feat: limit Redis server connections by thweetkomputer · Pull Request #3498 · apache/brpc

thweetkomputer · 2026-08-28T04:24:18Z

What problem does this PR solve?

Issue Number: N/A

Problem Summary:

RedisService has no server-side connection limit. max_concurrency limits requests only after protocol parsing, so idle clients can consume all available connection resources. On an SSL listener, accepting excess clients into brpc also allows them to enter the comparatively expensive TLS handshake before an application can reject them.

What is changed and the side effects?

Changed:

Add ServerOptions.redis_max_connections (0 keeps the existing unlimited behavior).
Add Server::SetRedisMaxConnections() to atomically change the limit on a running Redis-only Server. Raising or disabling the limit affects subsequent accepts; lowering it does not close established connections.
Reserve connection slots atomically in Acceptor, before creating a brpc Socket, so idle clients count and concurrent accepts cannot exceed the limit.
Require the limit to use a dedicated Redis public listener: redis_service set, enabled_protocols="redis", builtin services disabled, and no RPC or other protocol services on that Server. A dedicated listener can start unlimited and enable the limit later.
Make a nonblocking, best-effort attempt to send -ERR max number of clients reached to excess plaintext clients, then close the connection. Backpressure or socket errors may prevent some or all of the response from being delivered. If SSL is configured, close the accepted fd immediately without creating a brpc Socket or starting TLS.
Guard MSG_NOSIGNAL and fall back to SO_NOSIGPIPE where available. If per-socket SIGPIPE suppression is unavailable or fails, omit the optional plaintext error and close the connection.
Share the dedicated-listener diagnostic between startup and runtime validation; use RAII in the invalid-configuration test and explicitly verify admission after slot recovery.
Keep internal acceptors and other Server instances unlimited, and expose the cumulative rejection count as ServerStatistics.rejected_redis_connection_count.
Document the startup option and runtime setter in the English and Chinese server guides and add regression tests for listener isolation, dynamic limit changes, plaintext rejection, independent RPC availability, slot recovery, and pre-TLS rejection. Plaintext rejection tests accumulate short TCP reads and verify EOF; fd ownership and best-effort delivery are documented beside the rejection code.

Side effects:

Performance effects: accepted connections perform relaxed atomic admission/accounting, including an atomic load of the current limit; runtime updates are a relaxed atomic store. There is no request hot-path cost.
Breaking backward compatibility: the default behavior remains unlimited and existing source configuration is unchanged. The new public fields change the in-memory layouts of ServerOptions and ServerStatistics, so applications using a prebuilt shared brpc library must rebuild with the updated headers and library.

Check List:

Tests / Checks:

macOS / SO_NOSIGPIPE fallback not built or run locally. Linux validation below exercises MSG_NOSIGNAL.
cmake --build build --target brpc_server_unittest --parallel 4
Focused tests pass: dedicated-listener validation, runtime enable/raise/lower behavior, RPC isolation, plaintext rejection with short reads and EOF, pre-TLS rejection, and ServerTest.close_idle_connections (4/4 tests; rerun on 2026-09-10 after the portability and slot-recovery follow-up).
The complete brpc_server_unittest was not rerun in this follow-up. The previously recorded full-suite run was not clean in this local environment: the existing timing-sensitive overload assertions in ServerTest.http_error_code and ServerTest.max_concurrency observe a successful third RPC instead of overload rejection. The focused tests above pass; this PR does not change request concurrency code.
git diff --check upstream/master...HEAD

Code / Documentation:

The code follows the repository style.
Public API behavior and the accept/TLS invariants are documented.
The final diff was reviewed against the merge base.

Reviewer focus:

Whether requiring a dedicated Redis listener is the desired public contract. Protocol identification happens after TLS, so enforcing this invariant is what lets the acceptor reject excess TLS connections before authentication without affecting RPC listeners.
The relaxed atomic slot lifecycle: load the mutable limit and reserve immediately after accept, release on Socket::Create failure or BeforeRecycle, and update the limit with a relaxed store.

Rollback:

Call SetRedisMaxConnections(0) (or start with redis_max_connections=0) to retain unlimited admission, or revert these commits to remove the API and accounting fields.

Copilot

Pull request overview

This PR adds a server-side admission limit for Redis-only listeners to prevent idle clients (and, for SSL, expensive TLS handshakes) from consuming connection resources before request-level concurrency limits apply.

Changes:

Introduces ServerOptions.redis_max_connections and Server::SetRedisMaxConnections() to configure/update the Redis connection admission limit (default unlimited).
Enforces a “dedicated Redis listener” contract and reserves connection slots in Acceptor immediately after accept() (before Socket::Create() / TLS).
Adds stats (ServerStatistics.rejected_redis_connection_count), documentation updates (EN/CN), and unit tests covering rejection behavior and dynamic updates.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/brpc_server_unittest.cpp	Adds regression tests for dedicated-listener validation, plaintext rejection, TLS pre-handshake rejection, and dynamic limit updates.
src/brpc/server.h	Adds `redis_max_connections`, `rejected_redis_connection_count`, and `Server::SetRedisMaxConnections()` API surface.
src/brpc/server.cpp	Validates dedicated Redis-only configuration, wires redis limit into acceptor startup, aggregates rejection stats, implements runtime setter.
src/brpc/acceptor.h	Extends StartAccept signature and adds atomics/methods for connection slot accounting and rejection stats.
src/brpc/acceptor.cpp	Implements slot reservation before socket creation, relaxed-atomic accounting, and plaintext/TLS rejection behavior.
docs/en/server.md	Documents Redis connection limiting, dedicated listener requirements, runtime setter, and stats.
docs/cn/server.md	Chinese documentation for the Redis connection limiting feature and behavior.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

…-connections # Conflicts: # src/brpc/server.cpp

Copilot