FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

quic: add session creation rate limiting · nodejs/node@11778a7 · GitHub

/ node Public

Commit 11778a7

Browse files
jasnell
authored and
aduh95
committed
quic: add session creation rate limiting
Signed-off-by: James M Snell <jasnell@gmail.com> Assisted-by: Opencode/Opus 4.6 PR-URL: #63483 Backport-PR-URL: #64675 Reviewed-By: Stephen Belanger <admin@stephenbelanger.com> Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent 8107f1b commit 11778a7

9 files changed

Lines changed: 111 additions & 2 deletions

File tree

‎doc/api/quic.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -776,6 +776,12 @@ added: v23.8.0
776776
* Type: {bigint} The total number of immediate connection close packets
777777
dropped by the global rate limiter. Read only.
778778

779+
### `endpointStats.sessionCreationRateLimited`
780+
781+
* Type: {bigint} The total number of session creation attempts dropped by the
782+
per-host rate limiter. Read only. A non-zero value indicates one or more
783+
remote addresses are creating sessions faster than the configured rate allows.
784+
779785
## Class: `QuicSession`
780786

781787
<!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
25432549
The maximum burst of immediate connection close packets allowed before rate
25442550
limiting takes effect.
25452551

2552+
#### `endpointOptions.sessionCreationRate`
2553+
2554+
* Type: {number}
2555+
* **Default:** `50`
2556+
2557+
The maximum number of new sessions that a single remote address can create per
2558+
second. This is a per-host rate limit tracked in the address validation LRU
2559+
cache. It prevents a validated remote address from churning through sessions
2560+
(rapidly opening and abandoning connections) faster than the server can handle.
2561+
For benchmarking where traffic comes from a single source, set this to a high
2562+
value.
2563+
2564+
#### `endpointOptions.sessionCreationBurst`
2565+
2566+
* Type: {number}
2567+
* **Default:** `100`
2568+
2569+
The maximum burst of new session creations allowed from a single remote address
2570+
before rate limiting takes effect.
2571+
25462572
#### `endpointOptions.retryTokenExpiration`
25472573

25482574
<!-- YAML

‎lib/internal/quic/quic.js‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
315315
* @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
316316
* @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
317317
* @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
318+
* @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
319+
* @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
318320
* @property {ArrayBufferView} [resetTokenSecret] The reset token secret
319321
* @property {bigint|number} [retryTokenExpiration] The retry token expiration
320322
* @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
40134015
versionNegotiationBurst,
40144016
immediateCloseRate,
40154017
immediateCloseBurst,
4018+
sessionCreationRate,
4019+
sessionCreationBurst,
40164020
rxDiagnosticLoss,
40174021
txDiagnosticLoss,
40184022
udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
40564060
versionNegotiationBurst,
40574061
immediateCloseRate,
40584062
immediateCloseBurst,
4063+
sessionCreationRate,
4064+
sessionCreationBurst,
40594065
rxDiagnosticLoss,
40604066
txDiagnosticLoss,
40614067
udpReceiveBufferSize,

‎lib/internal/quic/stats.js‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,7 @@ const {
6767
IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
6868
IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
6969
IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
70+
IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
7071

7172
IDX_STATS_SESSION_CREATED_AT,
7273
IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
134135
assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED !== undefined);
135136
assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT !== undefined);
136137
assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED !== undefined);
138+
assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED !== undefined);
137139
assert(IDX_STATS_SESSION_CREATED_AT !== undefined);
138140
assert(IDX_STATS_SESSION_DESTROYED_AT !== undefined);
139141
assert(IDX_STATS_SESSION_CLOSING_AT !== undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
330332
return this.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
331333
}
332334

335+
/** @type {bigint} */
336+
get sessionCreationRateLimited() {
337+
assertIsQuicEndpointStats(this);
338+
return this.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
339+
}
340+
333341
toString() {
334342
return JSONStringify(this.toJSON());
335343
}
@@ -354,6 +362,7 @@ class QuicEndpointStats {
354362
statelessResetRateLimited,
355363
immediateCloseCount,
356364
immediateCloseRateLimited,
365+
sessionCreationRateLimited,
357366
} = this;
358367
return {
359368
__proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
377386
statelessResetRateLimited: `${statelessResetRateLimited}`,
378387
immediateCloseCount: `${immediateCloseCount}`,
379388
immediateCloseRateLimited: `${immediateCloseRateLimited}`,
389+
sessionCreationRateLimited: `${sessionCreationRateLimited}`,
380390
};
381391
}
382392

@@ -410,6 +420,7 @@ class QuicEndpointStats {
410420
statelessResetRateLimited,
411421
immediateCloseCount,
412422
immediateCloseRateLimited,
423+
sessionCreationRateLimited,
413424
} = this;
414425

415426
return `QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
431442
statelessResetRateLimited,
432443
immediateCloseCount,
433444
immediateCloseRateLimited,
445+
sessionCreationRateLimited,
434446
}, opts)}`;
435447
}
436448

‎src/quic/bindingdata.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,8 @@ class SessionManager;
125125
V(version_negotiation_burst, "versionNegotiationBurst") \
126126
V(immediate_close_rate, "immediateCloseRate") \
127127
V(immediate_close_burst, "immediateCloseBurst") \
128+
V(session_creation_rate, "sessionCreationRate") \
129+
V(session_creation_burst, "sessionCreationBurst") \
128130
V(max_stream_window, "maxStreamWindow") \
129131
V(max_window, "maxWindow") \
130132
V(min_version, "minVersion") \

‎src/quic/defs.h‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -371,8 +371,15 @@ struct TokenBucket final {
371371
double tokens; // current token count
372372
uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
373373

374+
TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
374375
TokenBucket(double rate, double burst);
375376

377+
// Reinitialize the bucket with new rate/burst parameters if it
378+
// hasn't been initialized yet (last_ts == 0). Used for per-host
379+
// buckets in the address LRU where the rate/burst aren't known
380+
// at construction time.
381+
void InitOnce(double r, double b);
382+
376383
// Try to consume one token. Refills based on elapsed time, then
377384
// attempts to consume. Returns true if the request is allowed.
378385
bool consume();

‎src/quic/endpoint.cc‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,8 @@ namespace quic {
7878
V(STATELESS_RESET_COUNT, stateless_reset_count) \
7979
V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
8080
V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
81-
V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
81+
V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
82+
V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
8283

8384
struct Endpoint::State {
8485
#define V(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
9192
TokenBucket::TokenBucket(double rate, double burst)
9293
: rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
9394

95+
void TokenBucket::InitOnce(double r, double b) {
96+
if (last_ts == 0) {
97+
rate = r;
98+
burst = b;
99+
tokens = b;
100+
last_ts = uv_hrtime();
101+
}
102+
}
103+
94104
// Try to consume one token. Refills based on elapsed time, then
95105
// attempts to consume. Returns true if the request is allowed.
96106
bool TokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
227237
!SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
228238
!SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
229239
!SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
230-
!SET(immediate_close_burst) ||
240+
!SET(immediate_close_burst) || !SET(session_creation_rate) ||
241+
!SET(session_creation_burst) ||
231242
#ifdef DEBUG
232243
!SET(rx_loss) || !SET(tx_loss) ||
233244
#endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
296307
"immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
297308
res += prefix +
298309
"immediate close burst: " + std::to_string(immediate_close_burst);
310+
res += prefix +
311+
"session creation rate: " + std::to_string(session_creation_rate) +
312+
"/s";
313+
res += prefix +
314+
"session creation burst: " + std::to_string(session_creation_burst);
299315
res += prefix + "validate address: " + boolToString(validate_address);
300316
res += prefix +
301317
"disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
13311347
// as a server, then we cannot accept the initial packet.
13321348
if (is_closed() || is_closing() || !is_listening()) return;
13331349

1350+
// Per-host session creation rate limit. The bucket is initialized
1351+
// on first access with the configured rate/burst from options.
1352+
auto info = addr_validation_lru_.Upsert(config.remote_address);
1353+
info->session_creation_bucket.InitOnce(options_.session_creation_rate,
1354+
options_.session_creation_burst);
1355+
if (!info->session_creation_bucket.consume()) {
1356+
Debug(this,
1357+
"Session creation rate limit exceeded for %s",
1358+
config.remote_address);
1359+
STAT_INCREMENT(Stats, session_creation_rate_limited);
1360+
return;
1361+
}
1362+
13341363
Debug(this, "Creating new session for %s", config.dcid);
13351364

13361365
std::optional<SessionTicket> no_ticket = std::nullopt;

‎src/quic/endpoint.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
4444
static constexpr double DEFAULT_IMMEDIATE_CLOSE_RATE = 100;
4545
static constexpr double DEFAULT_IMMEDIATE_CLOSE_BURST = 200;
4646

47+
// Per-host session creation rate limit. This is tracked per validated
48+
// remote address in the address LRU, preventing a single source from
49+
// churning through sessions faster than the server can handle. Unlike
50+
// the global stateless response buckets, this only applies after address
51+
// validation (spoofed sources can't reach this path).
52+
static constexpr double DEFAULT_SESSION_CREATION_RATE = 50;
53+
static constexpr double DEFAULT_SESSION_CREATION_BURST = 100;
54+
4755
// Endpoint configuration options
4856
struct Options final : public MemoryRetainer {
4957
// The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
8391
double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
8492
double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
8593

94+
// Per-host session creation rate limit. Tracked per validated remote
95+
// address in the address LRU. Set to high values for benchmarking
96+
// where traffic comes from a single source.
97+
double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
98+
double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
99+
86100
// The validate_address parameter instructs the Endpoint to perform explicit
87101
// address validation using retry tokens. This is strongly recommended and
88102
// should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
452466
struct Type final {
453467
uint64_t timestamp;
454468
bool validated;
469+
TokenBucket session_creation_bucket;
455470
};
456471

457472
static bool CheckExpired(const SocketAddress& address, const Type& type);

‎test/parallel/test-quic-internal-endpoint-options.mjs‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,16 @@ const cases = [
9999
valid: [0, 1, 10, 100.5, 1000],
100100
invalid: [-1, 'a', null, false, true, {}, [], () => {}]
101101
},
102+
{
103+
key: 'sessionCreationRate',
104+
valid: [0, 1, 10, 100.5, 1000, Infinity],
105+
invalid: [-1, 'a', null, false, true, {}, [], () => {}]
106+
},
107+
{
108+
key: 'sessionCreationBurst',
109+
valid: [0, 1, 10, 100.5, 1000, Infinity],
110+
invalid: [-1, 'a', null, false, true, {}, [], () => {}]
111+
},
102112
{
103113
key: 'validateAddress',
104114
valid: [true, false, 0, 1, 'a'],

‎test/parallel/test-quic-internal-endpoint-stats-state.mjs‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -95,6 +95,7 @@ const {
9595
strictEqual(typeof endpoint.stats.statelessResetRateLimited, 'bigint');
9696
strictEqual(typeof endpoint.stats.immediateCloseCount, 'bigint');
9797
strictEqual(typeof endpoint.stats.immediateCloseRateLimited, 'bigint');
98+
strictEqual(typeof endpoint.stats.sessionCreationRateLimited, 'bigint');
9899

99100
deepStrictEqual(Object.keys(endpoint.stats.toJSON()), [
100101
'connected',
@@ -115,6 +116,7 @@ const {
115116
'statelessResetRateLimited',
116117
'immediateCloseCount',
117118
'immediateCloseRateLimited',
119+
'sessionCreationRateLimited',
118120
]);
119121
strictEqual(typeof inspect(endpoint.stats), 'string');
120122
}

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL