Use token-bucket SYN limiter backends

Co-Authored-By: brekotis <93345790+brekotis@users.noreply.github.com>

src/config/defaults.rs

@@ -56,6 +56,7 @@ const DEFAULT_CONNTRACK_PRESSURE_LOW_WATERMARK_PCT: u8 = 70;
 const DEFAULT_CONNTRACK_DELETE_BUDGET_PER_SEC: u64 = 4096;
 const DEFAULT_SYNLIMIT_SECONDS: u32 = 1;
 const DEFAULT_SYNLIMIT_HITCOUNT: u32 = 1;
+const DEFAULT_SYNLIMIT_BURST: u32 = 3;
 const DEFAULT_UPSTREAM_CONNECT_RETRY_ATTEMPTS: u32 = 2;
 const DEFAULT_UPSTREAM_UNHEALTHY_FAIL_THRESHOLD: u32 = 5;
 const DEFAULT_UPSTREAM_CONNECT_BUDGET_MS: u64 = 3000;
@@ -253,6 +254,10 @@ pub(crate) fn default_synlimit_hitcount() -> u32 {
     DEFAULT_SYNLIMIT_HITCOUNT
 }
 
+pub(crate) fn default_synlimit_burst() -> u32 {
+    DEFAULT_SYNLIMIT_BURST
+}
+
 pub(crate) fn default_prefer_4() -> u8 {
     4
 }

src/config/load.rs

@@ -349,6 +349,7 @@ const LISTENER_CONFIG_KEYS: &[&str] = &[
     "synlimit",
     "synlimit_seconds",
     "synlimit_hitcount",
+    "synlimit_burst",
     "announce",
     "announce_ip",
     "proxy_protocol",
@@ -1961,6 +1962,11 @@ impl ProxyConfig {
                     "server.listeners[{idx}].synlimit_hitcount must be > 0"
                 )));
             }
+            if listener.synlimit_burst == 0 {
+                return Err(ProxyError::Config(format!(
+                    "server.listeners[{idx}].synlimit_burst must be > 0"
+                )));
+            }
         }
 
         if config.server.accept_permit_timeout_ms > 60_000 {
@@ -2202,6 +2208,7 @@ impl ProxyConfig {
                     synlimit: SynLimitMode::default(),
                     synlimit_seconds: default_synlimit_seconds(),
                     synlimit_hitcount: default_synlimit_hitcount(),
+                    synlimit_burst: default_synlimit_burst(),
                     announce: None,
                     announce_ip: None,
                     proxy_protocol: None,
@@ -2218,6 +2225,7 @@ impl ProxyConfig {
                     synlimit: SynLimitMode::default(),
                     synlimit_seconds: default_synlimit_seconds(),
                     synlimit_hitcount: default_synlimit_hitcount(),
+                    synlimit_burst: default_synlimit_burst(),
                     announce: None,
                     announce_ip: None,
                     proxy_protocol: None,

src/config/types.rs

@@ -1375,9 +1375,9 @@ pub enum SynLimitMode {
     /// Disable SYN limiting for this listener.
     #[default]
     Off,
-    /// Use iptables/ip6tables filter rules with the recent match.
+    /// Use iptables/ip6tables filter rules with the hashlimit match.
     Iptables,
-    /// Use nftables rules with timeout-backed dynamic sets.
+    /// Use nftables rules with per-source token-bucket meters.
     Nftables,
 }
 
@@ -2176,12 +2176,15 @@ pub struct ListenerConfig {
     /// Per-listener SYN limiter mode.
     #[serde(default)]
     pub synlimit: SynLimitMode,
-    /// Iptables recent-match interval for the per-listener SYN limiter.
+    /// Token-bucket rate interval for the per-listener SYN limiter.
     #[serde(default = "default_synlimit_seconds")]
     pub synlimit_seconds: u32,
-    /// Iptables recent-match hit count for the per-listener SYN limiter.
+    /// Token-bucket rate amount for the per-listener SYN limiter.
     #[serde(default = "default_synlimit_hitcount")]
     pub synlimit_hitcount: u32,
+    /// Token-bucket burst size for the per-listener SYN limiter.
+    #[serde(default = "default_synlimit_burst")]
+    pub synlimit_burst: u32,
     /// IP address or hostname to announce in proxy links.
     /// Takes precedence over `announce_ip` if both are set.
     #[serde(default)]