Struct MemDdosProtection 

pub struct MemDdosProtection { /* private fields */ }

In-memory DDoS protection with linearly decaying per-IP scores.

Each allow_request adds 1.0 point, each report_bad_request adds bad_request_penalty points. Between calls the score drains at decay_per_second points/second, so sustained low-rate traffic stabilises well below the threshold while bursts trigger quickly.

Scores are stored in a moka cache whose idle expiry is long enough for any maxed-out score to fully decay, keeping memory bounded.

Implementations

impl MemDdosProtection

pub fn new( score_threshold: f64, decay_per_second: f64, bad_request_penalty: f64, max_connections_per_ip: usize, ) -> Self

Trait Implementations

impl DdosProtection for MemDdosProtection

fn allow_request(&self, ip: &str) -> bool

Returns true if the request from ip should be processed, false if it should be dropped immediately.

fn report_bad_request(&self, ip: &str)

Notify the implementation that a request from ip was rejected. Implementations should use this to accumulate evidence and eventually ban repeat offenders.

fn try_acquire_connection(&self, ip: &str) -> bool

Try to acquire a connection slot for ip, checking both the ban score and the per-IP connection cap. Returns true and increments the connection count on success. Returns false if the IP is blocked or over the per-IP cap.

fn release_connection(&self, ip: &str)

Release a connection slot previously acquired by try_acquire_connection. Called automatically by DdosConnectionGuard::drop.