quinn-proto: drop Initials silently when saturated

[stablebits]

When the max_incoming queue is full (or CIDs are exhausted), quinn replied to each Initial with CONNECTION_REFUSED. Building that reply derives the packet's initial keys, which is computationally expensive.
A flood of Initials then forces the endpoint's packet-processing task to do per-Initial crypto work, leaving it less time for legitimate packets and degrading already-established connections.

So drop Initials silently when saturated.

[djc]

Don't we already have ignore() for this?

[alexpyattaev]

Don't we already have ignore() for this?

.ignore operates after Endpoint has spent the CPU time processing the initial_keys in Incoming packets.

[stablebits]

Don't we already have ignore() for this?

.ignore operates after Endpoint has spent the CPU time processing the initial_keys in Incoming packets.

A user app would need to get incoming from endpoint.accept() in order to call ignore(), wouldn't it? But this won't happen if the endpoint's incomings queue is full...

[Ralith]

Perhaps silently dropping unrecognized packets when max_incoming is saturated should be the default/only behavior? That condition should only arise under heavy load, after all.

[djc]

Perhaps silently dropping unrecognized packets when max_incoming is saturated should be the default/only behavior? That condition should only arise under heavy load, after all.

Seems reasonable to me.

[stablebits]

Perhaps silently dropping unrecognized packets when max_incoming is saturated should be the default/only behavior? That condition should only arise under heavy load, after all.

Seems reasonable to me.

Made it default/only-behaviour under saturation

[Ralith]

LGTM, some nits.

[djc]

Nice! Feel free to backport.