Struct Limits 

pub struct Limits {

    pub udp_session_timeout: u64,
    pub max_targets_per_conn: u32,
    pub max_connections: u32,
    pub connect_timeout: u64,
    pub ip_family_preference: IpFamilyPreference,
    pub max_streams_bidi: u32,
    pub max_idle_timeout: u64,
    pub keep_alive_interval: u64,
    pub initial_mtu: u16,
    pub mtu_discovery: bool,
    pub mtu_upper_bound: u16,
    pub congestion_control: CongestionControl,
    pub initial_rtt_ms: u64,
    pub socket_recv_buffer: usize,
    pub socket_send_buffer: usize,
}

[limits] — resource and lifetime limits.

Fields

udp_session_timeout: u64

Seconds a UDP session may sit idle before it is closed.

It bounds the TCP path too, despite the name: once one direction of a TCP tunnel has ended cleanly, each write in the surviving direction has this long to complete, which is the only thing keeping a half-closed tunnel from holding its socket and its slot for as long as the QUIC connection lasts (tunnel::tcp module docs). Both uses reach the tunnel as crate::tunnel::Context::stall_budget. The name is the CONNECT-UDP half alone because it is the older one and a configuration key cannot be renamed without breaking every deployed config file.

max_targets_per_conn: u32

Concurrent tunnels allowed on one QUIC connection.

max_connections: u32

Simultaneously open QUIC connections. Zero means no limit.

Beyond this, new connections are refused at the QUIC layer, before a handshake completes and before any per-connection state is built.

connect_timeout: u64

Seconds allowed for reaching a target. Zero disables the budget.

Spent twice per request: once on name resolution, once on the whole list of addresses it resolved to. See DEFAULT_CONNECT_TIMEOUT.

ip_family_preference: IpFamilyPreference

Which address family a resolved target is tried on first.

Applied once, at the single point where a name becomes a list of addresses, so both tunnel kinds see the same order; see IpFamilyPreference for why the default departs from the resolver’s.

max_streams_bidi: u32

Concurrent client-initiated bidirectional streams per QUIC connection, once a request on it has passed the credentials check.

Not what the handshake advertises: a connection is accepted on the smaller quic::INITIAL_BIDI_STREAMS and raised to this by its first authenticated request, so an unauthenticated peer is never worth the configured value.

Between 1 and 65536. The ceiling is not a formality: the credit is reserved slot by slot when the allowance is granted rather than when a stream is opened, so it is work paid in one go — at the first authentication now, and at every handshake before the clamp.

max_idle_timeout: u64

Seconds a QUIC connection may go without traffic before it is closed.

Only half of what decides that: RFC 9000 §10.1 takes the minimum of both endpoints’ advertisements, so a client advertising less wins. See DEFAULT_MAX_IDLE_TIMEOUT.

keep_alive_interval: u64

Seconds between keep-alive packets. Zero disables them.

Must be below half of Limits::max_idle_timeout; see DEFAULT_KEEP_ALIVE_INTERVAL for why.

initial_mtu: u16

Size of the first QUIC packets, in bytes. Between 1200 and 1452.

A UDP payload size rather than an IP packet size; see MAX_INITIAL_MTU for where the upper end of that range comes from.

mtu_discovery: bool

Probe for a larger path MTU than initial_mtu (RFC 8899 DPLPMTUD).

On by default. Turning it off stops the upward search: packets start at initial_mtu and are never probed larger. It is not a hard pin, though — quinn’s black-hole detector still runs, and if it fires it drops the packet size to the 1200-byte floor for the rest of the connection, with nothing left to probe it back up. Trades throughput for predictability on a path that black-holes large packets.

mtu_upper_bound: u16

Ceiling for path MTU discovery, in bytes. Between initial_mtu and 1472.

A UDP payload size like initial_mtu. quinn’s default of 1452 is the value safe over both IPv4 and IPv6 on Ethernet; an operator who has measured their path (ping -M do, tracepath) can claim what IPv4 leaves above that — at most 1472 — and overshooting is harmless, because a size is only ever reached by probing it. Moot when mtu_discovery is off, which is warned about rather than rejected. See MAX_MTU_UPPER_BOUND.

congestion_control: CongestionControl

QUIC congestion controller. Defaults to BBR; see CongestionControl.

initial_rtt_ms: u64

Milliseconds of round-trip time assumed before the first measurement.

Seeds the handshake retransmission timers; see DEFAULT_INITIAL_RTT_MS for the trade-off and how to pick a value from the connection logs.

socket_recv_buffer: usize

UDP socket receive buffer to request, in bytes. Zero keeps the OS default.

Applied to the socket when it is created, which makes this a startup-only setting: a SIGHUP reload does not rebind the socket, so a change here needs a restart — the same class as Server::listen, and unlike every key above it. A reload carrying a different value is accepted, applies nothing, and says so, exactly as one carrying a different listen does.

Two things the kernel does with the request are worth knowing before reading a log line about it. It is capped at a host ceiling — net.core.rmem_max on Linux, kern.ipc.maxsockbuf on macOS — and a host may fail the call outright instead of clamping. And on Linux the value read back is double what was granted, because the accounting includes per-packet overhead, so a satisfied 2 MiB request reads as 4194304 both here and in ss -uanpm. Either way the endpoint still comes up, and volto warns at startup when it got less than it asked for. See DEFAULT_SOCKET_RECV_BUFFER.

socket_send_buffer: usize

UDP socket send buffer to request, in bytes. Zero keeps the OS default.

Startup-only, read back and warned about exactly like Limits::socket_recv_buffer; the ceiling on this side is net.core.wmem_max. See DEFAULT_SOCKET_SEND_BUFFER.

Implementations

impl Limits

pub fn udp_session_timeout(&self) -> Duration

The UDP session idle timeout as a duration.

pub fn max_idle_timeout(&self) -> Duration

The QUIC idle timeout as a duration.

pub fn initial_rtt(&self) -> Duration

initial_rtt_ms as a Duration.

pub fn connect_timeout(&self) -> Option<Duration>

The budget for reaching a target, or None when it is disabled.

Read once per request rather than baked into the transport, so it is not one of the parameters a connection is stuck with for its whole life.

pub fn keep_alive_interval(&self) -> Option<Duration>

The keep-alive interval, or None when keep-alives are disabled.

Trait Implementations

impl Clone for Limits

fn clone(&self) -> Limits

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Limits

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Limits

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Limits

where Limits: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.