Additional data point: reproducible trigger for the UDP :53 leak via a failed online check (no WireGuard)
Setup: RPi2, LibreELEC 12.0.2 (ConnMan 1.43), WiFi only, no VPN/WireGuard, default online check settings ("one-shot", geometric interval [1, 12]).
Symptom: after ~35 days of uptime connmand had ~1015 of 1024 FDs open, followed by "Failed to open/bind time server socket" flooding the journal and NTP no longer syncing.
Findings:
- During normal operation there is no leak at all. connmand stayed at 17 FDs for 23 hours.
- Clean WiFi reconnects (connmanctl disconnect/connect, 3 cycles) don't leak either. FDs go 17 → 12 → 17 every time and all sockets are closed properly.
A single failed online check does trigger it. I blocked outbound HTTP with
and reconnected the WiFi. The service stays in "ready". After the first check times out (~2 min), every retry fails immediately with
Each retry leaves one more UDP socket to the DNS server (router:53) open. FDs went 17 → 24 within ~12 minutes (UDP :53 sockets 3 → 9+).
- The online check never recovers by itself. After removing the iptables rule it kept failing with -22 for another 7 minutes (and presumably forever, retrying at up to 144 s intervals), leaking one socket per attempt. Only restarting connman fixed it, after which the check succeeded immediately and FDs were back to 17.
So on my system the chain is: a short internet/connman.net outage → online check stuck in -22 → endless retries → one leaked UDP :53 socket per retry → FD limit reached after a few days → NTP dead. A clean reconnect isn't enough to start it, it needs the check to actually time out.
The ConnMan 1.44 changelog has "Fix issue with handling web context for online detection", and that release reworked the failure path in src/wispr.c / gweb. It might be related, but I haven't tested 12.2.x / 1.45 yet. The iptables rule above should be an easy way for anyone on 12.2 or 13 to check whether it still happens there.
Workaround for now: EnableOnlineCheck = false in /storage/.config/connman_main.conf (CamelCase, [General] section), then restart connman.
Update: still happens on LibreELEC 12.2.1 / ConnMan 1.45
I updated to 12.2.1 (ConnMan 1.45) and repeated the same test (iptables DROP on outbound tcp:80, then WiFi reconnect). So my guess about the 1.44 changelog was wrong. The bug is still there, only the error message changed:
21:52:58 IPv4 online check to http://ipv4.connman.net/online/status.html failed: Input/output error
21:52:59 No valid proxy with proxy auto-configuration (PAC) URL http://wpad.fritz.box/wpad.dat for wlan0 [ wifi ] online check URL http://ipv4.connman.net/online/status.html
21:52:59 IPv4 online check to http://ipv4.connman.net/online/status.html failed: no valid proxy
... (repeats at growing intervals)
- The first check times out after ~2 min (Input/output error). After that, every retry fails immediately with no valid proxy.
- Each retry still leaks one UDP socket to the DNS server (router:53). connmand went from 20 to 29 FDs in ~11 minutes.
- It doesn't recover after the block is removed. I waited another 5+ minutes and it was still "ready" with no valid proxy on every retry. Restarting connman fixes it immediately.
So in 1.45 the failure path seems to switch to WPAD/PAC proxy discovery. The PAC URL is derived from the DHCP domain (fritz.box, my AVM router doesn't provide a wpad.dat). It then never falls back to a direct request again, and every attempt leaves a resolver socket open.
Workaround is unchanged: EnableOnlineCheck = false in /storage/.config/connman_main.conf ([General] section), then restart connman.