handshake: read single message with bounded Read instead of io.ReadAll

io.ReadAll blocks until the stream is closed (EOF). For relay-based
connections FIN may not propagate to the receiver, causing every inbound
handshake to time out after handshakeRecvTimeout (10 s) instead of
processing immediately. Since the handshake protocol is exactly one JSON
message per connection, a single stream.Read(buf) is sufficient and
returns as soon as the bytes land.

Author: teovl

plugins/handshake/handshake.go

@@ -7,7 +7,6 @@ import (
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
-	"io"
 	"log/slog"
 	"os"
 	"path/filepath"
@@ -385,15 +384,26 @@ func (hm *Manager) Start() error {
 }
 
 // handleConnection processes a single handshake stream connection.
+//
+// The handshake protocol is exactly one JSON message per connection; we do a
+// single bounded Read rather than io.ReadAll so we return as soon as the
+// message bytes land, without waiting for the sender to close the stream.
 func (hm *Manager) handleConnection(stream coreapi.Stream) {
+	const maxMsgSize = 64 * 1024
+
 	type readResult struct {
 		data []byte
 		err  error
 	}
 	ch := make(chan readResult, 1)
 	go func() {
-		data, err := io.ReadAll(stream)
-		ch <- readResult{data, err}
+		buf := make([]byte, maxMsgSize)
+		n, err := stream.Read(buf)
+		if err != nil {
+			ch <- readResult{nil, err}
+			return
+		}
+		ch <- readResult{buf[:n], nil}
 	}()
 	select {
 	case res := <-ch:

plugins/handshake/zz_handshake_connection_parse_test.go

@@ -55,8 +55,8 @@ func TestHandleConnectionClosedRecvBufReturnsCleanly(t *testing.T) {
 	hm := newTestHM(t, "")
 	t.Cleanup(hm.Stop)
 
-	// An EOF stream (closed RecvBuf equivalent) causes io.ReadAll → empty
-	// data + nil error → JSON unmarshal error → handleConnection returns.
+	// An EOF stream (closed RecvBuf equivalent) causes Read → (0, io.EOF)
+	// → handleConnection returns on the read-error path.
 	stream := newMockStreamErr(io.EOF)
 
 	done := make(chan struct{})