mirror of
https://github.com/storytold/pdfcraft.git
synced 2026-10-31 05:28:09 -06:00
skylar taylor-barrick
7cce65917d
* Control channel: don't lose the refusal reply to a TCP reset When the control channel refused an unauthenticated connection (deadline passed, overlong line, bad first request) it wrote the error line and closed the socket at once. If the client had sent input the server had not read, Linux answers that close with a reset instead of a FIN, and the reset can discard the reply before the client reads it. That is the flake in an_unauthenticated_connection_is_closed_at_the_deadline: the dripping client's bytes were still unread when the server closed. Now the server shuts down its write side after the reply and reads and discards input until the client closes or a 1 s linger passes, and only then closes. The new test a_client_refused_with_input_unread_gets_the_reason pins it deterministically. * Control channel: refused connections linger outside the auth places A connection refused before auth used to keep its place among max_unauthenticated while it lingered (up to 1 s), so refusals could keep real clients out. Now `refuse` gives that place back and takes one of a separate, smaller set of lingering places (Limits::max_lingering, 8) before the reply is written. When none is free the connection is closed right after the FIN instead of lingering, so threads stay bounded as #1806 intended. Tests: a_lingering_connection_holds_no_place_to_authenticate and only_so_many_refused_connections_linger. * Control channel tests: a 5 s linger for the two linger tests Their timing checks (the auth round trips finishing within the linger, and a non-lingering connection failing a write within half of it) had only 1 s and 500 ms of margin with TEST_LIMITS. Each now serves with its own Limits and a 5 s linger; the assertions are unchanged and neither test waits for the linger on its passing path.