Harden TCP listener: log Accept failures, bound ClientHello read

The wrapped TCP listeners (:443/:8443) were observed dying in production
while :80 and the UDP/QUIC paths kept running. The Accept-error path that
permanently stops the net/http server was silent, making the cause
undiagnosable. Now:

- Log the underlying Accept() error before propagating it.
- Set a 10s read deadline around the synchronous ClientHello capture so a
  slow/silent client cannot wedge the Accept loop; clear it on success so
  the TLS handshake is unaffected.
- Demote routine per-connection capture failures (non-TLS clients, port
  scanners) from Error to Debug.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: sippejw

modcaddy/listener/listener.go

@@ -2,13 +2,21 @@ package listener
 
 import (
 	"net"
+	"time"
 
 	"github.com/caddyserver/caddy/v2"
 	"github.com/caddyserver/caddy/v2/caddyconfig/caddyfile"
 	"github.com/refraction-networking/clienthellod/modcaddy/app"
 	"go.uber.org/zap"
 )
 
+// clientHelloReadTimeout bounds how long the capture step may block waiting for
+// a client's ClientHello. HandleTCPConn reads it synchronously inside Accept(),
+// so without a deadline a client that connects but never sends a complete TLS
+// record would block the Accept loop indefinitely and stall every new
+// connection on this listener.
+const clientHelloReadTimeout = 10 * time.Second
+
 func init() {
 	caddy.RegisterModule(ListenerWrapper{})
 }
@@ -127,16 +135,32 @@ func (l *tlsListener) Accept() (net.Conn, error) {
 	for {
 		conn, err := l.Listener.Accept()
 		if err != nil {
+			// A non-temporary error returned here makes net/http's server stop
+			// serving this listener permanently (the socket is closed and no
+			// new connections are accepted). This path was previously silent,
+			// which made an in-the-wild listener death impossible to diagnose.
+			// Log it before propagating so the cause is always recorded.
+			l.logger.Error("clienthellod listener: underlying Accept failed, listener will stop serving", zap.Error(err))
 			return nil, err
 		}
 
+		// Bound the synchronous ClientHello read so a slow or silent client
+		// cannot wedge the Accept loop. Reset on success so the deadline does
+		// not carry into the TLS handshake on the rewound connection.
+		_ = conn.SetReadDeadline(time.Now().Add(clientHelloReadTimeout))
+
 		rewindConn, err := l.reservoir.TLSFingerprinter().HandleTCPConn(conn)
 		if err != nil {
-			l.logger.Error("internal error: TLSFingerprinter failed to handle TCP connection, closing connection", zap.Error(err))
+			// Per-connection failure (non-TLS client, malformed ClientHello,
+			// or read timeout). Drop just this connection and keep serving;
+			// never propagate as an Accept error.
+			l.logger.Debug("clienthellod listener: failed to handle TCP connection, closing it", zap.Error(err))
 			conn.Close()
 			continue
 		}
 
+		_ = conn.SetReadDeadline(time.Time{})
+
 		return rewindConn, nil
 	}
 }