution
• max_concurrent - Maximum concurrent mirror operations (prevents memory exhaustion)

Errors

Returns ShadowMirrorError::ClientCreation if the HTTP client cannot be created.

pub fn should_mirror(&self, risk_score: f32, client_ip: &str) -> bool

Determines if a request should be mirrored based on detection result.

Arguments

• risk_score - Risk score from detection (0-100)
• client_ip - Source IP address

Returns

true if the request should be mirrored, false otherwise.

pub fn mirror_async(&self, payload: MirrorPayload) -> bool

Sends a mirror payload asynchronously (fire-and-forget) with bounded concurrency.

Returns immediately without waiting for delivery to complete. Uses a semaphore to limit concurrent operations and prevent memory exhaustion when honeypots are slow or unresponsive. If the queue is full, the request is dropped (backpressure) rather than blocking or causing unbounded growth.

Returns

true if the payload was queued for delivery, false if dropped due to backpressure.

pub fn create_payload( &self, request_id: String, source_ip: String, method: String, uri: String, site_name: String, risk_score: f32, matched_rules: Vec<String>, ja4: Option<String>, ja4h: Option<String>, campaign_id: Option<String>, headers: HashMap<String, String>, body: Option<String>, ) -> MirrorPayload

Creates a mirror payload from request context.

Arguments

• request_id - Unique request identifier
• source_ip - Client IP address
• method - HTTP method
• uri - Request URI
• site_name - Site/vhost name
• risk_score - Calculated risk score
• matched_rules - IDs of rules that matched
• ja4 - Optional JA4 TLS fingerprint
• ja4h - Optional JA4H HTTP fingerprint
• campaign_id - Optional campaign correlation ID
• headers - Request headers to include
• body - Optional request body

pub fn cleanup(&self)

Runs periodic cleanup of the rate limiter.

Call this from a background task at regular intervals (e.g., every 60s).

pub fn stats(&self) -> ShadowMirrorStats

Returns statistics about shadow mirroring.

pub fn reset_stats(&self)

Resets all statistics.

pub fn is_enabled(&self) -> bool

Returns whether shadow mirroring is enabled.

pub fn config(&self) -> &ShadowMirrorConfig

Returns the configuration.