tree 9ac259eaa7d0e3999865f742a0c86ad8a88ca2e8
parent 142cc1b52a01d2aac30c91a4abb74b0a6aaca705
author Christopher Faulet <cfaulet@haproxy.com> 1681193044 +0200
committer Christopher Faulet <cfaulet@haproxy.com> 1681193946 +0200

BUG/MEDIUM: resolvers: Force the connect timeout for DNS resolutions

Timeouts for dynamic resolutions are not handled at the stream level but by
the resolvers themself. It means there is no connect, client and server
timeouts defined on the internal proxy used by a resolver.

While it is not an issue for DNS resolution over UDP, it can be a problem
for resolution over TCP. New sessions are automatically created when
required, and killed on excess. But only established connections are
considered. Connecting ones are never killed. Because there is no conncet
timeout, we rely on the kernel to report a connection error. And this may be
quite long.

Because resolutions are periodically triggered, this may lead to an excess
of unusable sessions in connecting state. This also prevents HAProxy to
quickly exit on soft-stop. It is annoying, especially because there is no
reason to not set a connect timeout.

So to mitigate the issue, we now use the "resolve" timeout as connect
timeout for the internal proxy attached to a resolver.

This patch should be backported as far as 2.4.