Repository navigation
Keep server TLS handshakes off the accept loop - #618
Merged
Merged
Conversation
An idle TCP peer must not occupy the server's only accept loop while TLS waits for a ClientHello. Move TLS acceptance to tracked connection workers for Network.framework and BSD-backed servers, with a ten-second deadline and cancellation during shutdown. Keep the stop flag set until the workers have exited, and include pending workers in the connection limit. Add cancellable accept overloads while keeping the existing entry point. OpenSSL and mbedTLS poll for socket readiness instead of spinning while a handshake needs more I/O. Failed handshakes release their socket through its owner and notify the connection thread collector. Test concurrent acceptance, shutdown cancellation, limits, slot recovery and timeout with all three TLS server backends. Share test credential generation, include the regressions in the native make target, and fix the OpenSSL TSAN target's misspelled backend flag so it actually tests OpenSSL.
Build with C++11 and deprecated API errors, verify the native backend and absence of OpenSSL linkage, then run the full test suite. Return success from ws --version so backend verification can check the command result.
The TLS backend can close its socket before the connection worker reports the timeout. Synchronize the test with that notification instead of sampling a counter immediately after EOF. Print failing test output in the OpenSSL TSAN target.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
An idle TCP peer currently holds the server's only accept loop while TLS waits for its ClientHello. Other clients cannot finish connecting until that peer disconnects or the native backend's handshake times out.
Run TLS handshakes in tracked connection workers for Network.framework, OpenSSL and mbedTLS. Give server handshakes a 10-second deadline, cancel them during shutdown, and count pending workers toward the connection limit. Keep the stop flag set until those workers have exited. OpenSSL and mbedTLS wait for socket readiness instead of spinning when TLS needs more I/O.
Preserve the existing one-argument socket accept API and add a cancellable overload. Share the worker lifecycle between native and BSD-backed listeners, including socket cleanup and termination notification on handshake failure.
Add a dedicated
mac_network_frameworkCI check using the same simple workflow layout as Linux. It callsmake -f makefile.dev test_network_framework, which:Correct the macOS OpenSSL TSAN make target's misspelled backend flag so that job actually tests OpenSSL. Make
ws --versionreturn success so CI can verify its output normally.Validation:
git diff --checkpassed.