Skip to content

http_server: inherit worker ALPN configuration - #12279

Merged
edsiper merged 1 commit into
fix-downstream-tls-session-invalidationfrom
fix-http-server-worker-alpn
Aug 13, 2026
Merged

http_server: inherit worker ALPN configuration#12279
edsiper merged 1 commit into
fix-downstream-tls-session-invalidationfrom
fix-http-server-worker-alpn

Conversation

@edsiper

@edsiper edsiper commented Aug 13, 2026

Copy link
Copy Markdown
Member

Problem

The parent HTTP server configures ALPN on its shared TLS provider before
starting listener workers. Each worker initializes a child server whose local
tls_alpn_configured flag is reset, causing every worker to configure the same
shared OpenSSL SSL_CTX again while sibling workers can already perform TLS
handshakes.

Helgrind identified the concurrent SSL_CTX_set_alpn_select_cb() mutation and
TLS handshake access. Under instrumentation, clients intermittently reported
unexpected message during concurrent HTTP/2 TLS ingestion.

Change

Propagate the parent's ALPN-configured state to each worker server. Workers
continue using the already configured shared TLS provider without mutating it.

Impact

Multi-worker HTTP servers can negotiate HTTP/2 over TLS without racing on
shared ALPN configuration.

This PR is stacked on #12278 because that PR fixes the separate downstream TLS
descriptor lifecycle defect found by the same reproducer.

Validation

  • cmake -S . -B build -DFLB_TESTS_RUNTIME=On -DFLB_TESTS_INTERNAL=On
  • cmake --build build -j8
  • ctest --test-dir build -R 'flb-it-(downstream_worker|http_server|opentelemetry)' --output-on-failure
  • Focused OpenTelemetry HTTP/2 TLS worker test: passed normally
  • Focused OpenTelemetry HTTP/2 TLS worker test: 3/3 passes with VALGRIND=1 VALGRIND_STRICT=1
  • CI-style commit-prefix validation against the stack base

All checks passed.

Signed-off-by: Eduardo Silva <eduardo@chronosphere.io>
@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 05a383b5-5a43-45a4-9170-1fa02825b178

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@edsiper
edsiper marked this pull request as ready for review August 13, 2026 15:28
@edsiper
edsiper requested a review from cosmo0920 as a code owner August 13, 2026 15:28
@edsiper
edsiper merged commit 8e04ba7 into fix-downstream-tls-session-invalidation Aug 13, 2026
24 checks passed
@edsiper edsiper added this to the Fluent Bit v5.1.1 milestone Aug 13, 2026
@edsiper
edsiper deleted the fix-http-server-worker-alpn branch August 13, 2026 17:18
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant