Disable closing tunnel on port forward failure threshold (by default)

* Too many false positives due to downstream client errors (e.g.,
  try to connect to an invalid address).
* Tunnel monitoring provided by SSH keep alives with timeout, with
  keep alive requests triggered both periodically and by port
  forward failure.

psiphon/config.go

@@ -45,7 +45,7 @@ const (
 	ESTABLISH_TUNNEL_TIMEOUT_SECONDS             = 300
 	ESTABLISH_TUNNEL_WORK_TIME_SECONDS           = 60 * time.Second
 	ESTABLISH_TUNNEL_PAUSE_PERIOD                = 5 * time.Second
-	PORT_FORWARD_FAILURE_THRESHOLD               = 10
+	PORT_FORWARD_FAILURE_THRESHOLD               = 0
 	HTTP_PROXY_ORIGIN_SERVER_TIMEOUT             = 15 * time.Second
 	HTTP_PROXY_MAX_IDLE_CONNECTIONS_PER_HOST     = 50
 	FETCH_REMOTE_SERVER_LIST_TIMEOUT             = 10 * time.Second

psiphon/tunnel.go

@@ -536,6 +536,14 @@ func dialSsh(
 // - "read tcp ... connection reset by peer"
 // - "ssh: unexpected packet in response to channel open: <nil>"
 //
+// Update: the above is superceded by SSH keep alives with timeouts. When a keep
+// alive times out, the tunnel is marked as failed. Keep alives are triggered
+// periodically, and also immediately in the case of a port forward failure (so
+// as to immediately detect a situation such as a device waking up and trying
+// to use a dead tunnel). By default, port forward theshold counting does not
+// cause a tunnel to be marked as failed, with the conservative assumption that
+// a server which responds to an SSH keep alive is fully functional.
+//
 func (tunnel *Tunnel) operateTunnel(config *Config, tunnelOwner TunnelOwner) {
 	defer tunnel.operateWaitGroup.Done()
 
@@ -577,7 +585,8 @@ func (tunnel *Tunnel) operateTunnel(config *Config, tunnelOwner TunnelOwner) {
 			tunnel.portForwardFailureTotal += failures
 			NoticeInfo("port forward failures for %s: %d",
 				tunnel.serverEntry.IpAddress, tunnel.portForwardFailureTotal)
-			if tunnel.portForwardFailureTotal > config.PortForwardFailureThreshold {
+			if config.PortForwardFailureThreshold > 0 &&
+				tunnel.portForwardFailureTotal > config.PortForwardFailureThreshold {
 				err = errors.New("tunnel exceeded port forward failure threshold")
 			} else {
 				// Try an SSH keep alive to check the state of the SSH connection