1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242
use mio::net::TcpListener;
use mio::{Events, Interest, Poll, Token, Waker};
use std::io::ErrorKind;
use std::net::{SocketAddr, TcpStream};
use std::time::Duration;
use tracing::{info, warn};
use crate::error::BootstrapError;
use crate::tools::mio_stream_to_std;
const NEW_CONNECTION: Token = Token(0);
const STOP_LISTENER: Token = Token(10);
/// Maximum number of connections accepted in a single `poll` cycle.
///
/// Draining the whole pending backlog at once would let a connection flood move
/// the entire listen queue (1024 entries) into process-owned file descriptors
/// before the server has had any chance to apply admission control, and would
/// hand the server a batch of that size to refuse in one go. Accepting in
/// bounded batches keeps the burst small; the remainder stays in the kernel
/// backlog and is picked up by the following cycles.
const MAX_ACCEPTS_PER_POLL: usize = 32;
/// TODO: this should be crate-private. currently needed for models testing
pub struct BootstrapTcpListener {
poll: Poll,
events: Events,
server: TcpListener,
/// Set when the last drain stopped at [`MAX_ACCEPTS_PER_POLL`]. The mio
/// registration is edge-triggered, so a backlog left behind does not
/// re-arm readiness on its own: the next `poll` has to look for it instead
/// of blocking.
backlog_pending: bool,
}
pub struct BootstrapListenerStopHandle(pub(crate) Waker);
/// Drain at most `max` currently-ready connections from `accept` into `out`.
///
/// The drain ends on the first error, whether it is `WouldBlock` (no more
/// pending connections) or any other error such as a persistent `EMFILE` /
/// `ENFILE`. Ending the drain on a non-`WouldBlock` error (instead of
/// `continue`-ing) is what prevents a sticky listener-level failure from
/// spinning `poll()` forever and starving the `STOP_LISTENER` token.
///
/// Returns `true` if the drain stopped because `max` was reached, meaning the
/// backlog may still hold connections that the caller has to come back for.
fn drain_accept<S>(
mut accept: impl FnMut() -> std::io::Result<S>,
out: &mut Vec<S>,
max: usize,
) -> bool {
for _ in 0..max {
match accept() {
Ok(item) => out.push(item),
Err(ref e) if e.kind() == ErrorKind::WouldBlock => return false,
Err(e) => {
warn!("Error accepting connection in bootstrap: {:?}", e);
return false;
}
}
}
true
}
pub enum PollEvent {
NewConnections(Vec<(TcpStream, SocketAddr)>),
Stop,
}
#[cfg_attr(test, mockall::automock)]
impl BootstrapTcpListener {
/// Setup a mio-listener that functions as a `select!` on a connection, or a waker
///
/// * `addr` - the address to listen on
pub fn create(
addr: &SocketAddr,
) -> Result<(BootstrapListenerStopHandle, Self), BootstrapError> {
let domain = if addr.is_ipv4() {
socket2::Domain::IPV4
} else {
socket2::Domain::IPV6
};
let socket = socket2::Socket::new(domain, socket2::Type::STREAM, None)?;
if addr.is_ipv6() {
socket.set_only_v6(false)?;
}
// This is needed for the mio-polling system, which depends on the socket being non-blocking.
// If we don't set non-blocking, then we can .accept() on the server below, which is needed to ensure the polling triggers every time.
socket.set_nonblocking(true)?;
socket.bind(&(*addr).into())?;
// Number of connections to queue, set to the hardcoded value used by tokio
socket.listen(1024)?;
info!("Starting bootstrap listener on {}", &addr);
let mut server = TcpListener::from_std(socket.into());
let poll = Poll::new()?;
// wake up the poll when we want to stop the listener
let waker = BootstrapListenerStopHandle(Waker::new(poll.registry(), STOP_LISTENER)?);
poll.registry()
.register(&mut server, NEW_CONNECTION, Interest::READABLE)?;
// TODO use config for capacity ?
let events = Events::with_capacity(128);
Ok((
waker,
BootstrapTcpListener {
poll,
server,
events,
backlog_pending: false,
},
))
}
/// Poll the listener for new connections
///
/// At most [`MAX_ACCEPTS_PER_POLL`] connections are returned per call, so
/// that the caller gets to apply admission control before the rest of the
/// backlog is pulled into the process.
pub fn poll(&mut self) -> Result<PollEvent, BootstrapError> {
// Only block when the backlog is known to be empty: a backlog left over
// from the previous cycle would otherwise wait for an unrelated
// readiness event before being served.
let timeout = if self.backlog_pending {
Some(Duration::ZERO)
} else {
None
};
self.poll.poll(&mut self.events, timeout).unwrap();
let mut accept_ready = self.backlog_pending;
for event in self.events.iter() {
match event.token() {
NEW_CONNECTION => accept_ready = true,
STOP_LISTENER => {
return Ok(PollEvent::Stop);
}
_ => unreachable!(),
}
}
if !accept_ready {
return Ok(PollEvent::NewConnections(Vec::new()));
}
// Drain the ready connections, borrowing only `self.server`, then
// post-process them (which borrows `self.poll`). The drain never spins
// on a persistent accept error, so control always returns to the poller
// and the STOP token can be serviced.
let mut accepted = Vec::with_capacity(MAX_ACCEPTS_PER_POLL);
self.backlog_pending =
drain_accept(|| self.server.accept(), &mut accepted, MAX_ACCEPTS_PER_POLL);
let mut results = Vec::with_capacity(accepted.len());
for (mut stream, remote_addr) in accepted {
let _ = self.poll.registry().deregister(&mut stream);
let stream: std::net::TcpStream = mio_stream_to_std(stream);
stream.set_nonblocking(false)?;
results.push((stream, remote_addr));
}
Ok(PollEvent::NewConnections(results))
}
}
impl BootstrapListenerStopHandle {
/// Stop the bootstrap listener.
pub fn stop(&self) -> Result<(), BootstrapError> {
self.0.wake().map_err(BootstrapError::from)
}
}
#[cfg(test)]
mod tests {
use super::{drain_accept, MAX_ACCEPTS_PER_POLL};
use std::io::{Error, ErrorKind};
#[test]
fn drain_stops_on_persistent_error_instead_of_spinning() {
let mut calls = 0u32;
let mut out: Vec<u8> = Vec::new();
let capped = drain_accept(
|| {
calls += 1;
// A persistent non-WouldBlock error (e.g. EMFILE/ENFILE).
Err::<u8, _>(Error::from(ErrorKind::Other))
},
&mut out,
MAX_ACCEPTS_PER_POLL,
);
assert_eq!(
calls, 1,
"a persistent accept error must break the drain, not loop forever"
);
assert!(out.is_empty());
assert!(!capped, "an errored drain leaves no known backlog");
}
#[test]
fn drain_collects_ready_connections_until_would_block() {
let mut seq = vec![
Ok(1u8),
Ok(2u8),
Err(Error::from(ErrorKind::WouldBlock)),
Ok(3u8),
]
.into_iter();
let mut out = Vec::new();
let capped = drain_accept(|| seq.next().unwrap(), &mut out, MAX_ACCEPTS_PER_POLL);
// Stops at the WouldBlock, leaving the trailing item untouched.
assert_eq!(out, vec![1, 2]);
assert!(!capped, "a drained backlog must not be reported as pending");
}
#[test]
fn drain_stops_at_the_batch_limit() {
// An endless supply of pending connections, as a backlog flood would.
let mut accepted = 0usize;
let mut out = Vec::new();
let capped = drain_accept(
|| {
accepted += 1;
Ok::<u8, Error>(0)
},
&mut out,
MAX_ACCEPTS_PER_POLL,
);
assert_eq!(out.len(), MAX_ACCEPTS_PER_POLL);
assert_eq!(
accepted, MAX_ACCEPTS_PER_POLL,
"the drain must not accept beyond the batch limit"
);
assert!(capped, "a capped drain must report the remaining backlog");
}
}