Skip to content

fix(http): reap idle TCP tunnels to bound goroutine and fd growth #405

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Okdusty wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(http): reap idle TCP tunnels to bound goroutine and fd growth #405

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions internal/netutil/conn.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,6 +232,14 @@ func (b *BufferedConn) Peek(n int) ([]byte, error) {
return b.r.Peek(n)
}

// DefaultTunnelIdleTimeout bounds how long an established TCP tunnel may sit with
// no traffic in either direction before it is torn down. Without it, a half-dead
// connection (peer gone with no FIN/RST — common behind NAT/flaky links) keeps its
// two copy goroutines and two fds alive forever, so they accumulate over long
// uptime and drive CPU up. Activity in either direction resets the timer, so this
// only reaps genuinely-silent tunnels. Mirrors the existing UDPIdleTimeout.
const DefaultTunnelIdleTimeout = 300 * time.Second

// IdleTimeoutConn wraps a net.Conn to extend the deadline on every Read/Write call.
// This is useful for sessions which should stay alive as long as there is activity.
type IdleTimeoutConn struct {
Expand Down
9 changes: 7 additions & 2 deletions internal/server/http/handler_http.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,9 +56,14 @@ func (h *HTTPHandler) HandleRequest(
ctx, cancel := context.WithCancel(ctx)
defer cancel()

// See handler_https.go: bound the tunnel so a half-dead peer can't leak its
// copy goroutines and fds forever. Activity in either direction resets it.
lIdle := netutil.NewIdleTimeoutConn(lConn, netutil.DefaultTunnelIdleTimeout)
rIdle := netutil.NewIdleTimeoutConn(rConn, netutil.DefaultTunnelIdleTimeout)

startedAt := time.Now()
go netutil.TunnelConns(ctx, resCh, lConn, rConn, netutil.TunnelDirOut)
go netutil.TunnelConns(ctx, resCh, rConn, lConn, netutil.TunnelDirIn)
go netutil.TunnelConns(ctx, resCh, lIdle, rIdle, netutil.TunnelDirOut)
go netutil.TunnelConns(ctx, resCh, rIdle, lIdle, netutil.TunnelDirIn)

return netutil.WaitForTunnelCompletion(
ctx,
Expand Down
11 changes: 9 additions & 2 deletions internal/server/http/handler_https.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,9 +102,16 @@ func (h *HTTPSHandler) HandleRequest(
ctx, cancel := context.WithCancel(ctx)
defer cancel()

// Bound the established tunnel: a half-dead peer (gone with no FIN/RST) would
// otherwise leak both copy goroutines and both fds forever, accumulating over
// long uptime. IdleTimeoutConn resets on activity in either direction, so only
// fully-silent tunnels are reaped (the resulting timeout is treated as benign).
lIdle := netutil.NewIdleTimeoutConn(lConn, netutil.DefaultTunnelIdleTimeout)
rIdle := netutil.NewIdleTimeoutConn(rConn, netutil.DefaultTunnelIdleTimeout)

startedAt := time.Now()
go netutil.TunnelConns(ctx, resCh, lConn, rConn, netutil.TunnelDirOut)
go netutil.TunnelConns(ctx, resCh, rConn, lConn, netutil.TunnelDirIn)
go netutil.TunnelConns(ctx, resCh, lIdle, rIdle, netutil.TunnelDirOut)
go netutil.TunnelConns(ctx, resCh, rIdle, lIdle, netutil.TunnelDirIn)

handleErrs := func(errs []error) error {
if len(errs) == 0 {
Expand Down
Loading