quic: add session creation rate limiting

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode/Opus 4.6
PR-URL: #63483
Backport-PR-URL: #64675
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: jasnell

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }

doc/api/quic.md

@@ -776,6 +776,12 @@ added: v23.8.0
 * Type: {bigint} The total number of immediate connection close packets
  dropped by the global rate limiter. Read only.
 
+### `endpointStats.sessionCreationRateLimited`
+
+* Type: {bigint} The total number of session creation attempts dropped by the
+ per-host rate limiter. Read only. A non-zero value indicates one or more
+ remote addresses are creating sessions faster than the configured rate allows.
+
 ## Class: `QuicSession`
 
 <!-- YAML
@@ -2543,6 +2549,26 @@ send per second.
 The maximum burst of immediate connection close packets allowed before rate
 limiting takes effect.
 
+#### `endpointOptions.sessionCreationRate`
+
+* Type: {number}
+***Default:**`50`
+
+The maximum number of new sessions that a single remote address can create per
+second. This is a per-host rate limit tracked in the address validation LRU
+cache. It prevents a validated remote address from churning through sessions
+(rapidly opening and abandoning connections) faster than the server can handle.
+For benchmarking where traffic comes from a single source, set this to a high
+value.
+
+#### `endpointOptions.sessionCreationBurst`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum burst of new session creations allowed from a single remote address
+before rate limiting takes effect.
+
 #### `endpointOptions.retryTokenExpiration`
 
 <!-- YAML

lib/internal/quic/quic.js

@@ -315,6 +315,8 @@ const endpointRegistry = new SafeSet();
  * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
  * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
  * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
+ * @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
+ * @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4013,6 +4015,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4056,6 +4060,8 @@ class QuicEndpoint {
  versionNegotiationBurst,
  immediateCloseRate,
  immediateCloseBurst,
+ sessionCreationRate,
+ sessionCreationBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -67,6 +67,7 @@ const {
 IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
+IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -134,6 +135,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT !== undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
+assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -330,6 +332,12 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
 }
 
+/** @type {bigint} */
+getsessionCreationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -354,6 +362,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -377,6 +386,7 @@ class QuicEndpointStats {
 statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
 immediateCloseRateLimited: `${immediateCloseRateLimited}`,
+sessionCreationRateLimited: `${sessionCreationRateLimited}`,
 };
 }
 
@@ -410,6 +420,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -431,6 +442,7 @@ class QuicEndpointStats {
  statelessResetRateLimited,
  immediateCloseCount,
  immediateCloseRateLimited,
+ sessionCreationRateLimited,
 },opts)}`;
 }
 

src/quic/bindingdata.h

@@ -125,6 +125,8 @@ class SessionManager;
 V(version_negotiation_burst, "versionNegotiationBurst") \
 V(immediate_close_rate, "immediateCloseRate") \
 V(immediate_close_burst, "immediateCloseBurst") \
+V(session_creation_rate, "sessionCreationRate") \
+V(session_creation_burst, "sessionCreationBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -371,8 +371,15 @@ struct TokenBucket final {
 double tokens; // current token count
 uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
 
+TokenBucket() : rate(0), burst(0), tokens(0), last_ts(0) {}
 TokenBucket(double rate, double burst);
 
+// Reinitialize the bucket with new rate/burst parameters if it
+// hasn't been initialized yet (last_ts == 0). Used for per-host
+// buckets in the address LRU where the rate/burst aren't known
+// at construction time.
+voidInitOnce(double r, double b);
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolconsume();

src/quic/endpoint.cc

@@ -78,7 +78,8 @@ namespace quic {
 V(STATELESS_RESET_COUNT, stateless_reset_count) \
 V(STATELESS_RESET_RATE_LIMITED, stateless_reset_rate_limited) \
 V(IMMEDIATE_CLOSE_COUNT, immediate_close_count) \
-V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited)
+V(IMMEDIATE_CLOSE_RATE_LIMITED, immediate_close_rate_limited) \
+V(SESSION_CREATION_RATE_LIMITED, session_creation_rate_limited)
 
 structEndpoint::State {
 #defineV(_, name, type) type name;
@@ -91,6 +92,15 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
+voidTokenBucket::InitOnce(double r, double b) {
+if (last_ts == 0) {
+ rate = r;
+ burst = b;
+ tokens = b;
+ last_ts = uv_hrtime();
+ }
+}
+
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
 boolTokenBucket::consume() {
@@ -227,7 +237,8 @@ Maybe<Endpoint::Options> Endpoint::Options::From(Environment* env,
  !SET(retry_rate) || !SET(retry_burst) || !SET(stateless_reset_rate) ||
  !SET(stateless_reset_burst) || !SET(version_negotiation_rate) ||
  !SET(version_negotiation_burst) || !SET(immediate_close_rate) ||
- !SET(immediate_close_burst) ||
+ !SET(immediate_close_burst) || !SET(session_creation_rate) ||
+ !SET(session_creation_burst) ||
 #ifdef DEBUG
  !SET(rx_loss) || !SET(tx_loss) ||
 #endif
@@ -296,6 +307,11 @@ std::string Endpoint::Options::ToString() const {
 "immediate close rate: " + std::to_string(immediate_close_rate) + "/s";
  res += prefix +
 "immediate close burst: " + std::to_string(immediate_close_burst);
+ res += prefix +
+"session creation rate: " + std::to_string(session_creation_rate) +
+"/s";
+ res += prefix +
+"session creation burst: " + std::to_string(session_creation_burst);
  res += prefix + "validate address: " + boolToString(validate_address);
  res += prefix +
 "disable stateless reset: " + boolToString(disable_stateless_reset);
@@ -1331,6 +1347,19 @@ void Endpoint::Receive(const uint8_t* data,
 // as a server, then we cannot accept the initial packet.
 if (is_closed() || is_closing() || !is_listening()) return;
 
+// Per-host session creation rate limit. The bucket is initialized
+// on first access with the configured rate/burst from options.
+auto info = addr_validation_lru_.Upsert(config.remote_address);
+ info->session_creation_bucket.InitOnce(options_.session_creation_rate,
+ options_.session_creation_burst);
+if (!info->session_creation_bucket.consume()) {
+Debug(this,
+"Session creation rate limit exceeded for %s",
+ config.remote_address);
+STAT_INCREMENT(Stats, session_creation_rate_limited);
+return;
+ }
+
 Debug(this, "Creating new session for %s", config.dcid);
 
  std::optional<SessionTicket> no_ticket = std::nullopt;

src/quic/endpoint.h

@@ -44,6 +44,14 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_RATE = 100;
 staticconstexprdoubleDEFAULT_IMMEDIATE_CLOSE_BURST = 200;
 
+// Per-host session creation rate limit. This is tracked per validated
+// remote address in the address LRU, preventing a single source from
+// churning through sessions faster than the server can handle. Unlike
+// the global stateless response buckets, this only applies after address
+// validation (spoofed sources can't reach this path).
+staticconstexprdoubleDEFAULT_SESSION_CREATION_RATE = 50;
+staticconstexprdoubleDEFAULT_SESSION_CREATION_BURST = 100;
+
 // Endpoint configuration options
 structOptionsfinal : public MemoryRetainer {
 // The local socket address to which the UDP port will be bound. The port
@@ -83,6 +91,12 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 double immediate_close_rate = DEFAULT_IMMEDIATE_CLOSE_RATE;
 double immediate_close_burst = DEFAULT_IMMEDIATE_CLOSE_BURST;
 
+// Per-host session creation rate limit. Tracked per validated remote
+// address in the address LRU. Set to high values for benchmarking
+// where traffic comes from a single source.
+double session_creation_rate = DEFAULT_SESSION_CREATION_RATE;
+double session_creation_burst = DEFAULT_SESSION_CREATION_BURST;
+
 // The validate_address parameter instructs the Endpoint to perform explicit
 // address validation using retry tokens. This is strongly recommended and
 // should only be disabled in trusted, closed environments as a performance
@@ -452,6 +466,7 @@ class Endpoint final : public AsyncWrap, public Packet::Listener {
 structTypefinal {
 uint64_t timestamp;
 bool validated;
+ TokenBucket session_creation_bucket;
  };
 
 staticboolCheckExpired(const SocketAddress& address, const Type& type);

test/parallel/test-quic-internal-endpoint-options.mjs

@@ -99,6 +99,16 @@ const cases = [
 valid: [0,1,10,100.5,1000],
 invalid: [-1,'a',null,false,true,{},[],()=>{}]
 },
+{
+key: 'sessionCreationRate',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
+{
+key: 'sessionCreationBurst',
+valid: [0,1,10,100.5,1000,Infinity],
+invalid: [-1,'a',null,false,true,{},[],()=>{}]
+},
 {
 key: 'validateAddress',
 valid: [true,false,0,1,'a'],

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -95,6 +95,7 @@ const {
 strictEqual(typeofendpoint.stats.statelessResetRateLimited,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseCount,'bigint');
 strictEqual(typeofendpoint.stats.immediateCloseRateLimited,'bigint');
+strictEqual(typeofendpoint.stats.sessionCreationRateLimited,'bigint');
 
 deepStrictEqual(Object.keys(endpoint.stats.toJSON()),[
 'connected',
@@ -115,6 +116,7 @@ const {
 'statelessResetRateLimited',
 'immediateCloseCount',
 'immediateCloseRateLimited',
+'sessionCreationRateLimited',
 ]);
 strictEqual(typeofinspect(endpoint.stats),'string');
 }