From 83f77d5a5f198dd97217b46e13082f893727e64e Mon Sep 17 00:00:00 2001
From: Jeff Mitchell <jeff@hashicorp.com>
Date: Tue, 31 Oct 2017 20:58:45 -0500
Subject: [PATCH] Fix memory leak when a connection would hit the cluster port
 and go away (#3513)

---
 vault/request_forwarding.go | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/vault/request_forwarding.go b/vault/request_forwarding.go
index 8635281d0f21..13dbcdeb6970 100644
--- a/vault/request_forwarding.go
+++ b/vault/request_forwarding.go
@@ -122,11 +122,10 @@ func (c *Core) startForwarding() error {
 
 				// Accept the connection
 				conn, err := tlsLn.Accept()
-				if conn != nil {
-					// Always defer although it may be closed ahead of time
-					defer conn.Close()
-				}
-				if err != nil {
+				if err != nil || conn == nil {
+					if conn != nil {
+						conn.Close()
+					}
 					continue
 				}
 
@@ -138,9 +137,7 @@ func (c *Core) startForwarding() error {
 					if c.logger.IsDebug() {
 						c.logger.Debug("core: error handshaking cluster connection", "error", err)
 					}
-					if conn != nil {
-						conn.Close()
-					}
+					conn.Close()
 					continue
 				}
 
@@ -153,10 +150,14 @@ func (c *Core) startForwarding() error {
 
 					c.logger.Trace("core: got request forwarding connection")
 					c.clusterParamsLock.RLock()
-					go fws.ServeConn(conn, &http2.ServeConnOpts{
-						Handler: c.rpcServer,
-					})
+					rpcServer := c.rpcServer
 					c.clusterParamsLock.RUnlock()
+					go func() {
+						defer conn.Close()
+						fws.ServeConn(conn, &http2.ServeConnOpts{
+							Handler: rpcServer,
+						})
+					}()
 
 				default:
 					c.logger.Debug("core: unknown negotiated protocol on cluster port")