get-convex / smokescreen / 30508961051

54%

master: 54%

Pull #2

github

Bound blackholed upstream connections with TCP_USER_TIMEOUT

An upstream that stops acknowledging otherwise holds its CONNECT tunnel
for tcp_retries2's ~16 minutes, and clients keep reusing it. Defaults to
30s, overridable with --upstream-tcp-user-timeout.

Tested at the 30s default with iptables blackholes over a CONNECT tunnel.
An unreachable peer is dropped after ~30s whether data is in flight, the
receive window is closed, the SYN goes unanswered, or nothing is in flight
at all. A reachable peer acknowledges at the TCP layer well before its
application replies, so a response that takes 45s still arrives. A peer
whose TCP stack answers while its application is gone stays undetected and
needs an app-layer probe, which we're doing with HTTP2 keepalives in the
Rust clients.

13 of 23 new or added lines in 3 files covered. (56.52%)

1460 of 2685 relevant lines covered (54.38%)

37.4 hits per line