Struct HttpHardening 

pub struct HttpHardening {
    pub http1_max_headers: usize,
    pub http1_max_buf_size: usize,
    pub http1_header_read_timeout: Duration,
    pub h2_max_concurrent_streams: u32,
    pub h2_initial_stream_window: u32,
    pub h2_initial_connection_window: u32,
    pub h2_max_send_buf_size: usize,
    pub request_body_gap: Option<Duration>,
}

Resolved hardening configuration (see the module docs for the knob table, defaults, and the attack each bound addresses).

Fields

http1_max_headers: usize

HTTP/1 max header count per request/section.

http1_max_buf_size: usize

HTTP/1 read-buffer cap, in BYTES.

http1_header_read_timeout: Duration

HTTP/1 header-read (slowloris) timeout.

h2_max_concurrent_streams: u32

HTTP/2 max concurrent streams (enforced and advertised).

h2_initial_stream_window: u32

HTTP/2 initial per-stream flow-control window, in BYTES.

h2_initial_connection_window: u32

HTTP/2 initial connection flow-control window, in BYTES.

h2_max_send_buf_size: usize

HTTP/2 per-connection send-buffer cap, in BYTES.

request_body_gap: Option<Duration>

Inbound request-body inactivity gap; None disables the wrapper (the body then streams through untouched).

Implementations

impl HttpHardening

pub fn from_env() -> Self

Read the knob set from the environment; invalid or absent values fall back to the documented defaults.

pub fn apply<E>(&self, builder: &mut Builder<E>)

Apply the connection-level bounds to a hyper-util auto builder (h1 + h2). Used by every serving surface: data-plane listeners and the admin listener share one hardening posture.

pub fn apply_listener_h2<E>( &self, builder: &mut Builder<E>, config: &Http2ListenerConfig, )

Apply per-listener HTTP/2 overrides (PERF-11, #244). Called after apply to override the process-wide h2 defaults with listener-specific values. Only the fields present in the config are overridden; absent fields keep the process default.

pub fn wrap_request_body<B>(&self, body: B) -> InboundBody<B>

where B: Body<Data = Bytes>, B::Error: Into<Box<dyn Error + Send + Sync>>,

Wrap an inbound request body with the inactivity-gap timeout. A thin passthrough when the knob is disabled.

pub async fn guard_connection<S>(&self, stream: S) -> Option<PrefixedStream<S>>

where S: AsyncRead + AsyncWrite + Unpin,

Pre-parse smuggling guard for one connection (DW-023). Reads ahead just enough of the first request head to apply the CL+TE rejection policy BEFORE hyper normalizes the head away (hyper’s HTTP/1 parser gives Transfer-Encoding precedence and DROPS the Content-Length header, which is desync-safe behind this gateway but erases the evidence an explicit rejection needs). Returns the stream to hand to the connection builder (with the sniffed bytes replayed in front), or None when the connection was rejected and answered.

Behavior:

• Bytes beginning with PRI (the h2c preface) pass through untouched the moment the first bytes identify it — h2 has its own framing rules (Transfer-Encoding is forbidden there; hyper rejects it) and needs no h1 head sniff.
• A first HTTP/1 head carrying BOTH a Content-Length and a Transfer-Encoding header (any order) is answered with a bare 400 Bad Request + close and never reaches the dataplane.
• A head containing an obs-fold (RFC 7230 3.2.4 obsolete line folding: any header line starting with SP/HTAB) is likewise answered 400 + close. Folding can split a header NAME across lines (Transfer-\r\n Encoding: chunked), which the name-anchored CL+TE scan below cannot see — and obs-fold is illegal in HTTP/1.1 requests, which hyper also rejects, so refusing it at the sniff is strictly aligned with the parser, one layer earlier.
• The head terminator is the FIRST blank line under either line-ending convention hyper tolerates (\r\n\r\n for RFC-strict clients, \n\n and the mixed forms for bare-LF clients): a legal LF-only client’s body must not be over-buffered into the sniff (spurious 431).
• A head exceeding the HTTP/1 read-buffer cap is likewise refused.
• The sniff’s read bound is per-read (http1_header_read_timeout applied to each individual read, see the module docs): a slow starter simply falls through to hyper, whose per-head slowloris timeout governs from there.
• Documented limitation: only the FIRST request head on a connection is inspected; later keep-alive requests rely on hyper’s framing itself, which cannot desync behind this gateway (every forwarded request is rebuilt from parsed parts — there is no raw-passthrough path).

Trait Implementations

impl Clone for HttpHardening

fn clone(&self) -> HttpHardening

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for HttpHardening

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for HttpHardening

fn default() -> Self

Returns the “default value” for a type.

impl PartialEq for HttpHardening

fn eq(&self, other: &HttpHardening) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Eq for HttpHardening

impl StructuralPartialEq for HttpHardening