Struct IpsetDdosProtection 

pub struct IpsetDdosProtection { /* private fields */ }

Production DDoS protection backed by Linux ipset.

Per-IP scores use linear time decay: each allow_request adds 1.0 point, each report_bad_request adds bad_request_penalty points, and the score drains at decay_per_second points/second. This means sustained low-rate traffic stabilises below the threshold while bursts trigger quickly.

When a score first crosses score_threshold, the IP is added to the named ipset via ipset add <set_name> <ip> --exist. A second 10-second moka cache (ipset_throttle) prevents hammering the ipset command.

try_acquire_connection additionally enforces a per-IP connection cap (max_connections_per_ip).

Implementations

impl IpsetDdosProtection

pub fn new( set_name: impl Into<String>, score_threshold: f64, decay_per_second: f64, bad_request_penalty: f64, max_connections_per_ip: usize, ) -> Self

Trait Implementations

impl DdosProtection for IpsetDdosProtection

fn allow_request(&self, ip: &str) -> bool

Returns true if the request from ip should be processed, false if it should be dropped immediately.

fn report_bad_request(&self, ip: &str)

Notify the implementation that a request from ip was rejected. Implementations should use this to accumulate evidence and eventually ban repeat offenders.

fn try_acquire_connection(&self, ip: &str) -> bool

Try to acquire a connection slot for ip, checking both the ban score and the per-IP connection cap. Returns true and increments the connection count on success. Returns false if the IP is blocked or over the per-IP cap.

fn release_connection(&self, ip: &str)

Release a connection slot previously acquired by try_acquire_connection. Called automatically by DdosConnectionGuard::drop.