quic: cache timestamp for address lru cache

Signed-off-by: James M Snell <jasnell@gmail.com>
PR-URL: #63483
Backport-PR-URL: #64675
Reviewed-By: Stephen Belanger <admin@stephenbelanger.com>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: jasnell

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================

src/node_sockaddr-inl.h

@@ -186,10 +186,10 @@ typename T::Type* SocketAddressLRU<T>::Peek(
 }
 
 template <typename T>
-void SocketAddressLRU<T>::CheckExpired() {
+void SocketAddressLRU<T>::CheckExpired(uint64_t now) {
 auto it = list_.rbegin();
 while (it != list_.rend()) {
-if (T::CheckExpired(it->first, it->second)) {
+if (T::CheckExpired(it->first, it->second, now)) {
  map_.erase(it->first);
  list_.pop_back();
  it = list_.rbegin();
@@ -211,21 +211,20 @@ void SocketAddressLRU<T>::MemoryInfo(MemoryTracker* tracker) const {
 // cache and adjust if necessary. Whether the item exists or not,
 // purge expired items.
 template <typename T>
-typename T::Type* SocketAddressLRU<T>::Upsert(
-const SocketAddress& address) {
-
-auto on_exit = OnScopeLeave([&]() { CheckExpired(); });
+typename T::Type* SocketAddressLRU<T>::Upsert(const SocketAddress& address,
+uint64_t now) {
+auto on_exit = OnScopeLeave([&]() { CheckExpired(now); });
 
 auto it = map_.find(address);
 if (it != std::end(map_)) {
  list_.splice(list_.begin(), list_, it->second);
-T::Touch(it->first, &it->second->second);
+T::Touch(it->first, &it->second->second, now);
 return &it->second->second;
  }
 
  list_.push_front(Pair(address, { }));
  map_[address] = list_.begin();
-T::Touch(list_.begin()->first, &list_.begin()->second);
+T::Touch(list_.begin()->first, &list_.begin()->second, now);
 
 // Drop the last item in the list if we are
 // over the size limit...

src/node_sockaddr.h

@@ -213,8 +213,9 @@ class SocketAddressLRU : public MemoryRetainer {
 // If the item already exists, returns a reference to
 // the existing item, adjusting items position in the
 // LRU. If the item does not exist, emplaces the item
-// and returns the new item.
- Type* Upsert(const SocketAddress& address);
+// and returns the new item. The caller provides a
+// timestamp to avoid redundant uv_hrtime() calls.
+ Type* Upsert(const SocketAddress& address, uint64_t now);
 
 // Returns a reference to the item if it exists, or
 // nullptr. The position in the LRU is not modified.
@@ -231,7 +232,7 @@ class SocketAddressLRU : public MemoryRetainer {
 using Pair = std::pair<SocketAddress, Type>;
 using Iterator = typename std::list<Pair>::iterator;
 
-voidCheckExpired();
+voidCheckExpired(uint64_t now);
 
  std::list<Pair> list_;
  SocketAddress::Map<Iterator> map_;

src/quic/defs.h

@@ -378,11 +378,13 @@ struct TokenBucket final {
 // hasn't been initialized yet (last_ts == 0). Used for per-host
 // buckets in the address LRU where the rate/burst aren't known
 // at construction time.
-voidInitOnce(double r, double b);
+voidInitOnce(double r, double b, uint64_t now);
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolconsume();
+// The caller provides the current timestamp to avoid redundant
+// uv_hrtime() calls in hot paths.
+boolconsume(uint64_t now);
 };
 
 classDebugIndentScopefinal {

src/quic/endpoint.cc

@@ -92,19 +92,18 @@ STAT_STRUCT(Endpoint, ENDPOINT)
 TokenBucket::TokenBucket(double rate, double burst)
  : rate(rate), burst(burst), tokens(burst), last_ts(uv_hrtime()) {}
 
-voidTokenBucket::InitOnce(double r, double b) {
+voidTokenBucket::InitOnce(double r, double b, uint64_t now) {
 if (last_ts == 0) {
  rate = r;
  burst = b;
  tokens = b;
- last_ts = uv_hrtime();
+ last_ts = now;
  }
 }
 
 // Try to consume one token. Refills based on elapsed time, then
 // attempts to consume. Returns true if the request is allowed.
-boolTokenBucket::consume() {
-uint64_t now = uv_hrtime();
+boolTokenBucket::consume(uint64_t now) {
 double elapsed = static_cast<double>(now - last_ts) / 1e9; // seconds
  last_ts = now;
  tokens = std::min(burst, tokens + elapsed * rate);
@@ -1025,9 +1024,9 @@ void Endpoint::SendBatch(Packet::Ptr* packets, size_t count) {
  }
 }
 
-voidEndpoint::SendRetry(const PathDescriptor& options) {
+voidEndpoint::SendRetry(const PathDescriptor& options, uint64_t now) {
 Debug(this, "Sending retry on path %s", options);
-if (!retry_bucket_.consume()) {
+if (!retry_bucket_.consume(now)) {
 Debug(this, "Retry rate limit exceeded (global)");
 STAT_INCREMENT(Stats, retry_rate_limited);
 return;
@@ -1041,9 +1040,10 @@ void Endpoint::SendRetry(const PathDescriptor& options) {
  }
 }
 
-voidEndpoint::SendVersionNegotiation(const PathDescriptor& options) {
+voidEndpoint::SendVersionNegotiation(const PathDescriptor& options,
+uint64_t now) {
 Debug(this, "Sending version negotiation on path %s", options);
-if (!version_negotiation_bucket_.consume()) {
+if (!version_negotiation_bucket_.consume(now)) {
 Debug(this, "Version negotiation rate limit exceeded (global)");
 STAT_INCREMENT(Stats, version_negotiation_rate_limited);
 return;
@@ -1057,7 +1057,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
 }
 
 boolEndpoint::SendStatelessReset(const PathDescriptor& options,
-size_t source_len) {
+size_t source_len,
+uint64_t now) {
 if (options_.disable_stateless_reset) [[unlikely]] {
 returnfalse;
  }
@@ -1066,7 +1067,7 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
  options,
  source_len);
 
-if (!stateless_reset_bucket_.consume()) {
+if (!stateless_reset_bucket_.consume(now)) {
 Debug(this, "Stateless reset rate limit exceeded (global)");
 STAT_INCREMENT(Stats, stateless_reset_rate_limited);
 returnfalse;
@@ -1086,12 +1087,13 @@ bool Endpoint::SendStatelessReset(const PathDescriptor& options,
 }
 
 voidEndpoint::SendImmediateConnectionClose(const PathDescriptor& options,
- QuicError reason) {
+ QuicError reason,
+uint64_t now) {
 Debug(this,
 "Sending immediate connection close on path %s with reason %s",
  options,
  reason);
-if (!immediate_close_bucket_.consume()) {
+if (!immediate_close_bucket_.consume(now)) {
 Debug(this, "Immediate connection close rate limit exceeded (global)");
 STAT_INCREMENT(Stats, immediate_close_rate_limited);
 return;
@@ -1313,6 +1315,8 @@ void Endpoint::CloseGracefully() {
 voidEndpoint::Receive(constuint8_t* data,
 size_t len,
 const SocketAddress& remote_address) {
+constuint64_t now = uv_hrtime();
+
 constauto receive = [&](Session* session,
 constuint8_t* pkt_data,
 size_t pkt_len,
@@ -1327,7 +1331,12 @@ void Endpoint::Receive(const uint8_t* data,
 // are generated. The deferred flush via BindingData's uv_check
 // callback calls SendPendingData once per dirty session after all
 // packets in the burst have been read.
-if (session->ReadPacket(pkt_data, pkt_len, local_address, remote_address)) {
+if (session->ReadPacket(pkt_data,
+ pkt_len,
+ local_address,
+ remote_address,
+PacketInfo(),
+ now)) {
 STAT_INCREMENT_N(Stats, bytes_received, pkt_len);
 STAT_INCREMENT(Stats, packets_received);
  }
@@ -1349,10 +1358,10 @@ void Endpoint::Receive(const uint8_t* data,
 
 // Per-host session creation rate limit. The bucket is initialized
 // on first access with the configured rate/burst from options.
-auto info = addr_validation_lru_.Upsert(config.remote_address);
- info->session_creation_bucket.InitOnce(options_.session_creation_rate,
-options_.session_creation_burst);
-if (!info->session_creation_bucket.consume()) {
+auto info = addr_validation_lru_.Upsert(config.remote_address, now);
+ info->session_creation_bucket.InitOnce(
+options_.session_creation_rate, options_.session_creation_burst, now);
+if (!info->session_creation_bucket.consume(now)) {
 Debug(this,
 "Session creation rate limit exceeded for %s",
  config.remote_address);
@@ -1451,7 +1460,8 @@ void Endpoint::Receive(const uint8_t* data,
 if (state_->busy) STAT_INCREMENT(Stats, server_busy_count);
 SendImmediateConnectionClose(
  PathDescriptor{version, dcid, scid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 // The packet was successfully processed, even if we did refuse the
 // connection.
 STAT_INCREMENT(Stats, packets_received);
@@ -1525,7 +1535,8 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this, "Retry token from %s is invalid.", remote_address);
 SendImmediateConnectionClose(
  PathDescriptor{version, scid, dcid, local_address, remote_address},
-QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED));
+QuicError::ForTransport(NGTCP2_CONNECTION_REFUSED),
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1541,7 +1552,7 @@ void Endpoint::Receive(const uint8_t* data,
 // Mark the address as validated since the retry round-trip proves
 // reachability.
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  }
 
 // Step 2: Address validation — decide whether to send a Retry or
@@ -1557,13 +1568,15 @@ void Endpoint::Receive(const uint8_t* data,
 "Initial packet has no token. Sending retry to %s to start "
 "validation",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1584,13 +1597,15 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Regular token from %s is invalid.",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1602,20 +1617,22 @@ void Endpoint::Receive(const uint8_t* data,
 Debug(this,
 "Initial packet from %s has unknown token type",
  remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
  }
 
 Debug(this, "Remote address %s is validated", remote_address);
- addr_validation_lru_.Upsert(remote_address)->validated = true;
+ addr_validation_lru_.Upsert(remote_address, now)->validated = true;
  } elseif (hd.tokenlen > 0) {
 Debug(this,
 "Ignoring initial packet from %s with unexpected token",
@@ -1627,13 +1644,15 @@ void Endpoint::Receive(const uint8_t* data,
 if (options_.validate_address) {
 Debug(
 this, "Sending retry to %s due to 0RTT packet", remote_address);
-SendRetry(PathDescriptor{
- version,
- dcid,
- scid,
- local_address,
- remote_address,
- });
+SendRetry(
+ PathDescriptor{
+ version,
+ dcid,
+ scid,
+ local_address,
+ remote_address,
+ },
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1742,8 +1761,12 @@ void Endpoint::Receive(const uint8_t* data,
  pversion_cid.version);
 CIDdcid(pversion_cid.dcid, pversion_cid.dcidlen);
 CIDscid(pversion_cid.scid, pversion_cid.scidlen);
-SendVersionNegotiation(PathDescriptor{
- pversion_cid.version, dcid, scid, local_address(), remote_address});
+SendVersionNegotiation(PathDescriptor{pversion_cid.version,
+ dcid,
+ scid,
+local_address(),
+ remote_address},
+ now);
 STAT_INCREMENT(Stats, packets_received);
 return;
  }
@@ -1822,7 +1845,8 @@ void Endpoint::Receive(const uint8_t* data,
 SendStatelessReset(
  PathDescriptor{
  pversion_cid.version, dcid, scid, addr, remote_address},
- len);
+ len,
+ now);
 return;
  }
 
@@ -1884,13 +1908,14 @@ void Endpoint::MemoryInfo(MemoryTracker* tracker) const {
 // Endpoint::SocketAddressInfoTraits
 
 boolEndpoint::SocketAddressInfoTraits::CheckExpired(
-const SocketAddress& address, const Type& type) {
-return (uv_hrtime() - type.timestamp) > kSocketAddressInfoTimeout;
+const SocketAddress& address, const Type& type, uint64_t now) {
+return (now - type.timestamp) > kSocketAddressInfoTimeout;
 }
 
 voidEndpoint::SocketAddressInfoTraits::Touch(const SocketAddress& address,
- Type* type) {
- type->timestamp = uv_hrtime();
+ Type* type,
+uint64_t now) {
+ type->timestamp = now;
 }
 
 // ======================================================================================