mirror of
https://github.com/tailscale/tailscale.git
synced 2026-09-13 06:19:11 -04:00
Brad Fitzpatrick
8e1fbc4740
Previously the DERP handler served each connection for its lifetime on its hijacked connection's net/http handler goroutine. That goroutine's conn.serve stack frame kept the dead HTTP/1 server state reachable for the whole DERP connection: the http.conn and its 4KB bufio.Writer (hijack hands over c.bufw but conn.serve still references it, so derpserver returning it to its flush pool never made it collectable), the 4KB bufio.Reader, the upgrade *http.Request with its parsed headers, and the request context chain. The goroutine also kept the stack growth from the TLS handshake and HTTP request parsing. Instead, hand the connection off to a new goroutine and return from the handler (ala tailscale/corp@dc09e27aef), letting all the HTTP upgrade state be collected. Give Accept a smaller 1KB frame reader, draining and releasing the hijacked reader if it contains buffered bytes from a fast-start client, and a nil bufio.Writer so writes go through pooled buffers held only for the duration of a write instead of a per-connection buffer. Because the handler now returns at handoff time, cmd/derper's gauge_derper_tls_active_version decrement can no longer be deferred to handler return: intercept Hijack in the TLS metrics wrapper and, for hijacked connections (DERP, its WebSocket flavor, and CONNECT), decrement the gauge once when the hijacked connection closes, restoring the gauge's connection-lifetime semantics. Teach derpserver's TCP RTT stats to unwrap the close-hook conn so they still find the underlying *net.TCPConn. Also soften the UntypedHexString deprecation notices in types/key to warnings: the untyped hex string format is the DERP wire protocol's key encoding, so these call sites are legitimate and permanent, and a Deprecated marker just makes them light up in editors and linters. The cautionary text about the format's risks remains. Measured with 100,000 idle TLS DERP connections on linux/amd64: standing memory drops from 55.6KB to 32.6KB per connection (-41%). Updates #21064 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Change-Id: If05a0c6ea79134807e9e8872861db216