Skip to content

OF-3171: Implement basic rate limiting for new connections (C2S and S2S) #3127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
guusdk wants to merge 2 commits into
base: main
Choose a base branch
from
Open

OF-3171: Implement basic rate limiting for new connections (C2S and S2S) #3127

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
32351f8
OF-3171: Implement basic rate limiting for new connections (C2S and S2S)
guusdk Jan 22, 2026
2bdc1f8
OF-3173: Expose rate-limiting statistics via Statistics API
guusdk Feb 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
105 changes: 105 additions & 0 deletions i18n/src/main/resources/openfire_i18n.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1325,6 +1325,13 @@ system_property.ldap.override.avatar=Set to true to save avatars in the local da
system_property.xmpp.domain=The XMPP domain of this server. Do not change this property directly, instead re-run the setup process.
system_property.xmpp.xml.xml-declaration.suppress=Controls if an XML declaration is generated before a 'stream' open tag is sent.
system_property.xmpp.xml.xml-declaration.suppress-newline=Controls if a newline is added after a generated XML declaration and the 'stream' open tag.
system_property.xmpp.ratelimit.newconnections.c2s.enabled=Enables or disables rate limiting for new client-to-server (C2S) connections.
system_property.xmpp.ratelimit.newconnections.c2s.permits_per_second=The sustained rate of new client-to-server connection attempts allowed per second. This applies to all C2S types (TCP, BOSH, WebSocket) combined.
system_property.xmpp.ratelimit.newconnections.c2s.max_burst=The maximum number of new client-to-server connection attempts that can be accepted in a short burst. Helps absorb spikes without exceeding the sustained rate.
system_property.xmpp.ratelimit.newconnections.s2s.enabled=Enables or disables rate limiting for new server-to-server (S2S) connections.
system_property.xmpp.ratelimit.newconnections.s2s.permits_per_second=The sustained rate of new server-to-server connection attempts allowed per second. Applies to all S2S (federation) connection types, which currently is just TCP.
system_property.xmpp.ratelimit.newconnections.s2s.max_burst=The maximum number of new server-to-server connection attempts that can be accepted in a short burst. Allows temporary bursts without violating the sustained rate.
system_property.xmpp.ratelimit.newconnections.logging.suppress=The minimum time to suppress repeated log messages for rejected new connection attempts of the same connection type; a value of zero or less disables log suppression.
system_property.plugins.upload.enabled=Defines if the admin console can be used to upload plugins.
system_property.plugins.upload.content-type-check.enabled=Determines if the content-type of uploaded plugin files is verified.
system_property.plugins.upload.content-type-check.expected-value=Defines the expected content-type of uploaded plugin files.
Expand Down Expand Up @@ -4119,3 +4126,101 @@ commands.event.vcardmodified.note.vcard-does-not-exist=VCard not found.
commands.generic.ping.label=Request pong from server
commands.generic.ping.form.title=Server ping result (pong!)
commands.generic.ping.form.field.timestamp.label=Server Time

# Rate Limiter Stats

stat.ratelimit.newconnections.socket_c2s.accepted.name=RL: C2S Allowed (TCP)
stat.ratelimit.newconnections.socket_c2s.accepted.desc=Total number of client-to-server (TCP) connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_c2s.accepted.units=connections
stat.ratelimit.newconnections.socket_c2s.rejected.name=RL: C2S Rejected (TCP)
stat.ratelimit.newconnections.socket_c2s.rejected.desc=Total number of client-to-server (TCP) connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_c2s.rejected.units=connections
stat.ratelimit.newconnections.socket_c2s.total.name=RL: C2S Total (TCP)
stat.ratelimit.newconnections.socket_c2s.total.desc=Total number of client-to-server (TCP) connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_c2s.total.units=connections
stat.ratelimit.newconnections.socket_c2s.ratio.name=RL: C2S Ratio (TCP)
stat.ratelimit.newconnections.socket_c2s.ratio.desc=Proportion of client-to-server (TCP) connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.socket_c2s.ratio.units=%
stat.ratelimit.newconnections.socket_c2s.tokens.name=RL: C2S Tokens (TCP)
stat.ratelimit.newconnections.socket_c2s.tokens.desc=Currently available tokens in the rate limiter for client-to-server (TCP) connections.
stat.ratelimit.newconnections.socket_c2s.tokens.units=tokens

stat.ratelimit.newconnections.bosh_c2s.accepted.name=RL: C2S Allowed (web)
stat.ratelimit.newconnections.bosh_c2s.accepted.desc=Total number of client-to-server (websocket and BOSH) connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.bosh_c2s.accepted.units=connections
stat.ratelimit.newconnections.bosh_c2s.rejected.name=RL: C2S Rejected (web)
stat.ratelimit.newconnections.bosh_c2s.rejected.desc=Total number of client-to-server (websocket and BOSH) connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.bosh_c2s.rejected.units=connections
stat.ratelimit.newconnections.bosh_c2s.total.name=RL: C2S Total (web)
stat.ratelimit.newconnections.bosh_c2s.total.desc=Total number of client-to-server (websocket and BOSH) connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.bosh_c2s.total.units=connections
stat.ratelimit.newconnections.bosh_c2s.ratio.name=RL: C2S Ratio (web)
stat.ratelimit.newconnections.bosh_c2s.ratio.desc=Proportion of client-to-server (websocket and BOSH) connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.bosh_c2s.ratio.units=%
stat.ratelimit.newconnections.bosh_c2s.tokens.name=RL: C2S Tokens (web)
stat.ratelimit.newconnections.bosh_c2s.tokens.desc=Currently available tokens in the rate limiter for client-to-server (websocket and BOSH) connections.
stat.ratelimit.newconnections.bosh_c2s.tokens.units=tokens

stat.ratelimit.newconnections.socket_s2s.accepted.name=RL: S2S Allowed (TCP)
stat.ratelimit.newconnections.socket_s2s.accepted.desc=Total number of server-to-server (TCP) connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_s2s.accepted.units=connections
stat.ratelimit.newconnections.socket_s2s.rejected.name=RL: S2S Rejected (TCP)
stat.ratelimit.newconnections.socket_s2s.rejected.desc=Total number of server-to-server (TCP) connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_s2s.rejected.units=connections
stat.ratelimit.newconnections.socket_s2s.total.name=RL: S2S Total (TCP)
stat.ratelimit.newconnections.socket_s2s.total.desc=Total number of server-to-server (TCP) connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.socket_s2s.total.units=conections
stat.ratelimit.newconnections.socket_s2s.ratio.name=RL: S2S Ratio (TCP)
stat.ratelimit.newconnections.socket_s2s.ratio.desc=Proportion of server-to-server (TCP) connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.socket_s2s.ratio.units=%
stat.ratelimit.newconnections.socket_s2s.tokens.name=RL: S2S Tokens (TCP)
stat.ratelimit.newconnections.socket_s2s.tokens.desc=Currently available tokens in the rate limiter for server-to-server (TCP) connections.
stat.ratelimit.newconnections.socket_s2s.tokens.units=tokens

stat.ratelimit.newconnections.webadmin.accepted.name=RL: Webadmin Allowed
stat.ratelimit.newconnections.webadmin.accepted.desc=Total number of admin console connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.webadmin.accepted.units=connections
stat.ratelimit.newconnections.webadmin.rejected.name=RL: Webadmin Rejected
stat.ratelimit.newconnections.webadmin.rejected.desc=Total number of admin console connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.webadmin.rejected.units=connections
stat.ratelimit.newconnections.webadmin.total.name=RL: Webadmin Total
stat.ratelimit.newconnections.webadmin.total.desc=Total number of admin console connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.webadmin.total.units=conections
stat.ratelimit.newconnections.webadmin.ratio.name=RL: Webadmin Ratio
stat.ratelimit.newconnections.webadmin.ratio.desc=Proportion of admin console connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.webadmin.ratio.units=%
stat.ratelimit.newconnections.webadmin.tokens.name=RL: Webadmin Tokens
stat.ratelimit.newconnections.webadmin.tokens.desc=Currently available tokens in the rate limiter for admin console connections.
stat.ratelimit.newconnections.webadmin.tokens.units=tokens

stat.ratelimit.newconnections.component.accepted.name=RL: Component Allowed
stat.ratelimit.newconnections.component.accepted.desc=Total number of External Component connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.component.accepted.units=connections
stat.ratelimit.newconnections.component.rejected.name=RL: Component Rejected
stat.ratelimit.newconnections.component.rejected.desc=Total number of External Component connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.component.rejected.units=connections
stat.ratelimit.newconnections.component.total.name=RL: Component Total
stat.ratelimit.newconnections.component.total.desc=Total number of External Component connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.component.total.units=conections
stat.ratelimit.newconnections.component.ratio.name=RL: Component Ratio
stat.ratelimit.newconnections.component.ratio.desc=Proportion of External Component connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.component.ratio.units=%
stat.ratelimit.newconnections.component.tokens.name=RL: Component Tokens
stat.ratelimit.newconnections.component.tokens.desc=Currently available tokens in the rate limiter for External Component connections.
stat.ratelimit.newconnections.component.tokens.units=tokens

stat.ratelimit.newconnections.connection_manager.accepted.name=RL: ConnMan Allowed
stat.ratelimit.newconnections.connection_manager.accepted.desc=Total number of Connection Manager connections accepted by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.connection_manager.accepted.units=connections
stat.ratelimit.newconnections.connection_manager.rejected.name=RL: ConnMan Rejected
stat.ratelimit.newconnections.connection_manager.rejected.desc=Total number of Connection Manager connections rejected by the rate limiter. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.connection_manager.rejected.units=connections
stat.ratelimit.newconnections.connection_manager.total.name=RL: ConnMan Total
stat.ratelimit.newconnections.connection_manager.total.desc=Total number of Connection Manager connections evaluated by the rate limiter, which is the sum of all accepted and rejected connections. This is an absolute number since the last reset of the rate limiter.
stat.ratelimit.newconnections.connection_manager.total.units=conections
stat.ratelimit.newconnections.connection_manager.ratio.name=RL: ConnMan Ratio
stat.ratelimit.newconnections.connection_manager.ratio.desc=Proportion of Connection Manager connections accepted by the rate limiter relative to total connection attempts since the last reset.
stat.ratelimit.newconnections.connection_manager.ratio.units=%
stat.ratelimit.newconnections.connection_manager.tokens.name=RL: ConnMan Tokens
stat.ratelimit.newconnections.connection_manager.tokens.desc=Currently available tokens in the rate limiter for Connection Manager connections.
stat.ratelimit.newconnections.connection_manager.tokens.units=tokens
Loading
Loading