Struct IncomingSessionPixConfig 

pub struct IncomingSessionPixConfig {
    pub enforce_pix: bool,
    pub quota_range: RangeInclusive<u64>,
    pub max_ssa_delivery_time: Duration,
    pub max_deposit_wait: Duration,
    pub ssas_per_request: usize,
}

Configuration of the PIX protocol for incoming Sessions on Exit nodes.

Fields

enforce_pix: bool

If set to true, incoming Session without the Capability::UsePIX will be rejected.

Default false.

quota_range: RangeInclusive<u64>

Acceptable range of data quota per one SSA in bytes.

If an Entry sends PIX parameters for SSA reconstruction that are outside this quota range, the incoming Session will be rejected.

The default is derived from the default PIX dimensions (crate::DEFAULT_PIX_POLYS_PER_SSA × (crate::DEFAULT_PIX_SHARES_PER_POLY + crate::DEFAULT_PIX_SURPLUS_SHARES)) rather than hard-coded, so that an Entry running the default configuration is always accepted. The upper bound is exactly DEFAULT_PIX_SSA_QUOTA: the range expresses how much data this Exit is willing to serve per SSA cycle, and accepting more than our own nominal dimensions would raise both that exposure and the reconstructor memory held per Session. An Exit that wants to serve Entries configured with larger dimensions must widen this range explicitly.

The quota it is compared against counts the surplus — polys × (threshold + surplus) × PAYLOAD_SIZE — so this bounds the traffic actually served rather than the fraction of it the threshold accounts for. It used to bound only the latter, which understated the exposure by the surplus factor: 1.25× at the deployed dimensions.

Defaults to DEFAULT_PIX_SSA_QUOTA / 4 ..= DEFAULT_PIX_SSA_QUOTA (≈ 162 MiB to ≈ 649 MiB, inclusive).

max_ssa_delivery_time: Duration

Maximum time to wait for the SSA to be fully committed and delivered to the Exit.

The Session is allowed to be used unincentivized for max_deposit_time + max_ssa_delivery_time the deposit wait time because the Client has to be able to deliver its SSA commitment.

max_deposit_wait: Duration

Maximum time to wait for the funds to be deposited in the SSA.

The Session is allowed to be used unincentivized for max_deposit_time + max_ssa_delivery_time the deposit wait time because the Client has to be able to deliver its SSA commitment.

Default is 1 minute.

ssas_per_request: usize

Number of SSAs this Exit asks the Entry to commit to in a single [SsaServerCommitmentMessage].

Batching amortizes the round trip over several deposit cycles, at the cost of holding that many live reconstructor cycles at once (≈49 MiB of peak state each at the profiled dimensions) and fronting that many SSA quotas of unincentivized service before the first deposit lands. It applies to every request, including the first one at Session establishment.

The deposit deadline scales with it: each cycle in a batch gets a kill switch at ssas_per_request × (max_deposit_wait + max_ssa_delivery_time), and the deposit awaiter’s timeout is scaled by the same factor, so a batch is judged as a whole rather than per cycle.

This must not exceed the peer Entry’s max_ssas_per_request. There is no negotiation of the batch size — StartSession.additional_data is fully allocated (PIX dimensions in the upper 32 bits, SURB balancer target in the lower 32), so the Entry has no way to advertise its cap and this Exit has no way to learn it. An Entry that considers the batch too large rejects the whole request and replies with a [StartErrorReason::UnacceptablePixParams] SessionError, which closes the Session on both sides within about a round trip — see refuse_ssa_request. Every Session is still lost, so raising this requires raising pix.max_ssas_per_request on every Entry that will use this Exit; the reply only means the failure is immediate and reported rather than showing up as a deposit timeout after the whole ssas_per_request-scaled window has elapsed.

Clamped to 1..=MAX_SSA_BATCH_SIZE in SessionManager::new.

Defaults to DEFAULT_SSAS_PER_SSA_REQUEST (1), which reproduces the unbatched exchange exactly.

Trait Implementations

impl Clone for IncomingSessionPixConfig

fn clone(&self) -> IncomingSessionPixConfig

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for IncomingSessionPixConfig

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for IncomingSessionPixConfig

fn default() -> Self

Return IncomingSessionPixConfig { enforce_pix: false, quota_range: DEFAULT_PIX_SSA_QUOTA / DEFAULT_PIX_QUOTA_RANGE_SPAN ..= DEFAULT_PIX_SSA_QUOTA, max_ssa_delivery_time: Duration::from_secs(20), max_deposit_wait: Duration::from_secs(60), ssas_per_request: DEFAULT_SSAS_PER_SSA_REQUEST }

impl<'de> Deserialize<'de> for IncomingSessionPixConfig

where IncomingSessionPixConfig: Default,

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl PartialEq for IncomingSessionPixConfig

fn eq(&self, other: &IncomingSessionPixConfig) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl Serialize for IncomingSessionPixConfig

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for IncomingSessionPixConfig