Struct RateLimitBucketBudget 

pub struct RateLimitBucketBudget {
    pub max_distinct_per_peer: u32,
    pub max_distinct_global: u32,
    pub window: Duration,
}

Caps on how many distinct rate-limit buckets one scope may create, applied by super::RateLimitLayer’s default key derivation.

Where the defaults come from

max_distinct_per_peer = 128 is sized so that no realistic legitimate peer reaches it: a single NAT egress (or IPv6 /64) serving 128 simultaneously-active distinct credentials within one scope lifetime is already an unusual deployment, and one that should be configuring this rather than inheriting it. An attacker, by contrast, needs one bucket per request to amplify — so 128 is three orders of magnitude below what the attack needs while still above what real traffic uses.

max_distinct_global = 8192 applies only when there is no verified peer address at all (no ConnectInfo), where every caller shares one scope. It is deliberately far larger, because collateral there hits unrelated callers: the global scope degrades to a single loud overflow bucket only when the deployment is both misconfigured and under attack.

window (default 60s) is a floor on how long one admitted credential holds its slot, not a fixed period that resets the scope. The store raises it to at least the buckets’ own TTL (cratestack_core::scope_ttl_secs), because a record that expired first bounded nothing — the next generation re-admitted max_distinct more while the previous one was still alive, for a real steady state of max_distinct × ceil(bucket_ttl / window) (cratestack#871 review, blocker 2). Slots expire individually and are refreshed on use, so an active credential keeps its slot while a rotated-away one releases it.

Fields

max_distinct_per_peer: u32

max_distinct_global: u32

window: Duration

Implementations

impl RateLimitBucketBudget

pub const DEFAULT_MAX_DISTINCT_PER_PEER: u32 = 128

pub const DEFAULT_MAX_DISTINCT_GLOBAL: u32 = 8192

pub const DEFAULT_WINDOW: Duration

pub fn new( max_distinct_per_peer: u32, max_distinct_global: u32, window: Duration, ) -> RateLimitBucketBudget

pub fn max_distinct_per_peer(self, max: u32) -> RateLimitBucketBudget

pub fn max_distinct_global(self, max: u32) -> RateLimitBucketBudget

pub fn window(self, window: Duration) -> RateLimitBucketBudget

Trait Implementations

impl Clone for RateLimitBucketBudget

fn clone(&self) -> RateLimitBucketBudget

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for RateLimitBucketBudget

impl Debug for RateLimitBucketBudget

fn fmt(&self, f: &mut Formatter<'_>) -> Result<(), Error>

Formats the value using the given formatter.

impl Default for RateLimitBucketBudget

fn default() -> RateLimitBucketBudget

Returns the “default value” for a type.

impl Eq for RateLimitBucketBudget

impl PartialEq for RateLimitBucketBudget

fn eq(&self, other: &RateLimitBucketBudget) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for RateLimitBucketBudget