network: add tcp listener backlog config

api/envoy/config/listener/v3/listener.proto

@@ -36,7 +36,7 @@ message ListenerCollection {
   udpa.core.v1.CollectionEntry entries = 1;
 }
 
-// [#next-free-field: 24]
+// [#next-free-field: 25]
 message Listener {
   option (udpa.annotations.versioning).previous_message_type = "envoy.api.v2.Listener";
 
@@ -259,4 +259,8 @@ message Listener {
   // If not present, treat it as "udp_default_writer".
   // [#not-implemented-hide:]
   core.v3.TypedExtensionConfig udp_writer_config = 23;
+
+  // The maximum length a tcp listener's pending connections queue can grow to. If no value is
+  // provided net.core.somaxconn will be used on Linux and 128 otherwise.
+  google.protobuf.UInt32Value tcp_backlog_size = 24;
 }

include/envoy/common/platform.h

@@ -273,3 +273,11 @@ struct mmsghdr {
 #undef SUPPORTS_PTHREAD_NAMING
 #define SUPPORTS_PTHREAD_NAMING 1
 #endif // defined(__ANDROID_API__)
+
+#if defined(__linux__)
+// On Linux, default listen backlog size to net.core.somaxconn which is runtime configurable
+#define ENVOY_TCP_BACKLOG_SIZE -1
+#else
+// On non-Linux platforms use 128 which is libevent listener default
+#define ENVOY_TCP_BACKLOG_SIZE 128
+#endif

include/envoy/event/dispatcher.h

@@ -148,11 +148,12 @@ class Dispatcher {
    * @param socket supplies the socket to listen on.
    * @param cb supplies the callbacks to invoke for listener events.
    * @param bind_to_port controls whether the listener binds to a transport port or not.
+   * @param backlog_size controls listener pending connections backlog
    * @return Network::ListenerPtr a new listener that is owned by the caller.
    */
   virtual Network::ListenerPtr createListener(Network::SocketSharedPtr&& socket,
-                                              Network::ListenerCallbacks& cb,
-                                              bool bind_to_port) PURE;
+                                              Network::ListenerCallbacks& cb, bool bind_to_port,
+                                              uint32_t backlog_size = ENVOY_TCP_BACKLOG_SIZE) PURE;
 
   /**
    * Creates a logical udp listener on a specific port.

include/envoy/network/listener.h

@@ -161,6 +161,11 @@ class ListenerConfig {
    * @return std::vector<AccessLog::InstanceSharedPtr> access logs emitted by the listener.
    */
   virtual const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const PURE;
+
+  /**
+   * @return pending connection backlog for TCP listeners.
+   */
+  virtual uint32_t tcpBacklogSize() const PURE;
 };
 
 /**

source/common/event/dispatcher_impl.cc

@@ -138,9 +138,10 @@ Filesystem::WatcherPtr DispatcherImpl::createFilesystemWatcher() {
 
 Network::ListenerPtr DispatcherImpl::createListener(Network::SocketSharedPtr&& socket,
                                                     Network::ListenerCallbacks& cb,
-                                                    bool bind_to_port) {
+                                                    bool bind_to_port, uint32_t backlog_size) {
   ASSERT(isThreadSafe());
-  return std::make_unique<Network::ListenerImpl>(*this, std::move(socket), cb, bind_to_port);
+  return std::make_unique<Network::ListenerImpl>(*this, std::move(socket), cb, bind_to_port,
+                                                 backlog_size);
 }
 
 Network::UdpListenerPtr DispatcherImpl::createUdpListener(Network::SocketSharedPtr&& socket,

source/common/event/dispatcher_impl.h

@@ -60,7 +60,8 @@ class DispatcherImpl : Logger::Loggable<Logger::Id::main>,
                                uint32_t events) override;
   Filesystem::WatcherPtr createFilesystemWatcher() override;
   Network::ListenerPtr createListener(Network::SocketSharedPtr&& socket,
-                                      Network::ListenerCallbacks& cb, bool bind_to_port) override;
+                                      Network::ListenerCallbacks& cb, bool bind_to_port,
+                                      uint32_t backlog_size) override;
   Network::UdpListenerPtr createUdpListener(Network::SocketSharedPtr&& socket,
                                             Network::UdpListenerCallbacks& cb) override;
   TimerPtr createTimer(TimerCb cb) override;

source/common/network/listener_impl.cc

@@ -91,9 +91,7 @@ void ListenerImpl::onSocketEvent(short flags) {
 }
 
 void ListenerImpl::setupServerSocket(Event::DispatcherImpl& dispatcher, Socket& socket) {
-  // TODO(fcoras): make listen backlog configurable. For now use 128, which is what libevent
-  // defaults to for listeners configured with a negative (unspecified) backlog
-  socket.ioHandle().listen(128);
+  socket.ioHandle().listen(backlog_size_);
 
   // Although onSocketEvent drains to completion, use level triggered mode to avoid potential
   // loss of the trigger due to transient accept errors.
@@ -109,8 +107,8 @@ void ListenerImpl::setupServerSocket(Event::DispatcherImpl& dispatcher, Socket&
 }
 
 ListenerImpl::ListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket,
-                           ListenerCallbacks& cb, bool bind_to_port)
-    : BaseListenerImpl(dispatcher, std::move(socket)), cb_(cb) {
+                           ListenerCallbacks& cb, bool bind_to_port, uint32_t backlog_size)
+    : BaseListenerImpl(dispatcher, std::move(socket)), cb_(cb), backlog_size_(backlog_size) {
   if (bind_to_port) {
     setupServerSocket(dispatcher, *socket_);
   }

source/common/network/listener_impl.h

@@ -15,7 +15,7 @@ namespace Network {
 class ListenerImpl : public BaseListenerImpl {
 public:
   ListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket, ListenerCallbacks& cb,
-               bool bind_to_port);
+               bool bind_to_port, uint32_t backlog_size);
   void disable() override;
   void enable() override;
 
@@ -25,6 +25,7 @@ class ListenerImpl : public BaseListenerImpl {
   void setupServerSocket(Event::DispatcherImpl& dispatcher, Socket& socket);
 
   ListenerCallbacks& cb_;
+  uint32_t backlog_size_;
 
 private:
   void onSocketEvent(short flags);

source/server/admin/admin.h

@@ -390,6 +390,7 @@ class AdminImpl : public Admin,
     const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
       return empty_access_logs_;
     }
+    uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
     AdminImpl& parent_;
     const std::string name_;

source/server/config_validation/dispatcher.cc

@@ -22,7 +22,8 @@ Network::DnsResolverSharedPtr ValidationDispatcher::createDnsResolver(
 }
 
 Network::ListenerPtr ValidationDispatcher::createListener(Network::SocketSharedPtr&&,
-                                                          Network::ListenerCallbacks&, bool) {
+                                                          Network::ListenerCallbacks&, bool,
+                                                          uint32_t) {
   NOT_IMPLEMENTED_GCOVR_EXCL_LINE;
 }
 

source/server/config_validation/dispatcher.h

@@ -27,7 +27,7 @@ class ValidationDispatcher : public DispatcherImpl {
   createDnsResolver(const std::vector<Network::Address::InstanceConstSharedPtr>& resolvers,
                     const bool use_tcp_for_dns_lookups) override;
   Network::ListenerPtr createListener(Network::SocketSharedPtr&&, Network::ListenerCallbacks&,
-                                      bool bind_to_port) override;
+                                      bool bind_to_port, uint32_t backlog_size) override;
 
 protected:
   std::shared_ptr<Network::ValidationDnsResolver> dns_resolver_{

source/server/connection_handler_impl.cc

@@ -141,7 +141,7 @@ ConnectionHandlerImpl::ActiveTcpListener::ActiveTcpListener(ConnectionHandlerImp
     : ActiveTcpListener(
           parent,
           parent.dispatcher_.createListener(config.listenSocketFactory().getListenSocket(), *this,
-                                            config.bindToPort()),
+                                            config.bindToPort(), config.tcpBacklogSize()),
           config) {}
 
 ConnectionHandlerImpl::ActiveTcpListener::ActiveTcpListener(ConnectionHandlerImpl& parent,

source/server/listener_impl.cc

@@ -233,6 +233,8 @@ ListenerImpl::ListenerImpl(const envoy::config::listener::v3::Listener& config,
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, per_connection_buffer_limit_bytes, 1024 * 1024)),
       listener_tag_(parent_.factory_.nextListenerTag()), name_(name), added_via_api_(added_via_api),
       workers_started_(workers_started), hash_(hash),
+      tcp_backlog_size_(
+          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, tcp_backlog_size, ENVOY_TCP_BACKLOG_SIZE)),
       validation_visitor_(
           added_via_api_ ? parent_.server_.messageValidationContext().dynamicValidationVisitor()
                          : parent_.server_.messageValidationContext().staticValidationVisitor()),
@@ -310,6 +312,8 @@ ListenerImpl::ListenerImpl(ListenerImpl& origin,
           PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, per_connection_buffer_limit_bytes, 1024 * 1024)),
       listener_tag_(origin.listener_tag_), name_(name), added_via_api_(added_via_api),
       workers_started_(workers_started), hash_(hash),
+      tcp_backlog_size_(
+          PROTOBUF_GET_WRAPPED_OR_DEFAULT(config, tcp_backlog_size, ENVOY_TCP_BACKLOG_SIZE)),
       validation_visitor_(
           added_via_api_ ? parent_.server_.messageValidationContext().dynamicValidationVisitor()
                          : parent_.server_.messageValidationContext().staticValidationVisitor()),

source/server/listener_impl.h

@@ -311,6 +311,7 @@ class ListenerImpl final : public Network::ListenerConfig,
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return tcp_backlog_size_; }
   Init::Manager& initManager();
   envoy::config::core::v3::TrafficDirection direction() const override {
     return config().traffic_direction();
@@ -371,6 +372,7 @@ class ListenerImpl final : public Network::ListenerConfig,
   const bool added_via_api_;
   const bool workers_started_;
   const uint64_t hash_;
+  const uint32_t tcp_backlog_size_;
   ProtobufMessage::ValidationVisitor& validation_visitor_;
 
   // A target is added to Server's InitManager if workers_started_ is false.

test/common/network/listener_impl_test.cc

@@ -65,8 +65,8 @@ TEST_P(ListenerImplDeathTest, ErrorCallback) {
 class TestListenerImpl : public ListenerImpl {
 public:
   TestListenerImpl(Event::DispatcherImpl& dispatcher, SocketSharedPtr socket, ListenerCallbacks& cb,
-                   bool bind_to_port)
-      : ListenerImpl(dispatcher, std::move(socket), cb, bind_to_port) {}
+                   bool bind_to_port, uint32_t tcp_backlog = ENVOY_TCP_BACKLOG_SIZE)
+      : ListenerImpl(dispatcher, std::move(socket), cb, bind_to_port, tcp_backlog) {}
 
   MOCK_METHOD(Address::InstanceConstSharedPtr, getLocalAddress, (os_fd_t fd));
 };

test/extensions/common/proxy_protocol/proxy_protocol_regression_test.cc

@@ -79,6 +79,7 @@ class ProxyProtocolRegressionTest : public testing::TestWithParam<Network::Addre
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {

test/extensions/filters/listener/proxy_protocol/proxy_protocol_test.cc

@@ -94,6 +94,7 @@ class ProxyProtocolTest : public testing::TestWithParam<Network::Address::IpVers
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {
@@ -1291,6 +1292,7 @@ class WildcardProxyProtocolTest : public testing::TestWithParam<Network::Address
   const std::vector<AccessLog::InstanceSharedPtr>& accessLogs() const override {
     return empty_access_logs_;
   }
+  uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
   // Network::FilterChainManager
   const Network::FilterChain* findFilterChain(const Network::ConnectionSocket&) const override {

test/integration/fake_upstream.h

@@ -731,6 +731,7 @@ class FakeUpstream : Logger::Loggable<Logger::Id::testing>,
       return empty_access_logs_;
     }
     ResourceLimit& openConnections() override { return connection_resource_; }
+    uint32_t tcpBacklogSize() const override { return ENVOY_TCP_BACKLOG_SIZE; }
 
     void setMaxConnections(const uint32_t num_connections) {
       connection_resource_.setMax(num_connections);

test/mocks/event/mocks.h

@@ -64,8 +64,9 @@ class MockDispatcher : public Dispatcher {
   }
 
   Network::ListenerPtr createListener(Network::SocketSharedPtr&& socket,
-                                      Network::ListenerCallbacks& cb, bool bind_to_port) override {
-    return Network::ListenerPtr{createListener_(std::move(socket), cb, bind_to_port)};
+                                      Network::ListenerCallbacks& cb, bool bind_to_port,
+                                      uint32_t backlog_size) override {
+    return Network::ListenerPtr{createListener_(std::move(socket), cb, bind_to_port, backlog_size)};
   }
 
   Network::UdpListenerPtr createUdpListener(Network::SocketSharedPtr&& socket,
@@ -115,7 +116,7 @@ class MockDispatcher : public Dispatcher {
   MOCK_METHOD(Filesystem::Watcher*, createFilesystemWatcher_, ());
   MOCK_METHOD(Network::Listener*, createListener_,
               (Network::SocketSharedPtr && socket, Network::ListenerCallbacks& cb,
-               bool bind_to_port));
+               bool bind_to_port, uint32_t backlog_size));
   MOCK_METHOD(Network::UdpListener*, createUdpListener_,
               (Network::SocketSharedPtr && socket, Network::UdpListenerCallbacks& cb));
   MOCK_METHOD(Timer*, createTimer_, (Event::TimerCb cb));

test/mocks/network/mocks.h

@@ -358,6 +358,7 @@ class MockListenerConfig : public ListenerConfig {
   MOCK_METHOD(Network::UdpPacketWriterFactoryOptRef, udpPacketWriterFactory, ());
   MOCK_METHOD(ConnectionBalancer&, connectionBalancer, ());
   MOCK_METHOD(ResourceLimit&, openConnections, ());
+  MOCK_METHOD(uint32_t, tcpBacklogSize, (), (const));
 
   envoy::config::core::v3::TrafficDirection direction() const override {
     return envoy::config::core::v3::UNSPECIFIED;