Changeset 576

Timestamp:

18/05/08 17:53:13 (7 months ago)

Author:

smoku

Message:

Merged asynchronous domain resolving in s2s component support by Simon Arlott. Closes #206 #208 #216

Location:

trunk

Files:

• AUTHORS (modified) (1 diff)
• configure.ac (modified) (2 diffs)
• etc/jabberd.cfg.dist.in (modified) (1 diff)
• etc/Makefile.am (modified) (1 diff)
• etc/resolver.xml.dist.in (modified) (1 diff)
• etc/s2s.xml.dist.in (modified) (4 diffs)
• Makefile.am (modified) (1 diff)
• man/Makefile.am (modified) (1 diff)
• man/resolver.8.in (modified) (1 diff)
• mio/mio.h (modified) (2 diffs)
• mio/mio_impl.h (modified) (1 diff)
• resolver (deleted)
• s2s/in.c (modified) (1 diff)
• s2s/main.c (modified) (20 diffs)
• s2s/out.c (modified) (24 diffs)
• s2s/router.c (modified) (1 diff)
• s2s/s2s.h (modified) (14 diffs)
• util/jqueue.c (modified) (2 diffs)
• util/util.h (modified) (2 diffs)

trunk/AUTHORS

@@ -159 +159 @@
     - XEP-0054 completness, server vcards
 
+  Simon Arlott
+    - asunchronous DNS resolver for s2s
+    - TLS certificates for each vhost
+    - misc fixes
+
 Thanks also go to the testers and bug reporters out there - you know who
 you are. Special thanks in this capacity to Justin Kirby, whose many

trunk/configure.ac

@@ -367 +367 @@
 fi
 
+# udns
+AC_CHECK_LIB(udns, dns_init)
+if test "x-$ac_cv_lib_udns_dns_init" != "x-yes" ; then
+    AC_MSG_ERROR([UDNS library not found])
+fi
+
 #
 # SASL backend selection
@@ -921 +927 @@
                  storage/Makefile
                  c2s/Makefile
-                 resolver/Makefile
                  router/Makefile
                  s2s/Makefile

trunk/etc/jabberd.cfg.dist.in

@@ -14 +14 @@
 
 @jabberd_router_bin@      @sysconfdir@/router.xml
-@jabberd_resolver_bin@    @sysconfdir@/resolver.xml
 @jabberd_sm_bin@          @sysconfdir@/sm.xml
 @jabberd_s2s_bin@         @sysconfdir@/s2s.xml

trunk/etc/Makefile.am

@@ -1 @@
-sysconf_DATA = c2s.xml.dist resolver.xml.dist router.xml.dist s2s.xml.dist sm.xml.dist jabberd.cfg.dist router-users.xml.dist router-filter.xml.dist
-EXTRA_DIST = c2s.xml.dist.in resolver.xml.dist.in router.xml.dist.in s2s.xml.dist.in sm.xml.dist.in jabberd.cfg.dist.in router-users.xml.dist.in router-filter.xml.dist.in
+sysconf_DATA = c2s.xml.dist router.xml.dist s2s.xml.dist sm.xml.dist jabberd.cfg.dist router-users.xml.dist router-filter.xml.dist
+EXTRA_DIST = c2s.xml.dist.in router.xml.dist.in s2s.xml.dist.in sm.xml.dist.in jabberd.cfg.dist.in router-users.xml.dist.in router-filter.xml.dist.in
 
 SUBDIRS = templates
 
-jabberd_bin = router resolver sm s2s c2s
+jabberd_bin = router sm s2s c2s
 
 edit = sed \

trunk/etc/resolver.xml.dist.in

@@ -1 @@
-<!-- Resolver configuration -->
-<resolver>
-  <!-- Our id on the network (default: resolver) -->
-  <id>resolver</id>
-
-  <!-- The process ID file. Comment this out if you don't need to know
-       the process ID from outside the process (eg for control scripts) -->
-  <pidfile>@localstatedir@/jabberd/pid/resolver.pid</pidfile>
-
-  <!-- Router connection configuration -->
-  <router>
-    <!-- IP/port the router is waiting for connections on -->
-    <ip>127.0.0.1</ip>            <!-- default: 127.0.0.1 -->
-    <port>5347</port>             <!-- default: 5347 -->
-
-    <!-- Username/password to authenticate as -->
-    <user>jabberd</user>          <!-- default: jabberd -->
-    <pass>secret</pass>           <!-- default: secret -->
-
-    <!-- File containing an SSL certificate and private key to use when
-         setting up an encrypted channel with the router. From
-         SSL_CTX_use_certificate_chain_file(3): "The certificates must be
-         in PEM format and must be sorted starting with the subject's
-         certificate (actual client or server certificate), followed
-         by intermediate CA certificates if applicable, and ending
-         at the highest level (root) CA" (the latter one being optional).
-         If this is commented out, or the file can't be read, no attempt
-         will be made to establish an encrypted channel with the router. -->
-    <!--
-    <pemfile>@sysconfdir@/server.pem</pemfile>
-    -->
-
-    <!-- Router connection retry -->
-    <retry>
-      <!-- If the connection to the router can't be established at
-           startup, we should try again this many times before exiting.
-           Use -1 to retry indefinitely. [default: 3] -->
-      <init>3</init>
-
-      <!-- If we lost the connection to the router during normal
-           operation (ie we've successfully connected to the router in
-           the past), we should try to reconnect this many times before
-           exiting. Use -1 to retry indefinitely. [default: 3] -->
-      <lost>3</lost>
-
-      <!-- Sleep for this many seconds before trying attempting a
-           reconnect. [default: 2] -->
-      <sleep>2</sleep>
-    </retry>
-  </router>
-
-  <!-- Log configuration - type is "syslog", "file" or "stdout" -->
-  <log type='syslog'>
-    <!-- If logging to syslog, this is the log ident -->
-    <ident>jabberd/resolver</ident>
-
-    <!-- If logging to syslog, this is the log facility
-         (local0 - local7)                        [default: local3] -->
-    <facility>local3</facility>
-
-    <!-- If logging to file, this is the filename of the logfile -->
-    <!--
-    <file>@localstatedir@/jabberd/log/resolver.log</file>
-    -->
-  </log>
-
-  <!-- SRV records will be resolved in the following order. The first
-       one that returns something will be used (ie dereferenced via an
-       A/AAAA lookup). If no SRV records are found, resolver will
-       fallback to a straight A/AAAA lookup. -->
-  <lookup>
-    <!-- _xmpp-server._tcp is mandated by the XMPP spec -->
-    <srv>_xmpp-server._tcp</srv>
-
-    <!-- traditionally, _jabber._tcp has been used -->
-    <srv>_jabber._tcp</srv>
-  </lookup>
-
-  <!-- If this is enabled, the resolver will look up AAAA records as well
-       as A records. This is needed if you want s2s to use IPv6. -->
-  <!--
-  <ipv6/>
-  -->
-
-</resolver>
-<!--
-  vim: syntax=xml
--->

trunk/etc/s2s.xml.dist.in

@@ -149 +149 @@
          Checks will be run every n seconds.
 
-         0 disables all checks.                       (default: 60) -->
+         0 disables all checks except DNS expiry.     (default: 60) -->
     <interval>60</interval>
 
@@ -164 +164 @@
          3. Completing dialback (incoming and outgoing)
 
+         If stage 1 connection establishment fails and there are
+         alternative hosts for this route that have not failed 
+         recently, they will be tried too before finally giving up.
+
          0 disables queue expiry.                     (default: 60) -->
     <queue>60</queue>
 
+    <!-- Queue retry timeout.
+
+         If the queue is older than this timeout, the connection
+         will not be retried even if there are alternative hosts
+         that have not failed recently.
+
+         0 disables retry expiry.                    (default: 300) -->
+    <retry>300</retry>
+
     <!-- Idle connection checks.
 
-           Connections that have not sent data for longer than this many
-           seconds will be dropped.
-
-           0 disables idle timeouts.              (default: 86400) -->
+         Connections that have not sent data for longer than this many
+         seconds will be dropped.
+
+         0 disables idle timeouts.                 (default: 86400) -->
     <idle>86400</idle>
 
@@ -185 +198 @@
     <keepalive>0</keepalive>
 
+    <!-- Interval between DNS result/bad host expiry.
+
+         0 disables expiry checks.                 (default: 300) -->
+    <dnscache>300</dnscache>
   </check>
 
@@ -195 +212 @@
   </stats>
 
+  <lookup>
+     <!-- SRV TCP services will be resolved in the following order. The first
+          one that returns something will be used (ie dereferenced via an
+          A/AAAA lookup). If no SRV records are found, resolver will
+          fallback to a straight A/AAAA lookup. -->
+
+    <!-- xmpp-server is mandated by the XMPP spec -->
+    <srv>xmpp-server</srv>
+
+    <!-- traditionally, jabber has been used -->
+    <srv>jabber</srv>
+
+
+    <!-- If this is enabled, the resolver will look up AAAA records as well
+         as A records. This is needed if you want s2s to use IPv6.
+         Connection attempts will be made to all IPv6 hosts before trying
+         IPv4 (see bad host timeout below). -->
+    <!--
+    <resolve-ipv6/>
+    -->
+
+    <!-- Minimum time that DNS lookup results are cached (overrides max below). -->
+    <min-ttl>30</min-ttl>
+
+    <!-- Maximum time that DNS lookup results are cached. -->
+    <max-ttl>86400</max-ttl>
+
+    <!-- Minimum time to wait before using hosts that we have failed to
+         establish a connection to (unless there are no alternatives).
+         Do not set this too low - it is required to detect permanent
+         problems like broken IPv6 connectivity in order to attempt IPv4.
+
+         0 disables bad host caching.               (default: 3600) -->
+    <bad-host-timeout>3600</bad-host-timeout>
+
+    <!-- Disable the DNS cache (negative caching will still be done).
+         This is likely to negatively impact performance while saving
+         a small amount of memory since multiple DNS requests must
+         then be made for every re-connection. -->
+    <!--
+    <no-cache/>
+    -->
+  </lookup>
+
+  <!-- If this is enabled, domains which share the same host will re-use
+       existing outgoing connections. This is a potential security risk
+       as the SSL connection from the first domain will be re-used too. -->
+  <out-reuse-conn/>
 </s2s>
 <!--

trunk/Makefile.am

@@ -1 +1 @@
 EXTRA_DIST = Doxyfile.in README.win32 README.protocol contrib UPGRADE
 
-SUBDIRS = etc tools man mio subst sx util c2s resolver router s2s sm storage
+SUBDIRS = etc tools man mio subst sx util c2s router s2s sm storage
 
 .PHONY: docs

trunk/man/Makefile.am

@@ -1 @@
-man_MANS = jabberd.8 c2s.8 resolver.8 router.8 s2s.8 sm.8
-EXTRA_DIST = jabberd.8.in c2s.8.in resolver.8.in router.8.in s2s.8.in sm.8.in
+man_MANS = jabberd.8 c2s.8 router.8 s2s.8 sm.8
+EXTRA_DIST = jabberd.8.in c2s.8.in router.8.in s2s.8.in sm.8.in
 
-jabberd_bin = router resolver sm s2s c2s
+jabberd_bin = router sm s2s c2s
 
 edit = sed \

trunk/man/resolver.8.in

@@ -1 @@
-.TH @jabberd_resolver_bin@ 8 "28 August 2003" "@VERSION@" "jabberd project"
-.SH NAME
-@jabberd_resolver_bin@ \- DNS resolver
-.SH SYNOPSIS
-.B @jabberd_resolver_bin@
-.I [-h] [-c config] [-D]
-.SH DESCRIPTION
-.BR @jabberd_resolver_bin@
-is a helper component for s2s. It performs DNS lookups of external servers as required.
-.SH OPTIONS
-.TP
-.B \-h
-Show summary of options.
-.TP
-.B \-c
-Alternate configuration file to use. The compiled-in default is @sysconfdir@/resolver.xml.
-.TP
-.B \-D
-Print debugging output. You should configure jabberd with the --enable-debug switch to enable this.
-.SH SEE ALSO
-.BR jabberd (8)
-.BR @jabberd_c2s_bin@ (8)
-.BR @jabberd_router_bin@ (8)
-.BR @jabberd_s2s_bin@ (8)
-.BR @jabberd_sm_bin@ (8)
-.SH AUTHOR
-Robert Norris <rob@cataclysm.cx>

trunk/mio/mio.h

@@ -116 +116 @@
                                    mio_handler_t app, void *arg);
 
+  struct mio_fd_st *(*mio_register)(struct mio_st **m, int fd,
+                                   mio_handler_t app, void *arg);
+
   void (*mio_app)(struct mio_st **m, struct mio_fd_st *fd,
                   mio_handler_t app, void *arg);
@@ -140 +143 @@
 #define mio_connect(m, port, hostip, app, arg) \
     (*m)->mio_connect(m, port, hostip, app, arg)
+
+/** for adding an existing socket connected to this mio */
+#define mio_register(m, fd, app, arg) \
+    (*m)->mio_register(m, fd, app, arg)
 
 /** re-set the app handler */

trunk/mio/mio_impl.h

@@ -447 +447 @@
     static struct mio_st mio_impl = {
         _mio_free,
-        _mio_listen, _mio_connect,
+        _mio_listen, _mio_connect, _mio_setup_fd,
         _mio_app,
         _mio_close,

trunk/s2s/in.c

@@ -140 +140 @@
 
 #ifdef HAVE_SSL
-            sx_server_init(in->s, S2S_DB_HEADER | ((s2s->local_pemfile != NULL) ? SX_SSL_STARTTLS_OFFER : 0) );
+            sx_server_init(in->s, S2S_DB_HEADER | ((s2s->sx_ssl != NULL) ? SX_SSL_STARTTLS_OFFER : 0) );
 #else
             sx_server_init(in->s, S2S_DB_HEADER);

trunk/s2s/main.c

@@ -67 +67 @@
 static void _s2s_config_expand(s2s_t s2s) {
     char *str, secret[41];
+    config_elem_t elem;
     int i, r;
 
@@ -121 +122 @@
     s2s->local_port = j_atoi(config_get_one(s2s->config, "local.port", 0), 0);
 
-    s2s->local_resolver = config_get_one(s2s->config, "local.resolver", 0);
-    if(s2s->local_resolver == NULL)
-        s2s->local_resolver = "resolver";
-
     if(config_get(s2s->config, "local.secret") != NULL)
         s2s->local_secret = strdup(config_get_one(s2s->config, "local.secret", 0));
@@ -152 +149 @@
     s2s->check_keepalive = j_atoi(config_get_one(s2s->config, "check.keepalive", 0), 0);
     s2s->check_idle = j_atoi(config_get_one(s2s->config, "check.idle", 0), 86400);
-
+    s2s->check_dnscache = j_atoi(config_get_one(s2s->config, "check.dnscache", 0), 300);
+    s2s->retry_limit = j_atoi(config_get_one(s2s->config, "check.retry", 0), 300);
+
+    if((elem = config_get(s2s->config, "lookup.srv")) != NULL) {
+        s2s->lookup_srv = elem->values;
+        s2s->lookup_nsrv = elem->nvalues;
+    }
+
+    s2s->resolve_aaaa = config_count(s2s->config, "lookup.ipv6") ? 1 : 0;
+    s2s->dns_cache_enabled = config_count(s2s->config, "lookup.no-cache") ? 0 : 1;
+    s2s->dns_bad_timeout = j_atoi(config_get_one(s2s->config, "lookup.bad-host-timeout", 0), 3600);
+    s2s->dns_min_ttl = j_atoi(config_get_one(s2s->config, "lookup.min-ttl", 0), 30);
+    if (s2s->dns_min_ttl < 5)
+        s2s->dns_min_ttl = 5;
+    s2s->dns_max_ttl = j_atoi(config_get_one(s2s->config, "lookup.max-ttl", 0), 86400);
+    s2s->out_reuse = config_count(s2s->config, "out-conn-reuse") ? 1 : 0;
 }
 
@@ -273 +285 @@
     conn_t conn;
     time_t now;
-    char *domain, ipport[INET6_ADDRSTRLEN + 17], *key;
+    char *rkey, *key;
     jqueue_t q;
     dnscache_t dns;
+    char *c;
     union xhashv xhv;
 
@@ -285 +298 @@
             do {
                 xhv.jq_val = &q;
-                xhash_iter_get(s2s->outq, (const char **) &domain, xhv.val);
-
-                log_debug(ZONE, "running time checks for %s", domain);
+                xhash_iter_get(s2s->outq, (const char **) &rkey, xhv.val);
+
+                log_debug(ZONE, "running time checks for %s", rkey);
+                c = strchr(rkey, '/');
+                c++;
 
                 /* dns lookup timeout check first */
-                dns = xhash_get(s2s->dnscache, domain);
-                if(dns == NULL)
-                    continue;
-
-                if(dns->pending) {
-                    log_debug(ZONE, "dns lookup pending for %s", domain);
+                dns = xhash_get(s2s->dnscache, c);
+                if(dns != NULL && dns->pending) {
+                    log_debug(ZONE, "dns lookup pending for %s", c);
                     if(now > dns->init_time + s2s->check_queue) {
-                        log_write(s2s->log, LOG_NOTICE, "dns lookup for %s timed out", domain);
+                        log_write(s2s->log, LOG_NOTICE, "dns lookup for %s timed out", c);
 
                         /* bounce queue */
-                        out_bounce_queue(s2s, domain, stanza_err_REMOTE_SERVER_NOT_FOUND);
+                        out_bounce_route_queue(s2s, rkey, stanza_err_REMOTE_SERVER_NOT_FOUND);
 
                         /* expire pending dns entry */
                         xhash_zap(s2s->dnscache, dns->name);
+                        xhash_free(dns->results);
+                        if (dns->query != NULL) {
+                            if (dns->query->query != NULL)
+                                dns_cancel(NULL, dns->query->query);
+                            xhash_free(dns->query->hosts);
+                            xhash_free(dns->query->results);
+                            free(dns->query->name);
+                            free(dns->query);
+                        }
                         free(dns);
                     }
@@ -310 +331 @@
                 }
 
-                /* generate the ip/port pair */
-                snprintf(ipport, INET6_ADDRSTRLEN + 16, "%s/%d", dns->ip, dns->port);
-
                 /* get the conn */
-                conn = xhash_get(s2s->out, ipport);
+                conn = xhash_get(s2s->out_dest, c);
                 if(conn == NULL) {
                     if(jqueue_size(q) > 0) {
                        /* no pending conn? perhaps it failed? */
-                       log_debug(ZONE, "no pending connection for %s, bouncing %i packets in queue", domain, jqueue_size(q));
+                       log_debug(ZONE, "no pending connection for %s, bouncing %i packets in queue", c, jqueue_size(q));
 
                        /* bounce queue */
-                       out_bounce_queue(s2s, domain, stanza_err_REMOTE_SERVER_TIMEOUT);
+                       out_bounce_route_queue(s2s, rkey, stanza_err_REMOTE_SERVER_TIMEOUT);
                     }
 
@@ -329 +347 @@
                 /* connect timeout check */
                 if(!conn->online && now > conn->init_time + s2s->check_queue) {
-                    log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] connection to %s timed out", conn->fd->fd, conn->ip, conn->port, domain);
-
-                    /* bounce queue */
-                    out_bounce_queue(s2s, domain, stanza_err_REMOTE_SERVER_TIMEOUT);
+                    dnsres_t bad;
+                    char *ipport;
+
+                    log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] connection to %s timed out", conn->fd->fd, conn->ip, conn->port, c);
+
+                    if (s2s->dns_bad_timeout > 0) {
+                        /* mark this host as bad */
+                        ipport = dns_make_ipport(conn->ip, conn->port);
+                        bad = xhash_get(s2s->dns_bad, ipport);
+                        if (bad == NULL) {
+                            bad = (dnsres_t) calloc(1, sizeof(struct dnsres_st));
+                            bad->key = ipport;
+                            xhash_put(s2s->dns_bad, ipport, bad);
+                        } else {
+                            free(ipport);
+                        }
+                        bad->expiry = time(NULL) + s2s->dns_bad_timeout;
+                    }
 
                     /* close connection as per XMPP/RFC3920 */
+                    /* the close function will retry or bounce the queue */
                     sx_close(conn->s);
-
                 }
             } while(xhash_iter_next(s2s->outq));
@@ -345 +377 @@
 
         /* outgoing connections */
-        if(xhash_iter_first(s2s->out))
-            do {
-                xhv.conn_val = &conn;
-                xhash_iter_get(s2s->out, (const char **) &key, xhv.val);
-                log_debug(ZONE, "checking dialback state for outgoing conn %s", key);
-                if (_s2s_check_conn_routes(s2s, conn, "outgoing")) {
-                    log_debug(ZONE, "checking pending verify requests for outgoing conn %s", key);
-                    if (conn->verify > 0 && now > conn->last_verify + s2s->check_queue) {
-                        log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] dialback verify request timed out", conn->fd->fd, conn->ip, conn->port);
-                        sx_error(conn->s, stream_err_CONNECTION_TIMEOUT, "dialback verify request timed out");
-                        sx_close(conn->s);
+        if(s2s->out_reuse) {
+            if(xhash_iter_first(s2s->out_host))
+                do {
+                    xhv.conn_val = &conn;
+                    xhash_iter_get(s2s->out_host, (const char **) &key, xhv.val);
+                    log_debug(ZONE, "checking dialback state for outgoing conn %s", key);
+                    if (_s2s_check_conn_routes(s2s, conn, "outgoing")) {
+                        log_debug(ZONE, "checking pending verify requests for outgoing conn %s", key);
+                        if (conn->verify > 0 && now > conn->last_verify + s2s->check_queue) {
+                            log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] dialback verify request timed out", conn->fd->fd, conn->ip, conn->port);
+                            sx_error(conn->s, stream_err_CONNECTION_TIMEOUT, "dialback verify request timed out");
+                            sx_close(conn->s);
+                        }
                     }
-                }
-            } while(xhash_iter_next(s2s->out));
+                } while(xhash_iter_next(s2s->out_host));
+        } else {
+            if(xhash_iter_first(s2s->out_dest))
+                do {
+                    xhv.conn_val = &conn;
+                    xhash_iter_get(s2s->out_dest, (const char **) &key, xhv.val);
+                    log_debug(ZONE, "checking dialback state for outgoing conn %s (%s)", conn->dkey, conn->key);
+                    if (_s2s_check_conn_routes(s2s, conn, "outgoing")) {
+                        log_debug(ZONE, "checking pending verify requests for outgoing conn %s (%s)", conn->dkey, conn->key);
+                        if (conn->verify > 0 && now > conn->last_verify + s2s->check_queue) {
+                            log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] dialback verify request timed out", conn->fd->fd, conn->ip, conn->port);
+                            sx_error(conn->s, stream_err_CONNECTION_TIMEOUT, "dialback verify request timed out");
+                            sx_close(conn->s);
+                        }
+                    }
+                } while(xhash_iter_next(s2s->out_dest));
+        }
 
         /* incoming open streams */
@@ -392 +441 @@
 
     /* keepalives */
-    if(xhash_iter_first(s2s->out))
-        do {
-            xhv.conn_val = &conn;
-            xhash_iter_get(s2s->out, NULL, xhv.val);
-
-            if(s2s->check_keepalive > 0 && conn->last_activity > 0 && now > conn->last_activity + s2s->check_keepalive && conn->s->state >= state_STREAM) {
-                log_debug(ZONE, "sending keepalive for %d", conn->fd->fd);
-
-                sx_raw_write(conn->s, " ", 1);
-            }
-        } while(xhash_iter_next(s2s->out));
+    if(s2s->out_reuse) {
+        if(xhash_iter_first(s2s->out_host))
+            do {
+                xhv.conn_val = &conn;
+                xhash_iter_get(s2s->out_host, NULL, xhv.val);
+
+                if(s2s->check_keepalive > 0 && conn->last_activity > 0 && now > conn->last_activity + s2s->check_keepalive && conn->s->state >= state_STREAM) {
+                    log_debug(ZONE, "sending keepalive for %d", conn->fd->fd);
+
+                    sx_raw_write(conn->s, " ", 1);
+                }
+            } while(xhash_iter_next(s2s->out_host));
+    } else {
+        if(xhash_iter_first(s2s->out_dest))
+            do {
+                xhv.conn_val = &conn;
+                xhash_iter_get(s2s->out_dest, NULL, xhv.val);
+
+                if(s2s->check_keepalive > 0 && conn->last_activity > 0 && now > conn->last_activity + s2s->check_keepalive && conn->s->state >= state_STREAM) {
+                    log_debug(ZONE, "sending keepalive for %d", conn->fd->fd);
+
+                    sx_raw_write(conn->s, " ", 1);
+                }
+            } while(xhash_iter_next(s2s->out_dest));
+    }
 
     /* idle timeouts - disconnect connections through which no packets have been sent for <idle> seconds */
     if(s2s->check_idle > 0) {
 
-       /* outgoing connections */
-        if(xhash_iter_first(s2s->out))
-            do {
-                xhv.conn_val = &conn;
-                xhash_iter_get(s2s->out, (const char **) &key, xhv.val);
-                log_debug(ZONE, "checking idle state for %s", key);
-                if (conn->last_packet > 0 && now > conn->last_packet + s2s->check_idle && conn->s->state >= state_STREAM) {
-                    log_write(s2s->log, LOG_NOTICE, "[%d] [%s, port=%d] idle timeout", conn->fd->fd, conn->ip, conn->port)