Fix FIN_WAIT_2 accumulation by draining sockets before close

renaudallard · renaudallard · commit 004da4be13b4 · 2026-03-19T17:55:40.000+01:00
After shutdown(SHUT_WR) sends a FIN to the remote, tinyproxy was calling
close() without waiting for the remote FIN.  The socket was orphaned in
FIN_WAIT_2 state.  On Linux this is masked by tcp_fin_timeout reaping
orphaned sockets after 60s.  On OpenBSD, without SO_KEEPALIVE, these
sockets persist indefinitely and accumulate until the proxy stalls.

Add close_socket() that calls shutdown(SHUT_WR), then drains the socket
with a 2-second receive timeout to allow the remote FIN to arrive before
calling close().  Use it in conn_destroy_contents() for both client and
server file descriptors, covering all exit paths from relay_connection()
including idle timeout and poll error returns.

Also add the missing shutdown(server_fd, SHUT_WR) in relay_connection()
after flushing remaining data to the upstream server, so the server
receives a proper FIN rather than relying on the implicit close().
diff --git a/src/conns.c b/src/conns.c
@@ -77,19 +77,48 @@ int conn_init_contents (struct conn_s *connptr, const char *ipaddr,
         return 0;
 }
 
+/*
+ * Gracefully close a socket by completing the TCP close handshake.
+ * Send FIN via shutdown(SHUT_WR), then drain remaining data with a
+ * short timeout to receive the remote FIN.  This prevents connections
+ * from getting stuck in FIN_WAIT_2 on systems that do not aggressively
+ * reap orphaned sockets (e.g. OpenBSD without SO_KEEPALIVE).
+ */
+static void close_socket (int fd)
+{
+        char drain[4096];
+        ssize_t n;
+        struct timeval tv;
+
+        shutdown (fd, SHUT_WR);
+
+        tv.tv_sec = 2;
+        tv.tv_usec = 0;
+        setsockopt (fd, SOL_SOCKET, SO_RCVTIMEO, &tv, sizeof (tv));
+
+        for (;;) {
+                n = read (fd, drain, sizeof (drain));
+                if (n > 0)
+                        continue;
+                if (n == 0)
+                        break;
+                if (errno == EINTR)
+                        continue;
+                break;
+        }
+
+        close (fd);
+}
+
 void conn_destroy_contents (struct conn_s *connptr)
 {
         assert (connptr != NULL);
 
         if (connptr->client_fd != -1)
-                if (close (connptr->client_fd) < 0)
-                        log_message (LOG_INFO, "Client (%d) close message: %s",
-                                     connptr->client_fd, strerror (errno));
+                close_socket (connptr->client_fd);
         connptr->client_fd = -1;
         if (connptr->server_fd != -1)
-                if (close (connptr->server_fd) < 0)
-                        log_message (LOG_INFO, "Server (%d) close message: %s",
-                                     connptr->server_fd, strerror (errno));
+                close_socket (connptr->server_fd);
         connptr->server_fd = -1;
 
         if (connptr->cbuffer)
diff --git a/src/reqs.c b/src/reqs.c
@@ -1281,6 +1281,7 @@ static void relay_connection (struct conn_s *connptr)
                 if (write_buffer (connptr->server_fd, connptr->cbuffer) < 0)
                         break;
         }
+        shutdown (connptr->server_fd, SHUT_WR);
 
         return;
 }

Original file line number	Diff line number	Diff line change
`@@ -1281,6 +1281,7 @@ static void relay_connection (struct conn_s *connptr)`
`1281`	`1281`	`if (write_buffer (connptr->server_fd, connptr->cbuffer) < 0)`
`1282`	`1282`	`break;`
`1283`	`1283`	`}`
	`1284`	`+ shutdown (connptr->server_fd, SHUT_WR);`
`1284`	`1285`
`1285`	`1286`	`return;`
`1286`	`1287`	`}`