moonchen commented on code in PR #13737:
URL: https://github.com/apache/trafficserver/pull/13737#discussion_r4339824809
##########
src/iocore/net/UnixNetAccept.cc:
##########
@@ -77,6 +72,19 @@ handle_max_client_connections(IpEndpoint const &addr,
std::shared_ptr<Connection
return true;
}
+/// Count an accepted client connection, and whether it is from the client
exempt list.
+void
+count_client_connection(UnixNetVConnection *vc, bool exempt)
+{
+ Metrics::Gauge::increment(net_rsb.connections_currently_open);
+ vc->set_client_exempt(exempt);
+ if (exempt) {
+ Metrics::Counter::increment(net_rsb.per_client_connections_exempt_in);
+
Metrics::Gauge::increment(net_rsb.per_client_connections_exempt_currently_open);
+ Dbg(dbg_ctl_iocore_net_accepts, "Accepted a client connection from an
address in the exempt list.");
Review Comment:
Both are defined: `dbg_ctl_iocore_net_accepts` at line 41 and
`dbg_ctl_iocore_net_accept` at line 42. This line keeps `iocore_net_accepts`,
which the master line it replaces used, as does the per-client limit message
above it.
##########
doc/admin-guide/monitoring/statistics/core/network-io.en.rst:
##########
@@ -52,6 +52,23 @@ Network I/O
.. ts:stat:: global proxy.process.net.connections_currently_open integer
:type: counter
+ The number of open client and origin server connections, which
+ :ts:cv:`proxy.config.net.connections_throttle` limits.
Review Comment:
Fixed in 3cce0c23d2: `connections_currently_open` is created with
`Metrics::Gauge`, so it is now documented as a gauge.
##########
tests/uranium_tests/client_connection/throttle_client.py:
##########
@@ -0,0 +1,159 @@
+"""Client connections for test_connections_throttle_exempt.py."""
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from collections.abc import Callable
+import socket
+import ssl
+import time
+
+TIMEOUT = 10.0
+POLL_INTERVAL = 0.1
+
+
+def proxy_header(source: str, port: int) -> bytes:
+ """Return a PROXY protocol v1 header that claims the connection comes from
@a source.
+
+ :param source: The claimed source address.
+ :param port: The destination port.
+ """
+
+ if ":" in source:
+ return f"PROXY TCP6 {source} ::1 40000 {port}\r\n".encode()
+ return f"PROXY TCP4 {source} 127.0.0.1 40000 {port}\r\n".encode()
+
+
+def connect(host: str, port: int, tls: bool = False, proxy_source: str = "")
-> socket.socket:
+ """Open a connection to @a host, an IPv4 or IPv6 address.
+
+ :param tls: Use TLS.
+ :param proxy_source: Start with a PROXY protocol header that claims this
source address.
+ """
+
+ sock = socket.create_connection((host, port), timeout=TIMEOUT)
+ if proxy_source:
+ sock.sendall(proxy_header(proxy_source, port))
+ if tls:
+ context = ssl.create_default_context()
+ context.check_hostname = False
+ context.verify_mode = ssl.CERT_NONE
+ sock = context.wrap_socket(sock, server_hostname="healthcheck")
+ return sock
+
+
+def exchange(sock: socket.socket, close: bool) -> str:
+ """Send a health check request on @a sock and return the response status
line.
+
+ :param close: Ask the proxy to close the connection after the response.
+ :return: The status line, or an empty string if the proxy closed the
connection first.
+ """
+
+ request = b"GET / HTTP/1.1\r\nHost: healthcheck\r\n"
+ if close:
+ request += b"Connection: close\r\n"
+ try:
+ sock.sendall(request + b"\r\n")
+ response = b""
+ while b"\r\n\r\n" not in response:
+ data = sock.recv(4096)
+ if not data:
+ return ""
+ response += data
+ except (ConnectionResetError, BrokenPipeError, ssl.SSLError):
+ return ""
Review Comment:
A timeout here means the proxy neither answered nor closed the connection
within 10 seconds. That is a failure of the behavior under test, so the
exception should fail the test. Returning an empty status would let a hung
connection pass a `refused` check.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
