Skip to content

HTTP/2 to origin session pool and reliability fixes - #13447

Open
bneradt wants to merge 1 commit into
apache:masterfrom
bneradt:h2-origin-session-pool-fixes
Open

HTTP/2 to origin session pool and reliability fixes#13447
bneradt wants to merge 1 commit into
apache:masterfrom
bneradt:h2-origin-session-pool-fixes

Conversation

@bneradt

@bneradt bneradt commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

Long-lived HTTP/2 origin connections could remain discoverable after
entering half-close, become unreachable when global pooling was
configured, or be poisoned by a single request's Connection: close
header. Requests assigned to those sessions could fail immediately.
Valid responses could also be rejected when headers used CONTINUATION,
when their payload length followed HEAD or 304 rules, or when normal
SETTINGS acknowledgments crossed the receive-rate limit.

This makes outbound HTTP/2 session lifecycle consistently thread-local.
It always probes the thread pool before configured global pools, ignores
Connection: close for outbound session shutdown, refuses to re-pool
half-closed sessions, and evicts sessions as soon as they enter local
half-close. HTTP/1.x global pooling behavior remains unchanged.

This also carries the protocol's not-processed guarantee from GOAWAY and
RST_STREAM REFUSED_STREAM into retry selection. It permits safe replay
of non-idempotent requests and rearms a fully buffered request body
before a retry. SETTINGS acknowledgments are excluded from the peer
abuse limit because their rate is bounded by settings sent by Traffic
Server.

This accepts CONTINUATION frames in valid outbound stream states without
creating a second transaction and preserves request metadata needed to
validate HEAD and conditional 304 responses. Replay-based AuTests and
custom HTTP/2 origins cover session reuse, half-close handling, retries,
split response headers, payload validation, and SETTINGS accounting.

@bneradt bneradt added this to the 11.0.0 milestone Jul 29, 2026
Copilot AI review requested due to automatic review settings July 29, 2026 02:10
@bneradt bneradt self-assigned this Jul 29, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

Long-lived HTTP/2 origin connections could remain discoverable after
entering half-close, become unreachable when global pooling was
configured, or be poisoned by a single request's Connection: close
header. Requests assigned to those sessions could fail immediately.
Valid responses could also be rejected when headers used CONTINUATION,
when their payload length followed HEAD or 304 rules, or when normal
SETTINGS acknowledgments crossed the receive-rate limit.

This makes outbound HTTP/2 session lifecycle consistently thread-local.
It always probes the thread pool before configured global pools, ignores
Connection: close for outbound session shutdown, refuses to re-pool
half-closed sessions, and evicts sessions as soon as they enter local
half-close. HTTP/1.x global pooling behavior remains unchanged.

This also carries the protocol's not-processed guarantee from GOAWAY and
RST_STREAM REFUSED_STREAM into retry selection. It permits safe replay
of non-idempotent requests and rearms a fully buffered request body
before a retry. SETTINGS acknowledgments are excluded from the peer
abuse limit because their rate is bounded by settings sent by Traffic
Server.

This accepts CONTINUATION frames in valid outbound stream states without
creating a second transaction and preserves request metadata needed to
validate HEAD and conditional 304 responses. Replay-based AuTests and
custom HTTP/2 origins cover session reuse, half-close handling, retries,
split response headers, payload validation, and SETTINGS accounting.
@bneradt
bneradt force-pushed the h2-origin-session-pool-fixes branch from bfd25fe to d2127b4 Compare July 29, 2026 02:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants