http_server: inherit worker ALPN configuration - #12279
Merged
edsiper merged 1 commit intoAug 13, 2026
Merged
Conversation
Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
edsiper
marked this pull request as ready for review
August 13, 2026 15:28
edsiper
merged commit Aug 13, 2026
8e04ba7
into
fix-downstream-tls-session-invalidation
24 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The parent HTTP server configures ALPN on its shared TLS provider before
starting listener workers. Each worker initializes a child server whose local
tls_alpn_configuredflag is reset, causing every worker to configure the sameshared OpenSSL
SSL_CTXagain while sibling workers can already perform TLShandshakes.
Helgrind identified the concurrent
SSL_CTX_set_alpn_select_cb()mutation andTLS handshake access. Under instrumentation, clients intermittently reported
unexpected messageduring concurrent HTTP/2 TLS ingestion.Change
Propagate the parent's ALPN-configured state to each worker server. Workers
continue using the already configured shared TLS provider without mutating it.
Impact
Multi-worker HTTP servers can negotiate HTTP/2 over TLS without racing on
shared ALPN configuration.
This PR is stacked on #12278 because that PR fixes the separate downstream TLS
descriptor lifecycle defect found by the same reproducer.
Validation
cmake -S . -B build -DFLB_TESTS_RUNTIME=On -DFLB_TESTS_INTERNAL=Oncmake --build build -j8ctest --test-dir build -R 'flb-it-(downstream_worker|http_server|opentelemetry)' --output-on-failureVALGRIND=1 VALGRIND_STRICT=1All checks passed.