overload: scale transport socket connect timeout

api/envoy/config/overload/v3/overload.proto

@@ -93,6 +93,12 @@ message ScaleTimersOverloadActionConfig {
     // Adjusts the idle timer for downstream HTTP connections that takes effect when there are no active streams.
     // This affects the value of :ref:`RouteAction.idle_timeout <envoy_v3_api_field_config.route.v3.RouteAction.idle_timeout>`.
     HTTP_DOWNSTREAM_CONNECTION_IDLE = 1;
+
+    // Adjusts the timer for how long downstream clients have to finish transport-level negotiations
+    // before the connection is closed.
+    // This affects the value of
+    // :ref:`FilterChain.transport_socket_connect_timeout <envoy_v3_api_field_config.listener.v3.FilterChain.transport_socket_connect_timeout>`.
+    TRANSPORT_SOCKET_CONNECT = 2;
   }
 
   message ScaleTimer {

include/envoy/event/BUILD

@@ -32,6 +32,7 @@ envoy_cc_library(
         "//include/envoy/network:listener_interface",
         "//include/envoy/network:transport_socket_interface",
         "//include/envoy/server:watchdog_interface",
+        "//include/envoy/server/overload:thread_local_overload_state",
         "//include/envoy/thread:thread_interface",
     ],
 )

include/envoy/event/dispatcher.h

@@ -19,6 +19,7 @@
 #include "envoy/network/listen_socket.h"
 #include "envoy/network/listener.h"
 #include "envoy/network/transport_socket.h"
+#include "envoy/server/overload/thread_local_overload_state.h"
 #include "envoy/server/watchdog.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/stats_macros.h"
@@ -100,12 +101,12 @@ class Dispatcher {
    *        connection. Takes ownership of the socket.
    * @param transport_socket supplies a transport socket to be used by the connection.
    * @param stream_info info object for the server connection
+   * @param overload_state the overload state for this dispatcher.
    * @return Network::ConnectionPtr a server connection that is owned by the caller.
    */
-  virtual Network::ServerConnectionPtr
-  createServerConnection(Network::ConnectionSocketPtr&& socket,
-                         Network::TransportSocketPtr&& transport_socket,
-                         StreamInfo::StreamInfo& stream_info) PURE;
+  virtual Network::ServerConnectionPtr createServerConnection(
+      Network::ConnectionSocketPtr&& socket, Network::TransportSocketPtr&& transport_socket,
+      StreamInfo::StreamInfo& stream_info, Server::ThreadLocalOverloadState& overload_state) PURE;
 
   /**
    * Creates an instance of Envoy's Network::ClientConnection. Does NOT initiate the connection;

include/envoy/event/scaled_range_timer_manager.h

@@ -1,5 +1,7 @@
 #pragma once
 
+#include <ostream>
+
 #include "envoy/common/pure.h"
 #include "envoy/event/timer.h"
 
@@ -12,32 +14,43 @@ namespace Event {
  * Describes a minimum timer value that is equal to a scale factor applied to the maximum.
  */
 struct ScaledMinimum {
-  explicit ScaledMinimum(double scale_factor) : scale_factor_(scale_factor) {}
+  explicit constexpr ScaledMinimum(double scale_factor) : scale_factor_(scale_factor) {}
+  inline bool operator==(const ScaledMinimum& other) const {
+    return other.scale_factor_ == scale_factor_;
+  }
+  inline friend std::ostream& operator<<(std::ostream& output, const ScaledMinimum& minimum) {
+    return output << "ScaledMinimum { scale_factor_ = " << minimum.scale_factor_ << " }";
+  }
+
   const double scale_factor_;
 };
 
 /**
  * Describes a minimum timer value that is an absolute duration.
  */
 struct AbsoluteMinimum {
-  explicit AbsoluteMinimum(std::chrono::milliseconds value) : value_(value) {}
+  explicit constexpr AbsoluteMinimum(std::chrono::milliseconds value) : value_(value) {}
+  inline bool operator==(const AbsoluteMinimum& other) const { return other.value_ == value_; }
+  inline friend std::ostream& operator<<(std::ostream& output, const AbsoluteMinimum& minimum) {
+    return output << "AbsoluteMinimum { value = " << minimum.value_.count() << "ms }";
+  }
   const std::chrono::milliseconds value_;
 };
 
 /**
  * Class that describes how to compute a minimum timeout given a maximum timeout value. It wraps
  * ScaledMinimum and AbsoluteMinimum and provides a single computeMinimum() method.
  */
-class ScaledTimerMinimum : private absl::variant<ScaledMinimum, AbsoluteMinimum> {
+class ScaledTimerMinimum {
 public:
-  // Use base class constructor.
-  using absl::variant<ScaledMinimum, AbsoluteMinimum>::variant;
+  // Forward arguments to impl_'s constructor.
+  template <typename T> constexpr ScaledTimerMinimum(T arg) : impl_(arg) {}
 
   // Computes the minimum value for a given maximum timeout. If this object was constructed with a
   // - ScaledMinimum value:
-  //     the return value is the scale factor applied to the provided maximum.
+  //   the return value is the scale factor applied to the provided maximum.
   // - AbsoluteMinimum:
-  //     the return value is that minimum, and the provided maximum is ignored.
+  //   the return value is that minimum, and the provided maximum is ignored.
   std::chrono::milliseconds computeMinimum(std::chrono::milliseconds maximum) const {
     struct Visitor {
       explicit Visitor(std::chrono::milliseconds value) : value_(value) {}
@@ -50,9 +63,18 @@ class ScaledTimerMinimum : private absl::variant<ScaledMinimum, AbsoluteMinimum>
       }
       const std::chrono::milliseconds value_;
     };
-    return absl::visit<Visitor, const absl::variant<ScaledMinimum, AbsoluteMinimum>&>(
-        Visitor(maximum), *this);
+    return absl::visit(Visitor(maximum), impl_);
   }
+
+  inline bool operator==(const ScaledTimerMinimum& other) const { return impl_ == other.impl_; }
+
+  inline friend std::ostream& operator<<(std::ostream& output, const ScaledTimerMinimum& minimum) {
+    return absl::visit([&](const auto& minimum) -> std::ostream& { return output << minimum; },
+                       minimum.impl_);
+  }
+
+private:
+  absl::variant<ScaledMinimum, AbsoluteMinimum> impl_;
 };
 
 /**

include/envoy/server/overload/thread_local_overload_state.h

@@ -44,6 +44,10 @@ enum class OverloadTimerType {
   // The amount of time an HTTP connection to a downstream client can remain idle (no streams). This
   // corresponds to the HTTP_DOWNSTREAM_CONNECTION_IDLE TimerType in overload.proto.
   HttpDownstreamIdleConnectionTimeout,
+  // The amount of time a connection to a downstream client can spend waiting for the transport to
+  // report connection establishment before the connection is closed.
+  // This corresponds to the TRANSPORT_SOCKET_CONNECT_TIMEOUT TimerType in overload.proto.
+  TransportSocketConnectTimeout,
 };
 
 /**

source/common/event/dispatcher_impl.cc

@@ -110,13 +110,12 @@ void DispatcherImpl::clearDeferredDeleteList() {
   deferred_deleting_ = false;
 }
 
-Network::ServerConnectionPtr
-DispatcherImpl::createServerConnection(Network::ConnectionSocketPtr&& socket,
-                                       Network::TransportSocketPtr&& transport_socket,
-                                       StreamInfo::StreamInfo& stream_info) {
+Network::ServerConnectionPtr DispatcherImpl::createServerConnection(
+    Network::ConnectionSocketPtr&& socket, Network::TransportSocketPtr&& transport_socket,
+    StreamInfo::StreamInfo& stream_info, Server::ThreadLocalOverloadState& overload_state) {
   ASSERT(isThreadSafe());
   return std::make_unique<Network::ServerConnectionImpl>(
-      *this, std::move(socket), std::move(transport_socket), stream_info, true);
+      *this, overload_state, std::move(socket), std::move(transport_socket), stream_info, true);
 }
 
 Network::ClientConnectionPtr

source/common/event/dispatcher_impl.h

@@ -12,6 +12,7 @@
 #include "envoy/event/deferred_deletable.h"
 #include "envoy/event/dispatcher.h"
 #include "envoy/network/connection_handler.h"
+#include "envoy/server/overload/thread_local_overload_state.h"
 #include "envoy/stats/scope.h"
 
 #include "common/common/logger.h"
@@ -50,7 +51,8 @@ class DispatcherImpl : Logger::Loggable<Logger::Id::main>,
   Network::ServerConnectionPtr
   createServerConnection(Network::ConnectionSocketPtr&& socket,
                          Network::TransportSocketPtr&& transport_socket,
-                         StreamInfo::StreamInfo& stream_info) override;
+                         StreamInfo::StreamInfo& stream_info,
+                         Server::ThreadLocalOverloadState& overload_state) override;
   Network::ClientConnectionPtr
   createClientConnection(Network::Address::InstanceConstSharedPtr address,
                          Network::Address::InstanceConstSharedPtr source_address,

source/common/network/BUILD

@@ -78,6 +78,7 @@ envoy_cc_library(
         "//include/envoy/event:timer_interface",
         "//include/envoy/network:connection_interface",
         "//include/envoy/network:filter_interface",
+        "//include/envoy/server/overload:thread_local_overload_state",
         "//source/common/buffer:buffer_lib",
         "//source/common/buffer:watermark_buffer_lib",
         "//source/common/common:assert_lib",

source/common/network/connection_impl.cc

@@ -10,6 +10,7 @@
 #include "envoy/event/timer.h"
 #include "envoy/network/filter.h"
 #include "envoy/network/socket.h"
+#include "envoy/server/overload/thread_local_overload_state.h"
 
 #include "common/common/assert.h"
 #include "common/common/empty_string.h"
@@ -730,19 +731,22 @@ void ConnectionImpl::flushWriteBuffer() {
 }
 
 ServerConnectionImpl::ServerConnectionImpl(Event::Dispatcher& dispatcher,
+                                           Server::ThreadLocalOverloadState& overload_state,
                                            ConnectionSocketPtr&& socket,
                                            TransportSocketPtr&& transport_socket,
                                            StreamInfo::StreamInfo& stream_info, bool connected)
     : ConnectionImpl(dispatcher, std::move(socket), std::move(transport_socket), stream_info,
-                     connected) {}
+                     connected),
+      overload_state_(overload_state) {}
 
 void ServerConnectionImpl::setTransportSocketConnectTimeout(std::chrono::milliseconds timeout) {
   if (!transport_connect_pending_) {
     return;
   }
   if (transport_socket_connect_timer_ == nullptr) {
     transport_socket_connect_timer_ =
-        dispatcher_.createTimer([this] { onTransportSocketConnectTimeout(); });
+        overload_state_.createScaledTimer(Server::OverloadTimerType::TransportSocketConnectTimeout,
+                                          [this] { onTransportSocketConnectTimeout(); });
   }
   transport_socket_connect_timer_->enableTimer(timeout);
 }

source/common/network/connection_impl.h

@@ -7,6 +7,7 @@
 #include <string>
 
 #include "envoy/network/transport_socket.h"
+#include "envoy/server/overload/thread_local_overload_state.h"
 
 #include "common/buffer/watermark_buffer.h"
 #include "common/event/libevent.h"
@@ -208,9 +209,10 @@ class ConnectionImpl : public ConnectionImplBase, public TransportSocketCallback
 
 class ServerConnectionImpl : public ConnectionImpl, virtual public ServerConnection {
 public:
-  ServerConnectionImpl(Event::Dispatcher& dispatcher, ConnectionSocketPtr&& socket,
-                       TransportSocketPtr&& transport_socket, StreamInfo::StreamInfo& stream_info,
-                       bool connected);
+  ServerConnectionImpl(Event::Dispatcher& dispatcher,
+                       Server::ThreadLocalOverloadState& overload_state,
+                       ConnectionSocketPtr&& socket, TransportSocketPtr&& transport_socket,
+                       StreamInfo::StreamInfo& stream_info, bool connected);
 
   // ServerConnection impl
   void setTransportSocketConnectTimeout(std::chrono::milliseconds timeout) override;
@@ -219,6 +221,7 @@ class ServerConnectionImpl : public ConnectionImpl, virtual public ServerConnect
 private:
   void onTransportSocketConnectTimeout();
 
+  Server::ThreadLocalOverloadState& overload_state_;
   bool transport_connect_pending_{true};
   // Implements a timeout for the transport socket signaling connection. The timer is enabled by a
   // call to setTransportSocketConnectTimeout and is reset when the connection is established.

source/server/BUILD

@@ -75,6 +75,7 @@ envoy_cc_library(
         "//include/envoy/network:listener_interface",
         "//include/envoy/server:active_udp_listener_config_interface",
         "//include/envoy/server:listener_manager_interface",
+        "//include/envoy/server/overload:overload_manager_interface",
         "//include/envoy/stats:timespan_interface",
         "//source/common/common:linked_object",
         "//source/common/common:non_copyable",

source/server/connection_handler_impl.cc

@@ -29,8 +29,9 @@ void emitLogs(Network::ListenerConfig& config, StreamInfo::StreamInfo& stream_in
 } // namespace
 
 ConnectionHandlerImpl::ConnectionHandlerImpl(Event::Dispatcher& dispatcher,
+                                             Server::OverloadManager& overload_manager,
                                              absl::optional<uint32_t> worker_index)
-    : worker_index_(worker_index), dispatcher_(dispatcher),
+    : worker_index_(worker_index), dispatcher_(dispatcher), overload_manager_(overload_manager),
       per_handler_stat_prefix_(dispatcher.name() + "."), disable_listeners_(false) {}
 
 void ConnectionHandlerImpl::incNumConnections() { ++num_handler_connections_; }
@@ -480,7 +481,8 @@ void ConnectionHandlerImpl::ActiveTcpListener::newConnection(
   stream_info->setDownstreamSslConnection(transport_socket->ssl());
   auto& active_connections = getOrCreateActiveConnections(*filter_chain);
   auto server_conn_ptr = parent_.dispatcher_.createServerConnection(
-      std::move(socket), std::move(transport_socket), *stream_info);
+      std::move(socket), std::move(transport_socket), *stream_info,
+      parent_.overload_manager_.getThreadLocalOverloadState());
   if (const auto timeout = filter_chain->transportSocketConnectTimeout();
       timeout != std::chrono::milliseconds::zero()) {
     server_conn_ptr->setTransportSocketConnectTimeout(timeout);

source/server/connection_handler_impl.h

@@ -14,6 +14,7 @@
 #include "envoy/network/listener.h"
 #include "envoy/server/active_udp_listener_config.h"
 #include "envoy/server/listener_manager.h"
+#include "envoy/server/overload/overload_manager.h"
 #include "envoy/stats/scope.h"
 #include "envoy/stats/timespan.h"
 
@@ -66,7 +67,8 @@ class ConnectionHandlerImpl : public Network::ConnectionHandler,
                               NonCopyable,
                               Logger::Loggable<Logger::Id::conn_handler> {
 public:
-  ConnectionHandlerImpl(Event::Dispatcher& dispatcher, absl::optional<uint32_t> worker_index);
+  ConnectionHandlerImpl(Event::Dispatcher& dispatcher, OverloadManager& overload_manager,
+                        absl::optional<uint32_t> worker_index);
 
   // Network::ConnectionHandler
   uint64_t numConnections() const override { return num_handler_connections_; }
@@ -359,6 +361,7 @@ class ConnectionHandlerImpl : public Network::ConnectionHandler,
   // This has a value on worker threads, and no value on the main thread.
   const absl::optional<uint32_t> worker_index_;
   Event::Dispatcher& dispatcher_;
+  Server::OverloadManager& overload_manager_;
   const std::string per_handler_stat_prefix_;
   std::list<std::pair<Network::Address::InstanceConstSharedPtr, ActiveListenerDetails>> listeners_;
   std::atomic<uint64_t> num_handler_connections_{};

source/server/overload_manager_impl.cc

@@ -142,6 +142,8 @@ OverloadTimerType parseTimerType(
   switch (config_timer_type) {
   case Config::HTTP_DOWNSTREAM_CONNECTION_IDLE:
     return OverloadTimerType::HttpDownstreamIdleConnectionTimeout;
+  case Config::TRANSPORT_SOCKET_CONNECT:
+    return OverloadTimerType::TransportSocketConnectTimeout;
   default:
     throw EnvoyException(fmt::format("Unknown timer type {}", config_timer_type));
   }

source/server/server.cc

@@ -51,6 +51,7 @@
 #include "server/connection_handler_impl.h"
 #include "server/guarddog_impl.h"
 #include "server/listener_hooks.h"
+#include "server/overload_manager_impl.h"
 #include "server/ssl_context_manager.h"
 
 namespace Envoy {
@@ -75,7 +76,6 @@ InstanceImpl::InstanceImpl(
                                          : absl::nullopt)),
       dispatcher_(api_->allocateDispatcher("main_thread")),
       singleton_manager_(new Singleton::ManagerImpl(api_->threadFactory())),
-      handler_(new ConnectionHandlerImpl(*dispatcher_, absl::nullopt)),
       listener_component_factory_(*this), worker_factory_(thread_local_, *api_, hooks),
       access_log_manager_(options.fileFlushIntervalMsec(), *api_, *dispatcher_, access_log_lock,
                           store),
@@ -440,6 +440,9 @@ void InstanceImpl::initialize(const Options& options,
   // We can now initialize stats for threading.
   stats_store_.initializeThreading(*dispatcher_, thread_local_);
 
+  handler_ =
+      std::make_unique<ConnectionHandlerImpl>(*dispatcher_, *overload_manager_, absl::nullopt);
+
   // It's now safe to start writing stats from the main thread's dispatcher.
   if (bootstrap_.enable_dispatcher_stats()) {
     dispatcher_->initializeStats(stats_store_, "server.");

source/server/worker_impl.cc

@@ -17,9 +17,10 @@ namespace Server {
 WorkerPtr ProdWorkerFactory::createWorker(uint32_t index, OverloadManager& overload_manager,
                                           const std::string& worker_name) {
   Event::DispatcherPtr dispatcher(api_.allocateDispatcher(worker_name));
-  return std::make_unique<WorkerImpl>(tls_, hooks_, std::move(dispatcher),
-                                      std::make_unique<ConnectionHandlerImpl>(*dispatcher, index),
-                                      overload_manager, api_);
+  return std::make_unique<WorkerImpl>(
+      tls_, hooks_, std::move(dispatcher),
+      std::make_unique<ConnectionHandlerImpl>(*dispatcher, overload_manager, index),
+      overload_manager, api_);
 }
 
 WorkerImpl::WorkerImpl(ThreadLocal::Instance& tls, ListenerHooks& hooks,

test/common/http/BUILD

@@ -65,6 +65,7 @@ envoy_cc_test(
         "//test/mocks/event:event_mocks",
         "//test/mocks/http:http_mocks",
         "//test/mocks/network:network_mocks",
+        "//test/mocks/server:overload_manager_mocks",
         "//test/mocks/ssl:ssl_mocks",
         "//test/mocks/upstream:cluster_info_mocks",
         "//test/test_common:environment_lib",

test/common/http/codec_client_test.cc

@@ -15,6 +15,7 @@
 #include "test/mocks/event/mocks.h"
 #include "test/mocks/http/mocks.h"
 #include "test/mocks/network/mocks.h"
+#include "test/mocks/server/overload_manager.h"
 #include "test/mocks/ssl/mocks.h"
 #include "test/mocks/upstream/cluster_info.h"
 #include "test/test_common/environment.h"
@@ -301,7 +302,8 @@ class CodecNetworkTest : public testing::TestWithParam<Network::Address::IpVersi
     EXPECT_CALL(listener_callbacks_, onAccept_(_))
         .WillOnce(Invoke([&](Network::ConnectionSocketPtr& socket) -> void {
           upstream_connection_ = dispatcher_->createServerConnection(
-              std::move(socket), Network::Test::createRawBufferSocket(), stream_info_);
+              std::move(socket), Network::Test::createRawBufferSocket(), stream_info_,
+              overload_state_);
           upstream_connection_->addConnectionCallbacks(upstream_callbacks_);
 
           expected_callbacks--;
@@ -347,6 +349,7 @@ class CodecNetworkTest : public testing::TestWithParam<Network::Address::IpVersi
 protected:
   Api::ApiPtr api_;
   Event::DispatcherPtr dispatcher_;
+  Server::MockThreadLocalOverloadState overload_state_;
   Network::ListenerPtr upstream_listener_;
   Network::MockTcpListenerCallbacks listener_callbacks_;
   Network::MockConnectionHandler connection_handler_;