Add configurable idle connection timeout (ADO #39970)

doc/snippets/Microsoft.Data.SqlClient/SqlConnectionStringBuilder.xml

@@ -979,6 +979,31 @@ The following example converts an existing connection string from using SQL Serv
         </para>
       </remarks>
     </LoadBalanceTimeout>
+    <IdleTimeout>
+      <summary>
+        Gets or sets the maximum time, in seconds, that a connection can sit unused (idle) in the connection pool before it is discarded. The default is 300 (5 minutes).
+      </summary>
+      <value>
+        The idle timeout for pooled connections, in seconds.
+      </value>
+      <remarks>
+        <para>
+          This property corresponds to the "Connection Idle Timeout" key within the connection string.
+        </para>
+        <para>
+          In versions where the AppContext switch <c>Switch.Microsoft.Data.SqlClient.UseLegacyIdleTimeoutBehavior</c> is enabled (the default), the driver preserves historical pooling behavior and does not enforce this setting. Set the switch to <see langword="false" /> to enable idle-timeout enforcement.
+        </para>
+        <para>
+          The driver makes a best effort to discard connections that have remained idle in the pool for longer than this value. The exact point in the connection lifecycle at which the check occurs is an implementation detail and may change over time. This protects callers from receiving connections that may have been silently closed by firewalls, load balancers, or server-side inactivity thresholds.
+        </para>
+        <para>
+          A value of zero (0) disables idle expiration; connections are kept in the pool indefinitely (subject to other expiry rules such as <see cref="P:Microsoft.Data.SqlClient.SqlConnectionStringBuilder.LoadBalanceTimeout" />).
+        </para>
+        <para>
+          Idle timeout operates independently of <see cref="P:Microsoft.Data.SqlClient.SqlConnectionStringBuilder.LoadBalanceTimeout" />. Whichever threshold is exceeded first causes the connection to be discarded.
+        </para>
+      </remarks>
+    </IdleTimeout>
     <MaxPoolSize>
       <summary>
         Gets or sets the maximum number of connections allowed in the connection pool for this specific connection string.

src/Microsoft.Data.SqlClient/ref/Microsoft.Data.SqlClient.cs

@@ -1368,6 +1368,10 @@ public SqlConnectionStringBuilder(string connectionString) { }
     [System.ComponentModel.DisplayNameAttribute("Load Balance Timeout")]
     [System.ComponentModel.RefreshPropertiesAttribute(System.ComponentModel.RefreshProperties.All)]
     public int LoadBalanceTimeout { get { throw null; } set { } }
+    /// <include file='../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionStringBuilder.xml' path='docs/members[@name="SqlConnectionStringBuilder"]/IdleTimeout/*'/>
+    [System.ComponentModel.DisplayNameAttribute("Connection Idle Timeout")]
+    [System.ComponentModel.RefreshPropertiesAttribute(System.ComponentModel.RefreshProperties.All)]
+    public int IdleTimeout { get { throw null; } set { } }
     /// <include file='../../../doc/snippets/Microsoft.Data.SqlClient/SqlConnectionStringBuilder.xml' path='docs/members[@name="SqlConnectionStringBuilder"]/MaxPoolSize/*'/>
     [System.ComponentModel.DisplayNameAttribute("Max Pool Size")]
     [System.ComponentModel.RefreshPropertiesAttribute(System.ComponentModel.RefreshProperties.All)]

src/Microsoft.Data.SqlClient/src/Microsoft/Data/Common/ConnectionString/DbConnectionStringDefaults.cs

@@ -36,6 +36,9 @@ internal static class DbConnectionStringDefaults
         internal const bool IntegratedSecurity = false;
         internal const SqlConnectionIPAddressPreference IpAddressPreference = SqlConnectionIPAddressPreference.IPv4First;
         internal const int LoadBalanceTimeout = 0; // default of 0 means don't use
+        // Default configured idle timeout is 5 minutes. Connection pool behavior is gated by
+        // LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior for compatibility.
+        internal const int IdleTimeout = 300;
         internal const int MaxPoolSize = 100;
         internal const int MinPoolSize = 0;
         internal const bool MultipleActiveResultSets = false;

src/Microsoft.Data.SqlClient/src/Microsoft/Data/Common/ConnectionString/DbConnectionStringKeywords.cs

@@ -31,6 +31,7 @@ internal static class DbConnectionStringKeywords
         internal const string IntegratedSecurity = "Integrated Security";
         internal const string IpAddressPreference = "IP Address Preference";
         internal const string LoadBalanceTimeout = "Load Balance Timeout";
+        internal const string IdleTimeout = "Connection Idle Timeout";
         internal const string MaxPoolSize = "Max Pool Size";
         internal const string MinPoolSize = "Min Pool Size";
         internal const string MultipleActiveResultSets = "Multiple Active Result Sets";

src/Microsoft.Data.SqlClient/src/Microsoft/Data/ProviderBase/DbConnectionInternal.cs

@@ -82,6 +82,11 @@ internal DbConnectionInternal(ConnectionState state, bool hidePassword, bool all
             ShouldHidePassword = hidePassword;
             State = state;
             CreateTime = DateTime.UtcNow;
+            // Initialize the returned-to-pool stamp to creation time so that a freshly built connection is treated
+            // as "just used" by the pool's idle-expiry checks until the pool's return path stamps it again on first return.
+            // Without this initialization, ReturnedTime would default to DateTime.MinValue, which would cause
+            // IsLiveConnection to immediately evict every new connection whenever IdleTimeout is configured.
+            ReturnedTime = CreateTime;
         }
 
         #region Properties
@@ -91,6 +96,15 @@ internal DbConnectionInternal(ConnectionState state, bool hidePassword, bool all
         /// </summary>
         internal DateTime CreateTime { get; }
 
+        /// <summary>
+        /// UTC timestamp of when this connection was last returned to the pool.
+        /// Stamped by <see cref="SetReturnedTime"/>. Initialized to <see cref="CreateTime"/> in the constructor
+        /// so a freshly built connection is treated as "just used" until its first return.
+        /// Internal setter exists to support deterministic unit tests without reflection.
+        /// The pool reads this value to decide whether the connection has sat idle longer than the configured idle timeout.
+        /// </summary>
+        internal DateTime ReturnedTime { get; set; }
+
         /// <summary>
         /// The pool generation at the time this connection was created or added to the pool.
         /// Used by <see cref="ChannelDbConnectionPool"/> to detect stale connections after a pool clear.
@@ -726,6 +740,17 @@ internal virtual void PrepareForReplaceConnection()
             // By default, there is no preparation required
         }
 
+        /// <summary>
+        /// Stamps <see cref="ReturnedTime"/> with the current UTC time. The pool calls this from its
+        /// return-to-pool path only when it intends the idle-timeout machinery to act on the value;
+        /// the connection owns the mechanism (recording the time) while the pool owns the policy
+        /// (deciding when a stamp is meaningful).
+        /// </summary>
+        internal void SetReturnedTime()
+        {
+            ReturnedTime = DateTime.UtcNow;
+        }
+
         internal void PrePush(DbConnection expectedOwner)
         {
             // Called by IDbConnectionPool when we're about to be put into it's pool, we take this

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ConnectionPool/ChannelDbConnectionPool.cs

@@ -264,6 +264,16 @@ public void ReturnInternalConnection(DbConnectionInternal connection, DbConnecti
             }
             else
             {
+                // Stamp the return time so IsLiveConnection can later evict the connection if it sits
+                // idle past the configured limit. Skip the stamp when idle expiry is disabled or the
+                // legacy idle-timeout behavior is in effect to avoid the per-return DateTime.UtcNow on
+                // the hot return path; IsLiveConnection short-circuits on the same conditions so the
+                // value would be unread in those cases.
+                if (!LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior &&
+                    PoolGroupOptions.IdleTimeout != TimeSpan.Zero)
+                {
+                    connection.SetReturnedTime();
+                }
                 var written = _idleChannel.TryWrite(connection);
                 Debug.Assert(written, "Failed to write returning connection to the idle channel.");
             }
@@ -453,6 +463,22 @@ public bool TryGetConnection(
         /// <returns>Returns true if the connection is live and unexpired, otherwise returns false.</returns>
         private bool IsLiveConnection(DbConnectionInternal connection)
         {
+            // Connection has been sitting idle longer than the configured idle timeout.
+            // Checked before the (potentially expensive) liveness probe so an idle-expired
+            // connection is discarded without an SNI round-trip.
+            // ReturnedTime is initialized to CreateTime so a freshly minted connection never trips this
+            // check on first retrieval, and is then stamped by ReturnInternalConnection on every return.
+            // Use subtraction rather than addition so the comparison cannot throw if ReturnedTime is
+            // ever close to DateTime.MaxValue. A clock skew that leaves ReturnedTime in the future
+            // produces a negative TimeSpan, which falls through as not-expired (fail safe).
+            TimeSpan idleTimeout = PoolGroupOptions.IdleTimeout;
+            if (!LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior &&
+                idleTimeout != TimeSpan.Zero &&
+                DateTime.UtcNow - connection.ReturnedTime > idleTimeout)
+            {
+                return false;
+            }
+
             // Broken physical connection
             if (!connection.IsConnectionAlive())
             {

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ConnectionPool/DbConnectionPoolOptions.cs

@@ -13,6 +13,7 @@ internal sealed class DbConnectionPoolGroupOptions
         private readonly int _maxPoolSize;
         private readonly int _creationTimeout;
         private readonly TimeSpan _loadBalanceTimeout;
+        private readonly TimeSpan _idleTimeout;
         private readonly bool _hasTransactionAffinity;
         private readonly bool _useLoadBalancing;
 
@@ -22,7 +23,8 @@ public DbConnectionPoolGroupOptions(
                                         int maxPoolSize,
                                         int creationTimeout,
                                         int loadBalanceTimeout,
-                                        bool hasTransactionAffinity
+                                        bool hasTransactionAffinity,
+                                        int idleTimeout
         )
         {
             _poolByIdentity = poolByIdentity;
@@ -36,6 +38,16 @@ bool hasTransactionAffinity
                 _useLoadBalancing = true;
             }
 
+            if (idleTimeout < 0)
+            {
+                throw new ArgumentOutOfRangeException(nameof(idleTimeout), idleTimeout, "Idle timeout cannot be negative.");
+            }
+
+            if (idleTimeout != 0)
+            {
+                _idleTimeout = TimeSpan.FromSeconds(idleTimeout);
+            }
+
             _hasTransactionAffinity = hasTransactionAffinity;
         }
 
@@ -54,6 +66,20 @@ public TimeSpan LoadBalanceTimeout
         {
             get { return _loadBalanceTimeout; }
         }
+        /// <summary>
+        /// The maximum time a pooled connection can sit unused (idle) in the pool before it becomes
+        /// eligible for eviction. Eviction is best-effort: a connection that has been idle longer
+        /// than this value is discarded either on the next retrieval attempt or during a periodic
+        /// pool maintenance pass, whichever happens first. Because maintenance runs on a fixed
+        /// cadence shorter than the timeout, a connection that becomes idle just before a
+        /// maintenance pass may be discarded after roughly half the configured timeout; callers
+        /// that need a strict floor should configure a correspondingly larger value.
+        /// <see cref="TimeSpan.Zero"/> disables idle expiration.
+        /// </summary>
+        public TimeSpan IdleTimeout
+        {
+            get { return _idleTimeout; }
+        }
         public int MaxPoolSize
         {
             get { return _maxPoolSize; }

src/Microsoft.Data.SqlClient/src/Microsoft/Data/SqlClient/ConnectionPool/WaitHandleDbConnectionPool.cs

@@ -223,8 +223,25 @@ internal WaitHandleDbConnectionPool(
 
             lock (s_random)
             {
-                // Random.Next is not thread-safe
-                _cleanupWait = s_random.Next(12, 24) * 10 * 1000; // 2-4 minutes in 10 sec intervals, WebData 103603
+                TimeSpan idleTimeout = connectionPoolGroup.PoolGroupOptions.IdleTimeout;
+                if (LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior || idleTimeout == TimeSpan.Zero)
+                {
+                    // Historical 2-4 minute random cleanup window. Used for the legacy switch and for
+                    // the "idle eviction disabled" state (IdleTimeout=0) where the timer still runs for
+                    // non-idle maintenance but CleanupCallback skips the generational sweep.
+                    _cleanupWait = s_random.Next(12, 24) * 10 * 1000; // 2-4 minutes in 10 sec intervals, WebData 103603
+                }
+                else
+                {
+                    // New idle-timeout behavior with a configured value: the WaitHandle pool takes two
+                    // pruning cycles to evict an idle connection (new->old generation, then old->closed),
+                    // so halve the configured timeout to approximate the requested idle lifetime. Floor
+                    // the period at 1 second so small IdleTimeout values (e.g. 1s) don't schedule a
+                    // sub-second timer that wakes the threadpool just to walk empty stacks.
+                    long cleanupWaitMilliseconds = (long)idleTimeout.TotalMilliseconds / 2;
+                    cleanupWaitMilliseconds = Math.Max(cleanupWaitMilliseconds, 1000);
+                    _cleanupWait = cleanupWaitMilliseconds >= int.MaxValue ? int.MaxValue : (int)cleanupWaitMilliseconds;
+                }
             }
 
             _connectionFactory = connectionFactory;
@@ -351,8 +368,16 @@ private void CleanupCallback(object state)
             // at least one period but not more than two periods.
             SqlClientEventSource.Log.TryPoolerTraceEvent("<prov.DbConnectionPool.CleanupCallback|RES|INFO|CPOOL> {0}", Id);
 
+            // Idle eviction (the generational destroy/age-into-old-stack sweep below) is enabled under
+            // the legacy switch, or when the new behaviour is on with a non-zero IdleTimeout. When the
+            // new behaviour is on and IdleTimeout is 0, eviction is disabled entirely: skip the sweep
+            // and only run the MinPoolSize floor maintenance.
+            bool idleEvictionEnabled =
+                LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior ||
+                PoolGroupOptions.IdleTimeout != TimeSpan.Zero;
+
             // Destroy free objects that put us above MinPoolSize from old stack.
-            while (Count > MinPoolSize)
+            while (idleEvictionEnabled && Count > MinPoolSize)
             {
                 // While above MinPoolSize...
                 if (_waitHandles.PoolSemaphore.WaitOne(0, false))
@@ -363,6 +388,7 @@ private void CleanupCallback(object state)
                     if (_stackOld.TryPop(out obj))
                     {
                         Debug.Assert(obj != null, "null connection is not expected");
+
                         // If we obtained one from the old stack, destroy it.
 
                         SqlClientDiagnostics.Metrics.ExitFreeConnection();
@@ -414,7 +440,7 @@ private void CleanupCallback(object state)
 
             // Push to the old-stack.  For each free object, move object from
             // new stack to old stack.
-            if (_waitHandles.PoolSemaphore.WaitOne(0, false))
+            if (idleEvictionEnabled && _waitHandles.PoolSemaphore.WaitOne(0, false))
             {
                 for (; ; )
                 {
@@ -667,6 +693,10 @@ private void DeactivateObject(DbConnectionInternal obj)
                                 //   DelegatedTransactionEnded event will clean up the
                                 //   connection appropriately regardless of the pool state.
                                 Debug.Assert(_transactedConnectionPool != null, "Transacted connection pool was not expected to be null.");
+                                // Transacting connections are held in their own store and are never
+                                // proactively closed (doing so would abort the transaction, which can be
+                                // distributed). Idle-timeout enforcement does not apply here, so we do
+                                // not call SetReturnedTime when parking the connection in the transacted pool.
                                 _transactedConnectionPool.PutTransactedObject(transaction, obj);
                                 rootTxn = true;
                             }
@@ -1061,7 +1091,7 @@ private bool TryGetConnection(DbConnection owningObject, uint waitForMultipleObj
                                 Interlocked.Decrement(ref _waitCount);
                                 obj = GetFromGeneralPool();
 
-                                if ((obj != null) && (!obj.IsConnectionAlive()))
+                                if ((obj != null) && (IsIdleExpired(obj) || !obj.IsConnectionAlive()))
                                 {
                                     SqlClientEventSource.Log.TryPoolerTraceEvent("<prov.DbConnectionPool.GetConnection|RES|CPOOL> {0}, Connection {1}, found dead and removed.", Id, obj.ObjectID);
                                     DestroyObject(obj);
@@ -1243,6 +1273,8 @@ private DbConnectionInternal GetFromTransactedPool(out Transaction transaction)
                     }
                     else if (!obj.IsConnectionAlive())
                     {
+                        // Transacting connections are exempt from idle-timeout eviction (closing them
+                        // would abort the transaction, possibly distributed). Only liveness is checked here.
                         SqlClientEventSource.Log.TryPoolerTraceEvent("<prov.DbConnectionPool.GetFromTransactedPool|RES|CPOOL> {0}, Connection {1}, found dead and removed.", Id, obj.ObjectID);
                         DestroyObject(obj);
                         obj = null;
@@ -1363,13 +1395,39 @@ private void PutNewObject(DbConnectionInternal obj)
 
             SqlClientEventSource.Log.TryPoolerTraceEvent("<prov.DbConnectionPool.PutNewObject|RES|CPOOL> {0}, Connection {1}, Pushing to general pool.", Id, obj.ObjectID);
 
+            // Stamp the return time so IsIdleExpired can later decide whether the connection has sat
+            // unused too long. Skip the stamp when idle expiry is disabled or the legacy idle-timeout
+            // behavior is in effect to avoid the per-return DateTime.UtcNow on the hot return path;
+            // IsIdleExpired short-circuits on the same conditions so the value would be unread in
+            // those cases.
+            if (!LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior &&
+                PoolGroupOptions.IdleTimeout != TimeSpan.Zero)
+            {
+                obj.SetReturnedTime();
+            }
             _stackNew.Push(obj);
             _waitHandles.PoolSemaphore.Release(1);
 
             SqlClientDiagnostics.Metrics.EnterFreeConnection();
 
         }
 
+        /// <summary>
+        /// Returns true when the supplied connection has been sitting idle in the pool longer than the
+        /// configured <see cref="DbConnectionPoolGroupOptions.IdleTimeout"/>. Returns false when idle timeout
+        /// is disabled (zero).
+        /// </summary>
+        private bool IsIdleExpired(DbConnectionInternal obj)
+        {
+            // Use subtraction rather than addition so the comparison cannot throw if ReturnedTime is
+            // ever close to DateTime.MaxValue. A clock skew that leaves ReturnedTime in the future
+            // produces a negative TimeSpan, which falls through as not-expired (fail safe).
+            TimeSpan idleTimeout = PoolGroupOptions.IdleTimeout;
+            return !LocalAppContextSwitches.UseLegacyIdleTimeoutBehavior &&
+                   idleTimeout != TimeSpan.Zero &&
+                   DateTime.UtcNow - obj.ReturnedTime > idleTimeout;
+        }
+
         public void ReturnInternalConnection(DbConnectionInternal obj, DbConnection owningObject)
         {
             Debug.Assert(obj != null, "null obj?");