quic: refine rate limiting

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63483
Backport-PR-URL: #64675
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: jasnell

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }

doc/api/quic.md

@@ -726,31 +726,55 @@ added: v23.8.0
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of QUIC retry attempts on this endpoint. Read only.
+* Type: {bigint} The total number of retry packets sent by this endpoint. Read only.
+
+### `endpointStats.retryRateLimited`
+
+* Type: {bigint} The total number of retry packets dropped by the global rate
+ limiter. Read only. A non-zero value indicates the endpoint is under retry
+ flood pressure.
 
 ### `endpointStats.versionNegotiationCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions rejected due to QUIC version mismatch. Read only.
+* Type: {bigint} The total number of version negotiation packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.versionNegotiationRateLimited`
+
+* Type: {bigint} The total number of version negotiation packets dropped by
+ the global rate limiter. Read only.
 
 ### `endpointStats.statelessResetCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of stateless resets handled by this endpoint. Read only.
+* Type: {bigint} The total number of stateless reset packets sent by this
+ endpoint. Read only.
+
+### `endpointStats.statelessResetRateLimited`
+
+* Type: {bigint} The total number of stateless reset packets dropped by the
+ global rate limiter. Read only.
 
 ### `endpointStats.immediateCloseCount`
 
 <!-- YAML
 added: v23.8.0
 -->
 
-* Type: {bigint} The total number of sessions that were closed before handshake completed. Read only.
+* Type: {bigint} The total number of immediate connection close packets sent
+ by this endpoint. Read only.
+
+### `endpointStats.immediateCloseRateLimited`
+
+* Type: {bigint} The total number of immediate connection close packets
+ dropped by the global rate limiter. Read only.
 
 ## Class: `QuicSession`
 
@@ -2455,25 +2479,69 @@ addresses. When the limit is reached, new connections are refused with
 This limit can also be changed dynamically after construction via
 [`endpoint.maxConnectionsTotal`][].
 
-#### `endpointOptions.maxRetries`
+#### `endpointOptions.retryRate`
 
-<!-- YAML
-added: v23.8.0
--->
+* Type: {number}
+***Default:**`100`
 
-* Type: {bigint|number}
+The maximum number of QUIC retry packets the endpoint will send per second.
+This is a global rate limit (not per-host) that caps the total server-wide
+retry response rate, preventing spoofed-source floods from consuming unbounded
+resources.
 
-Specifies the maximum number of QUIC retry attempts allowed per remote peer address.
+#### `endpointOptions.retryBurst`
 
-#### `endpointOptions.maxStatelessResetsPerHost`
+* Type: {number}
+***Default:**`200`
 
-<!-- YAML
-added: v23.8.0
--->
+The maximum burst of retry packets allowed before rate limiting takes effect.
 
-* Type: {bigint|number}
+#### `endpointOptions.statelessResetRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of stateless reset packets the endpoint will send per second.
+
+#### `endpointOptions.statelessResetBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of stateless reset packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.versionNegotiationRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of version negotiation packets the endpoint will send per
+second.
+
+#### `endpointOptions.versionNegotiationBurst`
+
+* Type: {number}
+***Default:**`200`
+
+The maximum burst of version negotiation packets allowed before rate limiting
+takes effect.
+
+#### `endpointOptions.immediateCloseRate`
+
+* Type: {number}
+***Default:**`100`
+
+The maximum number of immediate connection close packets the endpoint will
+send per second.
+
+#### `endpointOptions.immediateCloseBurst`
+
+* Type: {number}
+***Default:**`200`
 
-Specifies the maximum number of stateless resets that are allowed per remote peer address.
+The maximum burst of immediate connection close packets allowed before rate
+limiting takes effect.
 
 #### `endpointOptions.retryTokenExpiration`
 

lib/internal/quic/quic.js

@@ -307,8 +307,14 @@ const endpointRegistry = new SafeSet();
  * @property {boolean} [reusePort] Enable SO_REUSEPORT for multi-process load balancing
  * @property {bigint|number} [maxConnectionsPerHost] The maximum number of connections per host
  * @property {bigint|number} [maxConnectionsTotal] The maximum number of total connections
- * @property {bigint|number} [maxRetries] The maximum number of retries
- * @property {bigint|number} [maxStatelessResetsPerHost] The maximum number of stateless resets per host
+ * @property {number} [retryRate] Global rate limit for retry packets (per second)
+ * @property {number} [retryBurst] Burst capacity for retry rate limiter
+ * @property {number} [statelessResetRate] Global rate limit for stateless reset packets (per second)
+ * @property {number} [statelessResetBurst] Burst capacity for stateless reset rate limiter
+ * @property {number} [versionNegotiationRate] Global rate limit for version negotiation packets (per second)
+ * @property {number} [versionNegotiationBurst] Burst capacity for version negotiation rate limiter
+ * @property {number} [immediateCloseRate] Global rate limit for immediate close packets (per second)
+ * @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
  * @property {ArrayBufferView} [resetTokenSecret] The reset token secret
  * @property {bigint|number} [retryTokenExpiration] The retry token expiration
  * @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -3997,10 +4003,16 @@ class QuicEndpoint {
  tokenExpiration,
  maxConnectionsPerHost =100,
  maxConnectionsTotal =10_000,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,
@@ -4034,10 +4046,16 @@ class QuicEndpoint {
 // Connection limits are set on the state buffer, not passed to C++.
  maxConnectionsPerHost,
  maxConnectionsTotal,
- maxStatelessResetsPerHost,
  disableStatelessReset,
  addressLRUSize,
- maxRetries,
+ retryRate,
+ retryBurst,
+ statelessResetRate,
+ statelessResetBurst,
+ versionNegotiationRate,
+ versionNegotiationBurst,
+ immediateCloseRate,
+ immediateCloseBurst,
  rxDiagnosticLoss,
  txDiagnosticLoss,
  udpReceiveBufferSize,

lib/internal/quic/stats.js

@@ -60,9 +60,13 @@ const {
 IDX_STATS_ENDPOINT_CLIENT_SESSIONS,
 IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT,
 IDX_STATS_ENDPOINT_RETRY_COUNT,
+IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED,
 IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT,
+IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED,
 IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT,
+IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED,
 IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
+IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
 
 IDX_STATS_SESSION_CREATED_AT,
 IDX_STATS_SESSION_DESTROYED_AT,
@@ -123,9 +127,13 @@ assert(IDX_STATS_ENDPOINT_SERVER_SESSIONS !== undefined);
 assert(IDX_STATS_ENDPOINT_CLIENT_SESSIONS!==undefined);
 assert(IDX_STATS_ENDPOINT_SERVER_BUSY_COUNT!==undefined);
 assert(IDX_STATS_ENDPOINT_RETRY_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED!==undefined);
 assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT!==undefined);
+assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED!==undefined);
 assert(IDX_STATS_SESSION_CREATED_AT!==undefined);
 assert(IDX_STATS_SESSION_DESTROYED_AT!==undefined);
 assert(IDX_STATS_SESSION_CLOSING_AT!==undefined);
@@ -280,24 +288,48 @@ class QuicEndpointStats {
 returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_COUNT];
 }
 
+/** @type {bigint} */
+getretryRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_RETRY_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getversionNegotiationCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_COUNT];
 }
 
+/** @type {bigint} */
+getversionNegotiationRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_VERSION_NEGOTIATION_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getstatelessResetCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_COUNT];
 }
 
+/** @type {bigint} */
+getstatelessResetRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED];
+}
+
 /** @type {bigint} */
 getimmediateCloseCount(){
 assertIsQuicEndpointStats(this);
 returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT];
 }
 
+/** @type {bigint} */
+getimmediateCloseRateLimited(){
+assertIsQuicEndpointStats(this);
+returnthis.#handle[IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED];
+}
+
 toString(){
 returnJSONStringify(this.toJSON());
 }
@@ -315,9 +347,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 return{
 __proto__: null,
@@ -334,9 +370,13 @@ class QuicEndpointStats {
 clientSessions: `${clientSessions}`,
 serverBusyCount: `${serverBusyCount}`,
 retryCount: `${retryCount}`,
+retryRateLimited: `${retryRateLimited}`,
 versionNegotiationCount: `${versionNegotiationCount}`,
+versionNegotiationRateLimited: `${versionNegotiationRateLimited}`,
 statelessResetCount: `${statelessResetCount}`,
+statelessResetRateLimited: `${statelessResetRateLimited}`,
 immediateCloseCount: `${immediateCloseCount}`,
+immediateCloseRateLimited: `${immediateCloseRateLimited}`,
 };
 }
 
@@ -363,9 +403,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 }=this;
 
 return`QuicEndpointStats ${inspect({
@@ -380,9 +424,13 @@ class QuicEndpointStats {
  clientSessions,
  serverBusyCount,
  retryCount,
+ retryRateLimited,
  versionNegotiationCount,
+ versionNegotiationRateLimited,
  statelessResetCount,
+ statelessResetRateLimited,
  immediateCloseCount,
+ immediateCloseRateLimited,
 },opts)}`;
 }
 

node.gyp

@@ -449,6 +449,7 @@
 'test/cctest/test_quic_cid.cc',
 'test/cctest/test_quic_error.cc',
 'test/cctest/test_quic_preferredaddress.cc',
+'test/cctest/test_quic_tokenbucket.cc',
 'test/cctest/test_quic_tokens.cc',
  ],
 'node_cctest_inspector_sources': [

src/quic/bindingdata.h

@@ -117,8 +117,14 @@ class SessionManager;
 V(idle_timeout, "idleTimeout") \
 V(max_idle_timeout, "maxIdleTimeout") \
 V(max_payload_size, "maxPayloadSize") \
-V(max_retries, "maxRetries") \
-V(max_stateless_resets, "maxStatelessResetsPerHost") \
+V(retry_rate, "retryRate") \
+V(retry_burst, "retryBurst") \
+V(stateless_reset_rate, "statelessResetRate") \
+V(stateless_reset_burst, "statelessResetBurst") \
+V(version_negotiation_rate, "versionNegotiationRate") \
+V(version_negotiation_burst, "versionNegotiationBurst") \
+V(immediate_close_rate, "immediateCloseRate") \
+V(immediate_close_burst, "immediateCloseBurst") \
 V(max_stream_window, "maxStreamWindow") \
 V(max_window, "maxWindow") \
 V(min_version, "minVersion") \

src/quic/defs.h

@@ -360,6 +360,24 @@ constexpr auto kSocketAddressInfoTimeout = 60 * NGTCP2_SECONDS;
 constexprsize_tkMaxVectorCount = 16;
 constexpr stream_id kMaxStreamId = std::numeric_limits<stream_id>::max();
 
+// A token bucket rate limiter using lazy refill. No timer needed — tokens
+// are computed on demand from the elapsed time since the last check.
+// Used to cap the total rate of stateless responses (retry, reset,
+// version negotiation, immediate close) regardless of source address,
+// preventing spoofed-source floods from bypassing per-host limits.
+structTokenBucketfinal {
+double rate; // tokens per second (refill rate)
+double burst; // maximum tokens (bucket capacity)
+double tokens; // current token count
+uint64_t last_ts; // last refill timestamp (nanoseconds, uv_hrtime)
+
+TokenBucket(double rate, double burst);
+
+// Try to consume one token. Refills based on elapsed time, then
+// attempts to consume. Returns true if the request is allowed.
+boolconsume();
+};
+
 classDebugIndentScopefinal {
 public:
 inlineDebugIndentScope() { ++indent_; }