Notify WebSocket clients about backpressure disconnect

[awelzel]

I'm testing throughput of Broker's WebSocket support by publishing many messages from four Zeek worker processes to /topic/test which a Zeek proxy process subscribes to. The proxy process also listens on a WebSocket port via Broker::listen_websocket().

The event rate at the WebSocket client connecting to the proxy process and subscribing to /topic/test is about ~70k events/s (which I find pretty impressive).

It's too much, however, and the client is disconnected eventually and broker.log contains a backpressure_overflow entry.

{"ts":1737545126.004208,"ty":"Broker::STATUS","ev":"peer-removed","peer.address":"127.0.0.1","peer.bound_port":54690,"message":"client removed: caf::sec::backpressure_overflow"}

The issue is, the WebSocket client receives a "1000 (OK) Normal closure" frame and no error message before the connection is closed.

$ python3 client.py  --url ws://127.0.0.1:8008/v1/messages/json --subscriptions '/topic/test' | pv -l  > /dev/null
Traceback (most recent call last):                                                                                                                                                                                                   <=>                                                                                                                                                     ]
  File "/home/awelzel/corelight-oss/zeek/issues/ws/client.py", line 70, in <module>
    main()
  File "/home/awelzel/corelight-oss/zeek/issues/ws/client.py", line 63, in main
    msg = ws.recv()
          ^^^^^^^^^
  File "/home/awelzel/.local/lib/python3.12/site-packages/websockets/sync/connection.py", line 253, in recv
    raise self.protocol.close_exc from self.recv_exc
websockets.exceptions.ConnectionClosedOK: received 1000 (OK) Normal closure; then sent 1000 (OK) Normal closure

It would be better for users to:

1. Send an error message before closing the connection

2. use some exceptional or custom code and an appropriate closure reason. I could see 1011, or anything 4000, so that it doesn't look like a normal closure.