Re: TCP connections clogging up accf_http(9) (was: ESTABLISHED sockets with no fd open? (was: generating ECONNRESET with no syscall?))

[Thor Lancelot Simon <tls%panix.com@localhost>]

On Fri, May 20, 2016 at 03:52:09AM +0200, Timo Buhrmester wrote:
> 
> Now, unless I'm missing something, the accept filter does not seem to
> have any sort of timeout mechanism - a TCP connection that has been
> opened but is otherwise seeing no traffic whatsoever will be stuck
> there until the remote end closes it.  If the remote end never closes
> it, it's stuck for good.  Once what appears to be 193 such connections
> are occupying the accept filter, establishing new connections becomes
> impossible.

The accept filter isn't really "occupied".  It has no local state and
is just called from soisconnected() when an event happens on the socket
(e.g. data is received).  Sockets just sit on so->so_q0 for the listen
socket until the accept filter lets them go.

I'm not seeing where your limit of 193 for the length of that queue
is coming from, or I would fix the issue right now.  If you see where
it is, the fix should be to dequeue the oldest filtered connection on
the listen socket (adapted from accept_filt_clear, note the extra "break"!):

        if (so->so_accf != NULL) {
                /* Pass the oldest connection waiting in the accept filter */
                for (so2 = TAILQ_FIRST(&so->so_q0); so2 != NULL; so2 = next) {
                        next = TAILQ_NEXT(so2, so_qe);
                        if (so2->so_upcall == NULL) {
                                continue;
                        }
                        so2->so_upcall = NULL;
                        so2->so_upcallarg = NULL;
                        so2->so_options &= ~SO_ACCEPTFILTER;
                        so2->so_rcv.sb_flags &= ~SB_UPCALL;
                        soisconnected(so2);
			break;
		}
	}

If anyone can see where to apply this, please let me know if it works.

Thor