fix: per-write deadline on listener + per-read deadline on source; ReadHeaderTimeout

Recurring symptom: HTTPS to the server stops responding after some
time even though the process is alive — TLS handshake completes
(verified with openssl s_client) but the HTTP layer hangs and curl
returns 'i/o timeout' for every request, stream and metadata POST
alike. CLOSE_WAIT socket count climbs into the dozens.

Root cause: handler-side I/O has no deadline.

  - serveStreamData's out.Write / w.Write to a slow or
    half-disconnected listener blocks indefinitely (TCP send buffer
    full, never drains). The handler goroutine sits there, the
    listener slot stays registered, the conn ends up in CLOSE_WAIT,
    and over time enough of these accumulate that the runtime can
    no longer service new HTTPS requests in a timely way.
  - handleSource's bufrw.Read on a hijacked conn has the same
    problem in the other direction: a source that drops without a
    FIN (network blip, encoder crash) wedges the handler.

The fix is the standard Go-network-server defence:

  - Listener: http.NewResponseController(w).SetWriteDeadline before
    every Write. 30 s — typical Write to a healthy listener
    finishes in <1 ms; this only fires when the receiver is gone.
  - Source: conn.SetReadDeadline(60 s) refreshed after every
    successful read. A continuously-streaming source never sees it;
    a silent connection dies cleanly.

Also: switched both http.Server's ReadTimeout (10 s, applies to the
WHOLE request including streaming bodies, wrong for a server that
ingests source audio over PUT/SOURCE) to ReadHeaderTimeout. Same
slowloris protection without penalising long-running uploads.

Author: DatanoiseTV

server/handlers_stream.go

@@ -152,6 +152,15 @@ func (s *Server) handleSource(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	defer conn.Close()
+	// Per-read deadline on the source. Without it, a source that
+	// silently drops (network blip, encoder crash without FIN)
+	// holds the handler goroutine in bufrw.Read forever; the stream
+	// stays mounted, transcoders keep their input subscription, and
+	// the next reconnect from the same encoder leaves zombies. The
+	// deadline is refreshed after every successful read so a
+	// continuously-streaming source is never penalised — only
+	// genuinely silent connections die.
+	const sourceReadTimeout = 60 * time.Second
 
 	bufrw.WriteString("HTTP/1.0 200 OK\r\nServer: Icecast 2.4.4\r\nConnection: Keep-Alive\r\n\r\n")
 	bufrw.Flush()
@@ -178,6 +187,7 @@ func (s *Server) handleSource(w http.ResponseWriter, r *http.Request) {
 
 	buf := make([]byte, 8192)
 	for {
+		_ = conn.SetReadDeadline(time.Now().Add(sourceReadTimeout))
 		n, err := bufrw.Read(buf)
 		if n > 0 {
 			stream.Broadcast(buf[:n], s.Relay)
@@ -504,6 +514,22 @@ func (s *Server) serveStreamData(w http.ResponseWriter, r *http.Request, stream
 		}
 	}
 
+	// Per-write deadline. Without it, a Write to a slow / dead /
+	// half-disconnected listener blocks forever — the handler
+	// goroutine sits in TCP-write-blocked state, the listener slot
+	// stays registered on the stream, and the conn ends up in
+	// CLOSE_WAIT. With many of those accumulating, the runtime ran
+	// out of usable handler slots and NEW HTTPS requests started
+	// timing out wholesale (recurring "i/o timeout" symptom).
+	//
+	// 30 s is conservative — typical TCP send to a healthy listener
+	// returns in <1 ms; 30 s only fires when the kernel send buffer
+	// is full and not draining (i.e. the receiver is gone). On
+	// deadline expiry Write returns an error → we exit the handler →
+	// Unsubscribe runs → the conn cleans up.
+	rc := http.NewResponseController(w)
+	const writeTimeout = 30 * time.Second
+
 	// 64 KiB read chunk: we flush after draining the buffer on each signal,
 	// so a larger chunk means fewer syscalls / TCP writes per second without
 	// adding latency. 4 KiB was causing tiny-segment writes whenever the
@@ -573,6 +599,7 @@ func (s *Server) serveStreamData(w http.ResponseWriter, r *http.Request, stream
 				}
 				offset = next
 
+				_ = rc.SetWriteDeadline(time.Now().Add(writeTimeout))
 				if _, err := out.Write(buf[:n]); err != nil {
 					return false
 				}
@@ -592,6 +619,7 @@ func (s *Server) serveStreamData(w http.ResponseWriter, r *http.Request, stream
 						res[0] = byte(l)
 						copy(res[1:], meta)
 
+						_ = rc.SetWriteDeadline(time.Now().Add(writeTimeout))
 						if _, err := w.Write(res); err != nil {
 							return false
 						}

server/listener.go

@@ -280,11 +280,18 @@ func (s *Server) startHTTPS(handler http.Handler, addr string) error {
 	}
 
 	httpsSrv := &http.Server{
-		Addr:         httpsAddr,
-		Handler:      handler,
-		ReadTimeout:  10 * time.Second,
-		WriteTimeout: 0,
-		IdleTimeout:  120 * time.Second,
+		Addr:    httpsAddr,
+		Handler: handler,
+		// ReadHeaderTimeout instead of ReadTimeout — the latter
+		// bounds the WHOLE request including streaming bodies,
+		// which is wrong for source ingest. Headers must be in
+		// within 10 s; bodies use their own per-read deadline
+		// (handleSource refreshes a 60 s deadline on every Read).
+		// Listener writes get a per-write deadline via
+		// http.NewResponseController inside the handler.
+		ReadHeaderTimeout: 10 * time.Second,
+		WriteTimeout:      0,
+		IdleTimeout:       120 * time.Second,
 	}
 	if s.certManager != nil {
 		httpsSrv.TLSConfig = s.certManager.TLSConfig()
@@ -312,8 +319,11 @@ func (s *Server) startHTTPS(handler http.Handler, addr string) error {
 			}
 			http.Redirect(w, r, target, http.StatusMovedPermanently)
 		}),
-		ReadTimeout: 10 * time.Second,
-		IdleTimeout: 120 * time.Second,
+		// Same rationale as the HTTPS server above: ReadHeaderTimeout
+		// caps slowloris attacks without breaking PUT/SOURCE streams
+		// that use Hijack and do their own per-read deadlines.
+		ReadHeaderTimeout: 10 * time.Second,
+		IdleTimeout:       120 * time.Second,
 	}
 	s.httpServers = append(s.httpServers, httpSrv)