downstream: invalidate TLS session before socket close

[edsiper]

Problem

Downstream teardown closes a TLS socket before invalidating the associated
TLS session. Session destruction is deferred, so the operating system can
reuse the numeric file descriptor before OpenSSL calls SSL_shutdown().
That allows the old TLS session to write a close-notify record into a new
connection, which clients report as bad record mac or unexpected message.

Change

Invalidate an active downstream TLS session before closing its socket. This
matches the existing upstream teardown ordering and prevents deferred TLS
cleanup from using a recycled descriptor.

Impact

Concurrent TLS listeners no longer risk corrupting newly accepted connections
during deferred downstream cleanup.

Validation

• cmake -S . -B build -DFLB_TESTS_RUNTIME=On -DFLB_TESTS_INTERNAL=On
• cmake --build build -j8
• ctest --test-dir build -R 'flb-it-(downstream_worker|http_server|opentelemetry)' --output-on-failure
• Focused OpenTelemetry HTTP/2 TLS worker test with VALGRIND=1 VALGRIND_STRICT=1
• CI-style commit-prefix validation against master

All checks passed.

Summary by CodeRabbit

• Bug Fixes
  • Improved cleanup when closing secure downstream connections by invalidating active TLS sessions.
  • Helps prevent stale security sessions from remaining after a connection is closed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dd4d6d08-d85c-4b8d-8ee9-3532331bae20

📥 Commits

Reviewing files that changed from the base of the PR and between ae51533 and c448710.

📒 Files selected for processing (1)

• src/flb_downstream.c

---

📝 Walkthrough

Walkthrough

The downstream connection teardown path now invalidates an active TLS session before closing its socket when TLS support is enabled.

Changes

Downstream TLS cleanup

Layer / File(s)	Summary
Invalidate TLS before socket closure src/flb_downstream.c	prepare_destroy_conn conditionally invalidates a non-null TLS session before closing the downstream connection socket.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Mergeability Score: ⚪ Minimal · up to c4487

This localized teardown-ordering fix prevents deferred TLS cleanup from using a recycled socket descriptor, with no actionable merge-blocking risk remaining after normal checks and review.

Possibly related PRs

• fluent/fluent-bit#10924: Applies the same TLS session invalidation to upstream connection teardown.
• fluent/fluent-bit#12079: Changes TLS shutdown handling to prevent connection or session reuse.

Suggested reviewers: cosmo0920

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes invalidating the TLS session before closing the downstream socket.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-downstream-tls-session-invalidation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}