vey-icap-client: add tcp_connect_timeout for ICAP TCP connect

Black-holed ICAP peers previously blocked until the OS SYN timeout
before bypass could apply. Default is 1s.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: zh-jq

lib/vey-icap-client/src/service/config/mod.rs

@@ -35,6 +35,7 @@ pub struct IcapServiceConfig {
     pub(crate) tls_name: ServerName<'static>,
     pub(crate) connection_pool: ConnectionPoolConfig,
     pub(crate) tcp_keepalive: TcpKeepAliveConfig,
+    pub(crate) tcp_connect_timeout: Duration,
     #[cfg(unix)]
     pub(crate) use_unix_socket: Option<PathBuf>,
     pub(crate) icap_206_enable: bool,
@@ -80,6 +81,7 @@ impl IcapServiceConfig {
             tls_name,
             connection_pool: ConnectionPoolConfig::default(),
             tcp_keepalive: TcpKeepAliveConfig::default_enabled(),
+            tcp_connect_timeout: Duration::from_secs(1),
             #[cfg(unix)]
             use_unix_socket: None,
             icap_206_enable: false,
@@ -95,6 +97,10 @@ impl IcapServiceConfig {
         self.tcp_keepalive = config;
     }
 
+    pub fn set_tcp_connect_timeout(&mut self, time: Duration) {
+        self.tcp_connect_timeout = time;
+    }
+
     pub fn set_tls_client(&mut self, config: RustlsClientConfigBuilder) {
         self.tls_client = Some(config);
     }
@@ -203,6 +209,7 @@ mod tests {
         let mut config = IcapServiceConfig::new(IcapMethod::Reqmod, url).unwrap();
         assert!(config.tls_client.is_none());
         assert_eq!(config.upstream.port(), 1344);
+        assert_eq!(config.tcp_connect_timeout, Duration::from_secs(1));
         config.user_agent = Some("vey-test/1.0".to_string());
 
         let header = String::from_utf8(config.build_request_header()).unwrap();

lib/vey-icap-client/src/service/config/yaml.rs

@@ -46,6 +46,12 @@ impl IcapServiceConfig {
                 config.set_tcp_keepalive(keepalive);
                 Ok(())
             }
+            "tcp_connect_timeout" => {
+                let connect_timeout = vey_yaml::humanize::as_duration(v)
+                    .context(format!("invalid humanize duration value for key {k}"))?;
+                config.set_tcp_connect_timeout(connect_timeout);
+                Ok(())
+            }
             #[cfg(unix)]
             "use_unix_socket" => {
                 let path = vey_yaml::value::as_absolute_path(v)
@@ -205,6 +211,7 @@ mod tests {
                   max_idle_count: 10
                   idle_timeout: 30s
                 disable_preview: true
+                tcp_connect_timeout: "3s"
                 respond_shared_names:
                   - "X-Header-1"
                   - "X-Header-2"
@@ -218,6 +225,10 @@ mod tests {
             config.tls_name,
             rustls_pki_types::ServerName::try_from("example.com").unwrap()
         );
+        assert_eq!(
+            config.tcp_connect_timeout,
+            std::time::Duration::from_secs(3)
+        );
         assert_eq!(
             config.tcp_keepalive.idle_time(),
             std::time::Duration::from_secs(60)
@@ -380,6 +391,14 @@ mod tests {
         );
         assert!(IcapServiceConfig::parse_respmod_service_yaml(&yaml, None).is_err());
 
+        let yaml = yaml_doc!(
+            r#"
+                url: "icap://example.com:1344/service"
+                tcp_connect_timeout: "-1s"
+            "#
+        );
+        assert!(IcapServiceConfig::parse_reqmod_service_yaml(&yaml, None).is_err());
+
         let yaml = yaml_doc!(
             r#"
                 respond_shared_names: false

lib/vey-icap-client/src/service/connection.rs

@@ -117,7 +117,9 @@ impl IcapConnector {
             &Default::default(),
             true,
         )?;
-        let stream = socket.connect(peer).await?;
+        let stream = tokio::time::timeout(self.config.tcp_connect_timeout, socket.connect(peer))
+            .await
+            .map_err(|_| io::Error::new(io::ErrorKind::TimedOut, "ICAP tcp connect timed out"))??;
 
         if let Some(client) = &self.tls_client {
             let tls_connector = TlsConnector::from(client.driver.clone());

sphinx/vey-values/configuration/values/audit.rst

@@ -88,6 +88,21 @@ If the value is a map, the following keys are supported:
 
   **default**: enabled with default value
 
+* tcp_connect_timeout
+
+  **optional**, **type**: :ref:`humanize duration <conf_value_humanize_duration>`
+
+  TCP connection timeout when establishing a connection to the ICAP server.
+  Without this bound, an unreachable (black-holed) ICAP endpoint can block each
+  audited request for the full OS SYN timeout before ``bypass`` can take effect.
+
+  **default**: 1s
+
+  .. availability::
+
+
+     - ``vey-proxy``: available since ``1.13.10``
+
 * icap_connection_pool
 
   **optional**, **type**: :ref:`connection pool <conf_value_connection_pool_config>`

vey-proxy/CHANGELOG

@@ -3,6 +3,7 @@ CHANGELOG
 Release notes for `vey-proxy`, ordered from newest to oldest.
 
 v1.13.10:
+ - Feature: add ICAP service `tcp_connect_timeout` (default 1s) so black-holed ICAP endpoints fail promptly and `bypass` can take effect
  - BUG FIX: ICAP `Host` includes the non-default port (and brackets IPv6 literals)
  - BUG FIX: ICAP OPTIONS requests include `Encapsulated: null-body=0` (RFC 3507)
  - BUG FIX: ICAP/ICAPS service URLs without an explicit port use defaults 1344 / 11344 instead of failing to parse