network: add tcp listener backlog config

api/envoy/config/listener/v3/listener.proto

@@ -36,7 +36,7 @@ message ListenerCollection {
   udpa.core.v1.CollectionEntry entries = 1;
 }
 
-// [#next-free-field: 24]
+// [#next-free-field: 25]
 message Listener {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener";
 
@@ -259,4 +259,8 @@ message Listener {
   // If not present, treat it as "udp_default_writer".
   // [#not-implemented-hide:]
   core.v3.TypedExtensionConfig udp_writer_config = 23;
+
+  // The maximum length a tcp listener's pending connections queue can grow to. If no value is
+  // provided net.core.somaxconn will be used on Linux and 128 otherwise.
+  google.protobuf.UInt32Value tcp_backlog_size = 24;
 }

include/envoy/common/platform.h

@@ -273,3 +273,11 @@ struct mmsghdr {
 #undef SUPPORTS_PTHREAD_NAMING
 #define SUPPORTS_PTHREAD_NAMING 1
 #endif // defined(__ANDROID_API__)
+
+#if defined(__linux__)
+// On Linux, default listen backlog size to net.core.somaxconn which is runtime configurable
+#define ENVOY_TCP_BACKLOG_SIZE -1
+#else
+// On non-Linux platforms use 128 which is libevent listener default
+#define ENVOY_TCP_BACKLOG_SIZE 128
+#endif

include/envoy/event/dispatcher.h

@@ -148,11 +148,12 @@ class Dispatcher {
    * @param socket supplies the socket to listen on.
    * @param cb supplies the callbacks to invoke for listener events.
    * @param bind_to_port controls whether the listener binds to a transport port or not.
+   * @param backlog_size controls listener pending connections backlog
    * @return Network::ListenerPtr a new listener that is owned by the caller.
    */
   virtual Network::ListenerPtr createListener(Network::SocketSharedPtr&& socket,
-                                              Network::ListenerCallbacks& cb,
-                                              bool bind_to_port) PURE;
+                                              Network::ListenerCallbacks& cb, bool bind_to_port,
+                                              uint32_t backlog_size) PURE;
 
   /**
    * Creates a logical udp listener on a specific port.

include/envoy/network/listener.h

@@ -161,6 +161,11 @@ class ListenerConfig {
    * @return std::vector<AccessLog::InstanceSharedPtr> access logs emitted by the listener.
    */
   virtual const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const PURE;
+
+  /**
+   * @return pending connection backlog for TCP listeners.
+   */
+  virtual uint32_t tcpBacklogSize() const PURE;
 };
 
 /**

source/common/event/dispatcher_impl.cc

@@ -138,9 +138,10 @@ Filesystem::WatcherPtr DispatcherImpl::createFilesystemWatcher() {
 
 Network::ListenerPtr DispatcherImpl::createListener(Network::SocketSharedPtr&& socket,
                                                     Network::ListenerCallbacks& cb,
-                                                    bool bind_to_port) {
+                                                    bool bind_to_port, uint32_t backlog_size) {
   ASSERT(isThreadSafe());
-  return std::make_unique<Network::ListenerImpl>(*this, std::move(socket), cb, bind_to_port);
+  return std::make_unique<Network::ListenerImpl>(*this, std::move(socket), cb, bind_to_port,
+                                                 backlog_size);
 }
 
 Network::UdpListenerPtr DispatcherImpl::createUdpListener(Network::SocketSharedPtr&& socket,

source/common/event/dispatcher_impl.h

@@ -60,7 +60,8 @@ class DispatcherImpl : Logger::Loggable<Logger::Id::main>,
                                uint32_t events) override;
   Filesystem::WatcherPtr createFilesystemWatcher() override;
   Network::ListenerPtr createListener(Network::SocketSharedPtr&& socket,
-                                      Network::ListenerCallbacks& cb, bool bind_to_port) override;
+                                      Network::ListenerCallbacks& cb, bool bind_to_port,
+                                      uint32_t backlog_size) override;
   Network::UdpListenerPtr createUdpListener(Network::SocketSharedPtr&& socket,
                                             Network::UdpListenerCallbacks& cb) override;
   TimerPtr createTimer(TimerCb cb) override;

source/common/network/listener_impl.cc

@@ -91,9 +91,7 @@ void ListenerImpl::onSocketEvent(short flags) {
 }
 
 void ListenerImpl::setupServerSocket(Event::DispatcherImpl& dispatcher, Socket& socket) {
-  // TODO(fcoras): make listen backlog configurable. For now use 128, which is what libevent
-  // defaults to for listeners configured with a negative (unspecified) backlog
-  socket.ioHandle().listen(128);
+  socket.ioHandle().listen(backlog_size_);
 
   // Although onSocketEvent drains to completion, use level triggered mode to avoid potential
   // loss of the trigger due to transient accept errors.
@@ -109,8 +107,8 @@ void ListenerImpl::setupServerSocket(Event::DispatcherImpl& dispatcher, Socket&
 }
 
 ListenerImpl::ListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket,
-                           ListenerCallbacks& cb, bool bind_to_port)
-    : BaseListenerImpl(dispatcher, std::move(socket)), cb_(cb) {
+                           ListenerCallbacks& cb, bool bind_to_port, uint32_t backlog_size)
+    : BaseListenerImpl(dispatcher, std::move(socket)), cb_(cb), backlog_size_(backlog_size) {
   if (bind_to_port) {
     setupServerSocket(dispatcher, *socket_);
   }

source/common/network/listener_impl.h

@@ -15,7 +15,7 @@ namespace Network {
 class ListenerImpl : public BaseListenerImpl {
 public:
   ListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket, ListenerCallbacks& cb,
-               bool bind_to_port);
+               bool bind_to_port, uint32_t backlog_size);
   void disable() override;
   void enable() override;
 
@@ -25,6 +25,7 @@ class ListenerImpl : public BaseListenerImpl {
   void setupServerSocket(Event::DispatcherImpl& dispatcher, Socket& socket);
 
   ListenerCallbacks& cb_;
+  const uint32_t backlog_size_;
 
 private:
   void onSocketEvent(short flags);

source/server/admin/admin.h

@@ -390,6 +390,7 @@ class AdminImpl : public Admin,
     const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
       return empty_access_logs_;
     }
+    uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
     AdminImpl& parent_;
     const std::string name_;

source/server/config_validation/dispatcher.cc

@@ -22,7 +22,8 @@ Network::DnsResolverSharedPtr ValidationDispatcher::createDnsResolver(
 }
 
 Network::ListenerPtr ValidationDispatcher::createListener(Network::SocketSharedPtr&&,
-                                                          Network::ListenerCallbacks&, bool) {
+                                                          Network::ListenerCallbacks&, bool,
+                                                          uint32_t) {
   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
 }
 

source/server/config_validation/dispatcher.h

@@ -27,7 +27,7 @@ class ValidationDispatcher : public DispatcherImpl {
   createDnsResolver(const std::vector<Network::Address::InstanceConstSharedPtr>& resolvers,
                     const bool use_tcp_for_dns_lookups) override;
   Network::ListenerPtr createListener(Network::SocketSharedPtr&&, Network::ListenerCallbacks&,
-                                      bool bind_to_port) override;
+                                      bool bind_to_port, uint32_t backlog_size) override;
 
 protected:
   std::shared_ptr<Network::ValidationDnsResolver> dns_resolver_{

source/server/connection_handler_impl.cc

@@ -141,7 +141,7 @@ ConnectionHandlerImpl::ActiveTcpListener::ActiveTcpListener(ConnectionHandlerImp
     : ActiveTcpListener(
           parent,
           parent.dispatcher_.createListener(config.listenSocketFactory().getListenSocket(), *this,
-                                            config.bindToPort()),
+                                            config.bindToPort(), config.tcpBacklogSize()),
           config) {}
 
 ConnectionHandlerImpl::ActiveTcpListener::ActiveTcpListener(ConnectionHandlerImpl& parent,

source/server/listener_impl.cc

@@ -233,6 +233,8 @@ ListenerImpl::ListenerImpl(const envoy::config::listener::v3::Listener& config,
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, per_connection_buffer_limit_bytes, 1024 * 1024)),
       listener_tag_(parent_.factory_.nextListenerTag()), name_(name), added_via_api_(added_via_api),
       workers_started_(workers_started), hash_(hash),
+      tcp_backlog_size_(
+          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, tcp_backlog_size, ENVOY_TCP_BACKLOG_SIZE)),
       validation_visitor_(
           added_via_api_ ? parent_.server_.messageValidationContext().dynamicValidationVisitor()
                          : parent_.server_.messageValidationContext().staticValidationVisitor()),
@@ -310,6 +312,8 @@ ListenerImpl::ListenerImpl(ListenerImpl& origin,
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, per_connection_buffer_limit_bytes, 1024 * 1024)),
       listener_tag_(origin.listener_tag_), name_(name), added_via_api_(added_via_api),
       workers_started_(workers_started), hash_(hash),
+      tcp_backlog_size_(
+          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, tcp_backlog_size, ENVOY_TCP_BACKLOG_SIZE)),
       validation_visitor_(
           added_via_api_ ? parent_.server_.messageValidationContext().dynamicValidationVisitor()
                          : parent_.server_.messageValidationContext().staticValidationVisitor()),

source/server/listener_impl.h

@@ -311,6 +311,7 @@ class ListenerImpl final : public Network::ListenerConfig,
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return tcp_backlog_size_; }
   Init::Manager& initManager();
   envoy::config::core::v3::TrafficDirection direction() const override {
     return config().traffic_direction();
@@ -371,6 +372,7 @@ class ListenerImpl final : public Network::ListenerConfig,
   const bool added_via_api_;
   const bool workers_started_;
   const uint64_t hash_;
+  const uint32_t tcp_backlog_size_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
 
   // A target is added to Server's InitManager if workers_started_ is false.

test/common/http/codec_client_test.cc

@@ -286,7 +286,8 @@ class CodecNetworkTest : public testing::TestWithParam<Network::Address::IpVersi
         Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true);
     Network::ClientConnectionPtr client_connection = dispatcher_->createClientConnection(
         socket->localAddress(), source_address_, Network::Test::createRawBufferSocket(), nullptr);
-    upstream_listener_ = dispatcher_->createListener(std::move(socket), listener_callbacks_, true);
+    upstream_listener_ = dispatcher_->createListener(std::move(socket), listener_callbacks_, true,
+                                                     ENVOY_TCP_BACKLOG_SIZE);
     client_connection_ = client_connection.get();
     client_connection_->addConnectionCallbacks(client_callbacks_);
 

test/common/network/connection_impl_test.cc

@@ -108,7 +108,8 @@ class ConnectionImplTest : public testing::TestWithParam<Address::IpVersion> {
     }
     socket_ = std::make_shared<Network::TcpListenSocket>(
         Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true);
-    listener_ = dispatcher_->createListener(socket_, listener_callbacks_, true);
+    listener_ =
+        dispatcher_->createListener(socket_, listener_callbacks_, true, ENVOY_TCP_BACKLOG_SIZE);
     client_connection_ = std::make_unique<Network::TestClientConnectionImpl>(
         *dispatcher_, socket_->localAddress(), source_address_,
         Network::Test::createRawBufferSocket(), socket_options_);
@@ -1132,7 +1133,8 @@ TEST_P(ConnectionImplTest, BindFailureTest) {
   dispatcher_ = api_->allocateDispatcher("test_thread");
   socket_ = std::make_shared<Network::TcpListenSocket>(
       Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true);
-  listener_ = dispatcher_->createListener(socket_, listener_callbacks_, true);
+  listener_ =
+      dispatcher_->createListener(socket_, listener_callbacks_, true, ENVOY_TCP_BACKLOG_SIZE);
 
   client_connection_ = dispatcher_->createClientConnection(
       socket_->localAddress(), source_address_, Network::Test::createRawBufferSocket(), nullptr);
@@ -2238,7 +2240,8 @@ class ReadBufferLimitTest : public ConnectionImplTest {
     dispatcher_ = api_->allocateDispatcher("test_thread");
     socket_ = std::make_shared<Network::TcpListenSocket>(
         Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true);
-    listener_ = dispatcher_->createListener(socket_, listener_callbacks_, true);
+    listener_ =
+        dispatcher_->createListener(socket_, listener_callbacks_, true, ENVOY_TCP_BACKLOG_SIZE);
 
     client_connection_ = dispatcher_->createClientConnection(
         socket_->localAddress(), Network::Address::InstanceConstSharedPtr(),

test/common/network/dns_impl_test.cc

@@ -437,7 +437,7 @@ class DnsImplTest : public testing::TestWithParam<Address::IpVersion> {
     server_ = std::make_unique<TestDnsServer>(*dispatcher_);
     socket_ = std::make_shared<Network::TcpListenSocket>(
         Network::Test::getCanonicalLoopbackAddress(GetParam()), nullptr, true);
-    listener_ = dispatcher_->createListener(socket_, *server_, true);
+    listener_ = dispatcher_->createListener(socket_, *server_, true, ENVOY_TCP_BACKLOG_SIZE);
 
     // Point c-ares at the listener with no search domains and TCP-only.
     peer_ = std::make_unique<DnsResolverImplPeer>(dynamic_cast<DnsResolverImpl*>(resolver_.get()));

test/common/network/listener_impl_test.cc

@@ -34,7 +34,8 @@ static void errorCallbackTest(Address::IpVersion version) {
       Network::Test::getCanonicalLoopbackAddress(version), nullptr, true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
-  Network::ListenerPtr listener = dispatcher->createListener(socket, listener_callbacks, true);
+  Network::ListenerPtr listener =
+      dispatcher->createListener(socket, listener_callbacks, true, ENVOY_TCP_BACKLOG_SIZE);
 
   Network::ClientConnectionPtr client_connection = dispatcher->createClientConnection(
       socket->localAddress(), Network::Address::InstanceConstSharedPtr(),
@@ -65,8 +66,8 @@ TEST_P(ListenerImplDeathTest, ErrorCallback) {
 class TestListenerImpl : public ListenerImpl {
 public:
   TestListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket, ListenerCallbacks& cb,
-                   bool bind_to_port)
-      : ListenerImpl(dispatcher, std::move(socket), cb, bind_to_port) {}
+                   bool bind_to_port, uint32_t tcp_backlog = ENVOY_TCP_BACKLOG_SIZE)
+      : ListenerImpl(dispatcher, std::move(socket), cb, bind_to_port, tcp_backlog) {}
 
   MOCK_METHOD(Address::InstanceConstSharedPtr, getLocalAddress, (os_fd_t fd));
 };
@@ -150,7 +151,8 @@ TEST_P(ListenerImplTest, GlobalConnectionLimitEnforcement) {
       Network::Test::getCanonicalLoopbackAddress(version_), nullptr, true);
   Network::MockListenerCallbacks listener_callbacks;
   Network::MockConnectionHandler connection_handler;
-  Network::ListenerPtr listener = dispatcher_->createListener(socket, listener_callbacks, true);
+  Network::ListenerPtr listener =
+      dispatcher_->createListener(socket, listener_callbacks, true, ENVOY_TCP_BACKLOG_SIZE);
 
   std::vector<Network::ClientConnectionPtr> client_connections;
   std::vector<Network::ConnectionPtr> server_connections;

test/extensions/common/proxy_protocol/proxy_protocol_regression_test.cc

@@ -79,6 +79,7 @@ class ProxyProtocolRegressionTest : public testing::TestWithParam<Network::Addre
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {

test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc

@@ -94,6 +94,7 @@ class ProxyProtocolTest : public testing::TestWithParam<Network::Address::IpVers
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {
@@ -1291,6 +1292,7 @@ class WildcardProxyProtocolTest : public testing::TestWithParam<Network::Address
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {