From ab257e0cbc44e1d55968e7ecd665f66803602c52 Mon Sep 17 00:00:00 2001
From: "mergify[bot]" <37929162+mergify[bot]@users.noreply.github.com>
Date: Thu, 25 Apr 2024 00:48:46 -0700
Subject: [PATCH] v1.17: Limit max concurrent connections (backport of #851)
 (#925)

* Limit max concurrent connections (#851)


Co-authored-by: Lijun Wang <83639177+lijunwangs@users.noreply.github.com>
---
 streamer/src/nonblocking/quic.rs | 4 +++-
 streamer/src/quic.rs             | 2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/streamer/src/nonblocking/quic.rs b/streamer/src/nonblocking/quic.rs
index 38200ea15fe71a..ba567a7f3123fb 100644
--- a/streamer/src/nonblocking/quic.rs
+++ b/streamer/src/nonblocking/quic.rs
@@ -115,7 +115,9 @@ pub fn spawn_server(
     coalesce: Duration,
 ) -> Result<(Endpoint, Arc<StreamStats>, JoinHandle<()>), QuicServerError> {
     info!("Start {name} quic server on {sock:?}");
-    let (config, _cert) = configure_server(keypair, gossip_host)?;
+    let concurrent_connections = max_staked_connections + max_unstaked_connections;
+    let max_concurrent_connections = concurrent_connections + concurrent_connections / 4;
+    let (config, _cert) = configure_server(keypair, gossip_host, max_concurrent_connections)?;
 
     let endpoint = Endpoint::new(
         EndpointConfig::default(),
diff --git a/streamer/src/quic.rs b/streamer/src/quic.rs
index 557ffa0977ea35..1f8286c9b3d816 100644
--- a/streamer/src/quic.rs
+++ b/streamer/src/quic.rs
@@ -56,6 +56,7 @@ impl rustls::server::ClientCertVerifier for SkipClientVerification {
 pub(crate) fn configure_server(
     identity_keypair: &Keypair,
     gossip_host: IpAddr,
+    max_concurrent_connections: usize,
 ) -> Result<(ServerConfig, String), QuicServerError> {
     let (cert, priv_key) = new_self_signed_tls_certificate(identity_keypair, gossip_host)?;
     let cert_chain_pem_parts = vec![Pem {
@@ -71,6 +72,7 @@ pub(crate) fn configure_server(
     server_tls_config.alpn_protocols = vec![ALPN_TPU_PROTOCOL_ID.to_vec()];
 
     let mut server_config = ServerConfig::with_crypto(Arc::new(server_tls_config));
+    server_config.concurrent_connections(max_concurrent_connections as u32);
     server_config.use_retry(true);
     let config = Arc::get_mut(&mut server_config.transport).unwrap();