Struct Security 

pub struct Security {
    pub allow_private_networks: bool,
    pub denied_ports: Vec<u16>,
    pub unanswered_packet_budget: u32,
    pub max_auth_failures: u32,
    pub expected_sni: Vec<String>,
}

[security] — destination policy and abuse mitigations.

The defaults are the ones RFC 9298 §7 asks for: private address space is out of reach, the classic relay port is closed, and a session that has not heard from its target cannot be used as an amplifier.

Fields

allow_private_networks: bool

Allow tunnels to loopback, RFC 1918, link-local and ULA addresses.

Off by default: the proxy’s own source address often carries privileges a remote client must not borrow.

denied_ports: Vec<u16>

Target ports that are refused regardless of address.

unanswered_packet_budget: u32

Packets a UDP session may send before its target has answered.

Zero disables the mitigation.

max_auth_failures: u32

Authentication failures tolerated on one connection before it is closed.

Not a rate limit: it raises the cost of guessing from “one handshake, then unlimited attempts” to “one handshake per N attempts”. Zero disables it.

expected_sni: Vec<String>

Host names this server answers to, or an empty list to answer to any.

Empty is the default and the behaviour every release before this one had: the name a client asks for is logged and otherwise ignored. A non-empty list turns on the SNI gate (D106): a handshake whose ClientHello does not name one of these hosts is dropped at the socket, before quinn sees it, so a port scan of this address gets no answer at all. See crate::gate for what that covers and what it does not.

Trait Implementations

impl Clone for Security

fn clone(&self) -> Security

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Security

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Security

fn default() -> Self

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Security

where Security: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.