quic: add handshake timeout and default connection limits

Signed-off-by: James M Snell <jasnell@gmail.com>
Assisted-by: Opencode:Opus 4.6
PR-URL: #63267
Backport-PR-URL: #64675
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>

Author: jasnell

lib/internal/quic/quic.js

@@ -3944,8 +3944,8 @@ class QuicEndpoint {
     const {
       retryTokenExpiration,
       tokenExpiration,
-      maxConnectionsPerHost = 0,
-      maxConnectionsTotal = 0,
+      maxConnectionsPerHost = 100,
+      maxConnectionsTotal = 10_000,
       maxStatelessResetsPerHost,
       disableStatelessReset,
       addressLRUSize,

src/quic/endpoint.cc

@@ -979,7 +979,8 @@ void Endpoint::SendVersionNegotiation(const PathDescriptor& options) {
   };
 
   if (exceeds_limits()) {
-    Debug(this, "Version negotiation rate limit exceeded for %s",
+    Debug(this,
+          "Version negotiation rate limit exceeded for %s",
           options.remote_address);
     return;
   }
@@ -1048,7 +1049,8 @@ void Endpoint::SendImmediateConnectionClose(const PathDescriptor& options,
   };
 
   if (exceeds_limits()) {
-    Debug(this, "Immediate connection close rate limit exceeded for %s",
+    Debug(this,
+          "Immediate connection close rate limit exceeded for %s",
           options.remote_address);
     return;
   }

src/quic/session.cc

@@ -464,7 +464,12 @@ Session::Config::Config(Environment* env,
     settings.log_printf = ngtcp2_debug_log;
   }
 
-  settings.handshake_timeout = options.handshake_timeout;
+  // The handshake_timeout option is in milliseconds; ngtcp2 expects
+  // nanoseconds (ngtcp2_duration). UINT64_MAX means no timeout.
+  settings.handshake_timeout =
+      options.handshake_timeout == UINT64_MAX
+          ? UINT64_MAX
+          : options.handshake_timeout * NGTCP2_MILLISECONDS;
   settings.max_stream_window = options.max_stream_window;
   settings.max_window = options.max_window;
   settings.ack_thresh = options.unacknowledged_packet_threshold;
@@ -3648,6 +3653,10 @@ void Session::InitPerContext(Realm* realm, Local<Object> target) {
   NODE_DEFINE_CONSTANT(target, QUIC_PROTO_MAX);
   NODE_DEFINE_CONSTANT(target, QUIC_PROTO_MIN);
 
+  static constexpr auto DEFAULT_HANDSHAKE_TIMEOUT =
+      Session::Options::DEFAULT_HANDSHAKE_TIMEOUT;
+  NODE_DEFINE_CONSTANT(target, DEFAULT_HANDSHAKE_TIMEOUT);
+
   NODE_DEFINE_STRING_CONSTANT(
       target, "DEFAULT_CIPHERS", TLSContext::DEFAULT_CIPHERS);
   NODE_DEFINE_STRING_CONSTANT(

src/quic/session.h

@@ -153,8 +153,15 @@ class Session final : public AsyncWrap, private SessionTicket::AppData::Source {
     bool qlog = false;
 
     // The amount of time (in milliseconds) that the endpoint will wait for the
-    // completion of the tls handshake.
-    uint64_t handshake_timeout = UINT64_MAX;
+    // completion of the TLS handshake. If the handshake does not complete
+    // within this time, the session is closed. This prevents a peer from
+    // holding a session open indefinitely in the handshake state, consuming
+    // server resources (ngtcp2 connection, TLS state, JS objects) without
+    // ever completing the connection. The default of 10 seconds is generous
+    // enough to accommodate slow networks with retransmissions while still
+    // bounding resource exposure. Set to UINT64_MAX to disable.
+    static constexpr uint64_t DEFAULT_HANDSHAKE_TIMEOUT = 10'000;
+    uint64_t handshake_timeout = DEFAULT_HANDSHAKE_TIMEOUT;
 
     // The keep-alive timeout in milliseconds. When set to a non-zero value,
     // ngtcp2 will automatically send PING frames to keep the connection alive

test/parallel/test-quic-connection-limits.mjs

@@ -27,9 +27,11 @@ const endpoint = new QuicEndpoint({ maxConnectionsTotal: 1 });
 
 // Verify the limits are readable and mutable.
 strictEqual(endpoint.maxConnectionsTotal, 1);
-strictEqual(endpoint.maxConnectionsPerHost, 0);
-endpoint.maxConnectionsPerHost = 100;
+// The default maxConnectionsPerHost is 100 — a non-zero default that
+// prevents a single host from exhausting server resources.
 strictEqual(endpoint.maxConnectionsPerHost, 100);
+endpoint.maxConnectionsPerHost = 50;
+strictEqual(endpoint.maxConnectionsPerHost, 50);
 endpoint.maxConnectionsPerHost = 0;
 
 let sessionCount = 0;

test/parallel/test-quic-internal-endpoint-stats-state.mjs

@@ -43,8 +43,8 @@ const {
     isListening: false,
     isClosing: false,
     isBusy: false,
-    maxConnectionsPerHost: 0,
-    maxConnectionsTotal: 0,
+    maxConnectionsPerHost: 100,
+    maxConnectionsTotal: 10_000,
     pendingCallbacks: '0',
   });