From b9d9f9112faf02c87f644d52d598b00ad8fc5a4f Mon Sep 17 00:00:00 2001
From: Stefan Meinecke <meinecke@greensec.de>
Date: Sun, 18 Oct 2026 02:53:50 +0200
Subject: [PATCH] sslh-fork: decrement num_connections when fork() fails

num_connections was incremented before fork(), but the fork-failure
path only logged and closed the socket - no child exists to decrement
the counter, so each failed fork permanently inflates it. Under fork
failure conditions (process limits, memory pressure) the listener
eventually reports max_connections reached and refuses all connections
until restart.
---
 sslh-fork.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sslh-fork.c b/sslh-fork.c
index d25760b..bd3532f 100644
--- a/sslh-fork.c
+++ b/sslh-fork.c
@@ -264,6 +264,7 @@ void tcp_listener(struct listen_endpoint* endpoint, int num_endpoints, int activ
 
         switch(fork()) {
         case -1: print_message(msg_system_error, "fork failed: err %d: %s\n", errno, strerror(errno));
+                 self->num_connections--;  /* no child will reap it */
                  break;
 
         case 0: /* In child process */