Create the flood control that sits in front of the kehto bridge.
Each window has a token bucket of ingressBurst per second. When it is
empty, envelopes queue (defer) up to ingressQueue and are released by
drain as tokens refill; past the queue they are rejected. A window that
sends quarantineThreshold messages inside ten seconds, or fetches more
than hiddenResourceAllowance resources while hidden, is quarantined until
the user releases it. Oversized envelopes are rejected outright. A caller
that refuses deferred traffic instead of holding it passes hold: false:
the burst is reported as defer but nothing is queued.
The guard emits an event for every disposition other than pass, so the
user can see what an applet tried to do (D-003).
Create the flood control that sits in front of the kehto bridge.
Each window has a token bucket of
ingressBurstper second. When it is empty, envelopes queue (defer) up toingressQueueand are released bydrainas tokens refill; past the queue they are rejected. A window that sendsquarantineThresholdmessages inside ten seconds, or fetches more thanhiddenResourceAllowanceresources while hidden, is quarantined until the user releases it. Oversized envelopes are rejected outright. A caller that refuses deferred traffic instead of holding it passeshold: false: the burst is reported asdeferbut nothing is queued.The guard emits an event for every disposition other than
pass, so the user can see what an applet tried to do (D-003).