YARN-11845. WebAppProxy add Connection close header to prevent CLOSE_WAIT leaks

[sohurdc]

YARN-11845. WebAppProxy: add Connection: close header to prevent CLOSE_WAIT leaks

Description of PR

This PR fixes an accumulation of sockets stuck in CLOSE_WAIT state on the
ResourceManager host that runs the WebAppProxy.

WebAppProxyServlet.proxyLink() creates a brand-new HttpClient for every
proxied request (HttpClientBuilder.create() → build()), sends the request,
and only calls base.releaseConnection() afterward. It never closes the
HttpClient itself.

Apache HttpClient enables connection pooling / keep-alive by default, so the
backend (Application Master or History Server) keeps the connection open after
returning the response, waiting to reuse it. But since the proxy throws away
the HttpClient right after each request, that pooled connection can never be
reused. The corresponding socket on the proxy side therefore lingers in
CLOSE_WAIT until the HttpClient is finally garbage collected.

The fix is to explicitly ask the backend to close the connection once the
response has been sent, by setting a Connection: close request header on the
outgoing request:

base.setHeader("Connection", "close");

Because Connection is not in PASS_THROUGH_HEADERS, a client-supplied
Connection: keep-alive header is never forwarded, so the proxy always sends
close and the backend closes the connection as soon as the response is
written.

How was this patch tested?

• Added testWebAppProxyConnectionCloseHeader() in
  TestWebAppProxyServlet, which verifies that the proxied backend receives a
  Connection: close header in three cases:
  1. a plain GET request,
  2. a GET request where the client explicitly sends Connection: keep-alive
     (asserting the proxy overrides it with close),
  3. a PUT request (asserting the header is also set on the PUT path).
• The existing testWebAppProxyPassThroughHeaders assertion (9 headers
  received by the backend) is unaffected: the Connection header was already
  among the counted headers, only its value changes from Keep-Alive to
  close.

For code changes

• The title of this PR accurately describes the issue.
• The code follows the project's style guidelines.
• New tests are added, and existing tests still pass.
• No user-facing API/behavior change is introduced (the proxy continues to
  return the same responses; it only instructs the backend to close the
  underlying connection).

Additional notes

• Connection: close does not change the response returned to the client; it
  only affects the lifetime of the internal proxied connection, so it has no
  user-visible impact.
• This is a one-line, low-risk change scoped to the web-proxy module.

Commit message

YARN-11845. WebAppProxy: add Connection: close header to prevent CLOSE_WAIT socket buildup. Contributed by weishao <weishao@sohu-inc.com>.

WebAppProxyServlet.proxyLink() creates a new HttpClient per request and never
closes it. With keep-alive enabled by default, the backend keeps the proxied
connection open and the proxy-side socket lingers in CLOSE_WAIT until GC.
Explicitly setting Connection: close makes the backend close the connection
after each response.

[Copilot]

Pull request overview

This PR aims to prevent socket accumulation in CLOSE_WAIT on the YARN WebAppProxy host by forcing proxied backend requests (AM/History Server) to close the connection after each response.

Changes:

• Add Connection: close request header to proxied requests in WebAppProxyServlet.proxyLink().
• Extend TestWebAppProxyServlet to capture the backend-received Connection header and add a new test covering GET/PUT and client keep-alive override behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

File	Description
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/WebAppProxyServlet.java	Sets Connection: close on outgoing proxied requests to avoid backend keep-alive behavior contributing to socket retention.
hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/test/java/org/apache/hadoop/yarn/server/webproxy/TestWebAppProxyServlet.java	Adds a targeted test validating that the backend receives Connection: close and that client keep-alive is overridden; captures the header in the embedded backend servlet.

Suppressed comments (1)

hadoop-yarn-project/hadoop-yarn/hadoop-yarn-server/hadoop-yarn-server-web-proxy/src/main/java/org/apache/hadoop/yarn/server/webproxy/WebAppProxyServlet.java:320

• HttpClientBuilder.build() returns a CloseableHttpClient, but proxyLink() never closes the client (or the response), only base.releaseConnection(). Adding Connection: close may reduce socket retention on the backend side, but it doesn’t address the underlying client lifecycle leak and can still leave resources tied to the per-request connection manager until GC.

    base.setHeader("Connection", "close");
    String user = req.getRemoteUser();
    if (user != null && !user.isEmpty()) {
      base.setHeader("Cookie",
          PROXY_USER_COOKIE_NAME + "=" + URLEncoder.encode(user, "ASCII"));

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.