GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — quic: add block list support for endpoints · nodejs/node@e493f04

File tree

Expand file treeCollapse file tree
Open diff view settings
Filter options
  • doc/api
    • quic.md
  • lib/internal
    • blocklist.js
    • quic
      • quic.js
      • stats.js
  • src
    • node_sockaddr.cc
    • node_sockaddr.h
    • quic
      • bindingdata.h
      • endpoint.cc
      • endpoint.h
      • tlscontext.cc
  • test
    • cctest
      • test_sockaddr.cc
    • parallel
      • test-quic-blocklist.mjs
      • test-quic-internal-endpoint-options.mjs
      • test-quic-internal-endpoint-stats-state.mjs
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎doc/api/quic.md‎

Copy file name to clipboardExpand all lines: doc/api/quic.md
+80Lines changed: 80 additions & 0 deletions
  • Display the source diff
  • Display the rich diff
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,50 @@ object. Each rate limiter has a corresponding counter
189189
were dropped. A non-zero value indicates the rate limiter is actively
190190
protecting the endpoint.
191191

192+
#### Block lists
193+
194+
Endpoints can filter incoming packets by source address using a
195+
[`net.BlockList`][]. The block list is checked before any QUIC processing
196+
occurs, so blocked packets consume no resources beyond the check itself.
197+
198+
In **deny** mode (the default), packets from addresses in the list are dropped:
199+
200+
```mjs
201+
import { BlockList } from 'node:net';
202+
import { listen } from 'node:quic';
203+
204+
const blocked = new BlockList();
205+
blocked.addSubnet('192.168.1.0', 24); // Block an entire subnet
206+
blocked.addAddress('10.0.0.5'); // Block a specific address
207+
208+
const endpoint = await listen(onSession, {
209+
endpoint: {
210+
blockList: blocked,
211+
blockListPolicy: 'deny',
212+
},
213+
// ...
214+
});
215+
```
216+
217+
In **allow** mode, only packets from addresses in the list are accepted:
218+
219+
```mjs
220+
const trusted = new BlockList();
221+
trusted.addSubnet('10.0.0.0', 8);
222+
223+
const endpoint = await listen(onSession, {
224+
endpoint: {
225+
blockList: trusted,
226+
blockListPolicy: 'allow',
227+
},
228+
// ...
229+
});
230+
```
231+
232+
The block list is evaluated live — rules added or removed after the endpoint
233+
is created take effect immediately. The `endpoint.stats.packetsBlocked`
234+
counter tracks how many packets have been dropped by the filter.
235+
192236
### Applications
193237

194238
Every `QuicSession` is associated with a single application protocol, negotiated
@@ -831,6 +875,11 @@ added: v23.8.0
831875
per-host rate limiter. Read only. A non-zero value indicates one or more
832876
remote addresses are creating sessions faster than the configured rate allows.
833877

878+
### `endpointStats.packetsBlocked`
879+
880+
* Type: {bigint} The total number of incoming packets dropped by the
881+
block list filter. Read only.
882+
834883
## Class: `QuicSession`
835884

836885
<!-- YAML
@@ -2429,6 +2478,34 @@ added: v23.8.0
24292478

24302479
If not specified the endpoint will bind to IPv4 `localhost` on a random port.
24312480

2481+
#### `endpointOptions.blockList`
2482+
2483+
* Type: {net.BlockList}
2484+
2485+
An optional [`net.BlockList`][] instance for filtering incoming packets by
2486+
source address. When configured, every received UDP packet is checked against
2487+
the block list before any QUIC processing occurs, minimizing resource
2488+
expenditure on blocked sources. The block list is evaluated live — rules
2489+
added to the `BlockList` object after the endpoint is created take effect
2490+
immediately.
2491+
2492+
See [`endpointOptions.blockListPolicy`][] for how matches are interpreted.
2493+
2494+
#### `endpointOptions.blockListPolicy`
2495+
2496+
* Type: {string} One of `'deny'` or `'allow'`.
2497+
* **Default:** `'deny'`
2498+
2499+
Controls how the [`endpointOptions.blockList`][] is interpreted:
2500+
2501+
* `'deny'` — Packets from addresses matching the block list are dropped.
2502+
All other addresses are accepted. This is the typical blocklist mode.
2503+
* `'allow'` — Only packets from addresses matching the block list are
2504+
accepted. All other addresses are dropped. This is an allowlist mode
2505+
for restricting access to known clients.
2506+
2507+
If no block list is configured, this option has no effect.
2508+
24322509
#### `endpointOptions.addressLRUSize`
24332510

24342511
<!-- YAML
@@ -4275,6 +4352,8 @@ throughput issues caused by flow control.
42754352
[`endpoint.busy`]: #endpointbusy
42764353
[`endpoint.maxConnectionsPerHost`]: #endpointmaxconnectionsperhost
42774354
[`endpoint.maxConnectionsTotal`]: #endpointmaxconnectionstotal
4355+
[`endpointOptions.blockListPolicy`]: #endpointoptionsblocklistpolicy
4356+
[`endpointOptions.blockList`]: #endpointoptionsblocklist
42784357
[`endpointOptions.immediateCloseBurst`]: #endpointoptionsimmediatecloseburst
42794358
[`endpointOptions.immediateCloseRate`]: #endpointoptionsimmediatecloserate
42804359
[`endpointOptions.retryBurst`]: #endpointoptionsretryburst
@@ -4288,6 +4367,7 @@ throughput issues caused by flow control.
42884367
[`error.errorCode`]: #errorerrorcode
42894368
[`fs.promises.open(path, 'r')`]: fs.md#fspromisesopenpath-flags-mode
42904369
[`maxDatagramFrameSize`]: #transportparamsmaxdatagramframesize
4370+
[`net.BlockList`]: net.md#class-netblocklist
42914371
[`quic.connect()`]: #quicconnectaddress-options
42924372
[`quic.listen()`]: #quiclistenonsession-options
42934373
[`session.close()`]: #sessioncloseoptions
Collapse file

‎lib/internal/blocklist.js‎

Copy file name to clipboardExpand all lines: lib/internal/blocklist.js
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -298,4 +298,5 @@ ObjectSetPrototypeOf(InternalBlockList.prototype, BlockList.prototype);
298298
module.exports = {
299299
BlockList,
300300
InternalBlockList,
301+
kHandle,
301302
};
Collapse file

‎lib/internal/quic/quic.js‎

Copy file name to clipboardExpand all lines: lib/internal/quic/quic.js
+21Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,10 @@ if (!process.features.quic || !getOptionValue('--experimental-quic')) {
3636
}
3737

3838
const { inspect } = require('internal/util/inspect');
39+
const {
40+
BlockList,
41+
kHandle: kBlockListHandle,
42+
} = require('internal/blocklist');
3943

4044
let debug = require('internal/util/debuglog').debuglog('quic', (fn) => {
4145
debug = fn;
@@ -318,6 +322,8 @@ const endpointRegistry = new SafeSet();
318322
* @property {number} [immediateCloseBurst] Burst capacity for immediate close rate limiter
319323
* @property {number} [sessionCreationRate] Per-host rate limit for session creation (per second)
320324
* @property {number} [sessionCreationBurst] Per-host burst capacity for session creation rate limiter
325+
* @property {net.BlockList} [blockList] Block list for filtering incoming packets by source address
326+
* @property {'deny'|'allow'} [blockListPolicy='deny'] How to interpret the block list
321327
* @property {ArrayBufferView} [resetTokenSecret] The reset token secret
322328
* @property {bigint|number} [retryTokenExpiration] The retry token expiration
323329
* @property {number} [rxDiagnosticLoss] The receive diagnostic loss probability (range 0.0-1.0)
@@ -4048,6 +4054,8 @@ class QuicEndpoint {
40484054
immediateCloseBurst,
40494055
sessionCreationRate,
40504056
sessionCreationBurst,
4057+
blockList,
4058+
blockListPolicy = 'deny',
40514059
rxDiagnosticLoss,
40524060
txDiagnosticLoss,
40534061
udpReceiveBufferSize,
@@ -4062,6 +4070,16 @@ class QuicEndpoint {
40624070
tokenSecret,
40634071
} = options;
40644072

4073+
if (blockList !== undefined) {
4074+
if (!BlockList.isBlockList(blockList)) {
4075+
throw new ERR_INVALID_ARG_TYPE('options.blockList',
4076+
'net.BlockList', blockList);
4077+
}
4078+
}
4079+
4080+
validateOneOf(blockListPolicy, 'options.blockListPolicy',
4081+
['deny', 'allow']);
4082+
40654083
// All of the other options will be validated internally by the C++ code
40664084
if (address !== undefined && !SocketAddress.isSocketAddress(address)) {
40674085
if (typeof address === 'string') {
@@ -4093,6 +4111,9 @@ class QuicEndpoint {
40934111
immediateCloseBurst,
40944112
sessionCreationRate,
40954113
sessionCreationBurst,
4114+
// Pass the C++ handle, not the JS BlockList wrapper.
4115+
blockList: blockList?.[kBlockListHandle],
4116+
blockListPolicy,
40964117
rxDiagnosticLoss,
40974118
txDiagnosticLoss,
40984119
udpReceiveBufferSize,
Collapse file

‎lib/internal/quic/stats.js‎

Copy file name to clipboardExpand all lines: lib/internal/quic/stats.js
+12Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ const {
6868
IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT,
6969
IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED,
7070
IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED,
71+
IDX_STATS_ENDPOINT_PACKETS_BLOCKED,
7172

7273
IDX_STATS_SESSION_CREATED_AT,
7374
IDX_STATS_SESSION_DESTROYED_AT,
@@ -136,6 +137,7 @@ assert(IDX_STATS_ENDPOINT_STATELESS_RESET_RATE_LIMITED !== undefined);
136137
assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_COUNT !== undefined);
137138
assert(IDX_STATS_ENDPOINT_IMMEDIATE_CLOSE_RATE_LIMITED !== undefined);
138139
assert(IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED !== undefined);
140+
assert(IDX_STATS_ENDPOINT_PACKETS_BLOCKED !== undefined);
139141
assert(IDX_STATS_SESSION_CREATED_AT !== undefined);
140142
assert(IDX_STATS_SESSION_DESTROYED_AT !== undefined);
141143
assert(IDX_STATS_SESSION_CLOSING_AT !== undefined);
@@ -338,6 +340,12 @@ class QuicEndpointStats {
338340
return this.#handle[IDX_STATS_ENDPOINT_SESSION_CREATION_RATE_LIMITED];
339341
}
340342

343+
/** @type {bigint} */
344+
get packetsBlocked() {
345+
assertIsQuicEndpointStats(this);
346+
return this.#handle[IDX_STATS_ENDPOINT_PACKETS_BLOCKED];
347+
}
348+
341349
toString() {
342350
return JSONStringify(this.toJSON());
343351
}
@@ -363,6 +371,7 @@ class QuicEndpointStats {
363371
immediateCloseCount,
364372
immediateCloseRateLimited,
365373
sessionCreationRateLimited,
374+
packetsBlocked,
366375
} = this;
367376
return {
368377
__proto__: null,
@@ -387,6 +396,7 @@ class QuicEndpointStats {
387396
immediateCloseCount: `${immediateCloseCount}`,
388397
immediateCloseRateLimited: `${immediateCloseRateLimited}`,
389398
sessionCreationRateLimited: `${sessionCreationRateLimited}`,
399+
packetsBlocked: `${packetsBlocked}`,
390400
};
391401
}
392402

@@ -421,6 +431,7 @@ class QuicEndpointStats {
421431
immediateCloseCount,
422432
immediateCloseRateLimited,
423433
sessionCreationRateLimited,
434+
packetsBlocked,
424435
} = this;
425436

426437
return `QuicEndpointStats ${inspect({
@@ -443,6 +454,7 @@ class QuicEndpointStats {
443454
immediateCloseCount,
444455
immediateCloseRateLimited,
445456
sessionCreationRateLimited,
457+
packetsBlocked,
446458
}, opts)}`;
447459
}
448460

Collapse file

‎src/node_sockaddr.cc‎

Copy file name to clipboardExpand all lines: src/node_sockaddr.cc
+8-9Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -434,8 +434,7 @@ void SocketAddressBlockList::AddSocketAddressMask(
434434
rules_.emplace_front(std::move(rule));
435435
}
436436

437-
bool SocketAddressBlockList::Apply(
438-
const std::shared_ptr<SocketAddress>& address) {
437+
bool SocketAddressBlockList::Apply(const SocketAddress& address) {
439438
Mutex::ScopedLock lock(mutex_);
440439
for (const auto& rule : rules_) {
441440
if (rule->Apply(address)) return true;
@@ -457,8 +456,8 @@ SocketAddressBlockList::SocketAddressMaskRule::SocketAddressMaskRule(
457456
: network(network_), prefix(prefix_) {}
458457

459458
bool SocketAddressBlockList::SocketAddressRule::Apply(
460-
const std::shared_ptr<SocketAddress>& address) {
461-
return this->address->is_match(*address.get());
459+
const SocketAddress& address) {
460+
return this->address->is_match(address);
462461
}
463462

464463
std::string SocketAddressBlockList::SocketAddressRule::ToString() {
@@ -470,8 +469,8 @@ std::string SocketAddressBlockList::SocketAddressRule::ToString() {
470469
}
471470

472471
bool SocketAddressBlockList::SocketAddressRangeRule::Apply(
473-
const std::shared_ptr<SocketAddress>& address) {
474-
return *address.get() >= *start.get() && *address.get() <= *end.get();
472+
const SocketAddress& address) {
473+
return address >= *start.get() && address <= *end.get();
475474
}
476475

477476
std::string SocketAddressBlockList::SocketAddressRangeRule::ToString() {
@@ -485,8 +484,8 @@ std::string SocketAddressBlockList::SocketAddressRangeRule::ToString() {
485484
}
486485

487486
bool SocketAddressBlockList::SocketAddressMaskRule::Apply(
488-
const std::shared_ptr<SocketAddress>& address) {
489-
return address->is_in_network(*network.get(), prefix);
487+
const SocketAddress& address) {
488+
return address.is_in_network(*network.get(), prefix);
490489
}
491490

492491
std::string SocketAddressBlockList::SocketAddressMaskRule::ToString() {
@@ -656,7 +655,7 @@ void SocketAddressBlockListWrap::Check(
656655
SocketAddressBase* addr;
657656
ASSIGN_OR_RETURN_UNWRAP(&addr, args[0]);
658657

659-
args.GetReturnValue().Set(wrap->blocklist_->Apply(addr->address()));
658+
args.GetReturnValue().Set(wrap->blocklist_->Apply(*addr->address()));
660659
}
661660

662661
void SocketAddressBlockListWrap::GetRules(
Collapse file

‎src/node_sockaddr.h‎

Copy file name to clipboardExpand all lines: src/node_sockaddr.h
+9-5Lines changed: 9 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -258,14 +258,14 @@ class SocketAddressBlockList : public MemoryRetainer {
258258
void AddSocketAddressMask(const std::shared_ptr<SocketAddress>& address,
259259
int prefix);
260260

261-
bool Apply(const std::shared_ptr<SocketAddress>& address);
261+
bool Apply(const SocketAddress& address);
262262

263263
size_t size() const { return rules_.size(); }
264264

265265
v8::MaybeLocal<v8::Array> ListRules(Environment* env);
266266

267267
struct Rule : public MemoryRetainer {
268-
virtual bool Apply(const std::shared_ptr<SocketAddress>& address) = 0;
268+
virtual bool Apply(const SocketAddress& address) = 0;
269269
inline v8::MaybeLocal<v8::Value> ToV8String(Environment* env);
270270
virtual std::string ToString() = 0;
271271
};
@@ -275,7 +275,7 @@ class SocketAddressBlockList : public MemoryRetainer {
275275

276276
explicit SocketAddressRule(const std::shared_ptr<SocketAddress>& address);
277277

278-
bool Apply(const std::shared_ptr<SocketAddress>& address) override;
278+
bool Apply(const SocketAddress& address) override;
279279
std::string ToString() override;
280280

281281
void MemoryInfo(node::MemoryTracker* tracker) const override;
@@ -290,7 +290,7 @@ class SocketAddressBlockList : public MemoryRetainer {
290290
SocketAddressRangeRule(const std::shared_ptr<SocketAddress>& start,
291291
const std::shared_ptr<SocketAddress>& end);
292292

293-
bool Apply(const std::shared_ptr<SocketAddress>& address) override;
293+
bool Apply(const SocketAddress& address) override;
294294
std::string ToString() override;
295295

296296
void MemoryInfo(node::MemoryTracker* tracker) const override;
@@ -305,7 +305,7 @@ class SocketAddressBlockList : public MemoryRetainer {
305305
SocketAddressMaskRule(const std::shared_ptr<SocketAddress>& address,
306306
int prefix);
307307

308-
bool Apply(const std::shared_ptr<SocketAddress>& address) override;
308+
bool Apply(const SocketAddress& address) override;
309309
std::string ToString() override;
310310

311311
void MemoryInfo(node::MemoryTracker* tracker) const override;
@@ -353,6 +353,10 @@ class SocketAddressBlockListWrap : public BaseObject {
353353
std::shared_ptr<SocketAddressBlockList> blocklist =
354354
std::make_shared<SocketAddressBlockList>());
355355

356+
inline const std::shared_ptr<SocketAddressBlockList>& blocklist() const {
357+
return blocklist_;
358+
}
359+
356360
void MemoryInfo(node::MemoryTracker* tracker) const override;
357361
SET_MEMORY_INFO_NAME(SocketAddressBlockListWrap)
358362
SET_SELF_SIZE(SocketAddressBlockListWrap)
Collapse file

‎src/quic/bindingdata.h‎

Copy file name to clipboardExpand all lines: src/quic/bindingdata.h
+4Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ class SessionManager;
7070
V(ack_delay_exponent, "ackDelayExponent") \
7171
V(active_connection_id_limit, "activeConnectionIDLimit") \
7272
V(address_lru_size, "addressLRUSize") \
73+
V(allow, "allow") \
7374
V(application, "application") \
7475
V(authoritative, "authoritative") \
7576
V(bbr, "bbr") \
@@ -81,6 +82,7 @@ class SessionManager;
8182
V(crl, "crl") \
8283
V(cubic, "cubic") \
8384
V(datagram_drop_policy, "datagramDropPolicy") \
85+
V(deny, "deny") \
8486
V(disable_stateless_reset, "disableStatelessReset") \
8587
V(draining_period_multiplier, "drainingPeriodMultiplier") \
8688
V(enable_connect_protocol, "enableConnectProtocol") \
@@ -127,6 +129,8 @@ class SessionManager;
127129
V(immediate_close_burst, "immediateCloseBurst") \
128130
V(session_creation_rate, "sessionCreationRate") \
129131
V(session_creation_burst, "sessionCreationBurst") \
132+
V(block_list, "blockList") \
133+
V(block_list_policy, "blockListPolicy") \
130134
V(max_stream_window, "maxStreamWindow") \
131135
V(max_window, "maxWindow") \
132136
V(min_version, "minVersion") \

0 commit comments

Comments
0 (0)
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.