Skip to content

in_http: leftover pipelined data is never re-parsed after a request is consumed #12653

Open

Description

@arygupt

Bug Report

Describe the bug

After a request is consumed, the leftover bytes are moved to the front of the connection buffer and the parser is
re-initialised — but the remaining buffer is never parsed again. A pipelined request therefore sits unprocessed
until more data happens to arrive on the socket. If the client is waiting for the second response, it waits
until the keep-alive timeout.

This is separate from #12652 (which is about the body length being wrong): it reproduces with
Transfer-Encoding: chunked, where the request length is exact and the leftover bytes are correctly preserved.

To Reproduce

One connection, two pipelined chunked requests, then wait:

POST / HTTP/1.1
Host: x
Content-Type: application/json
Transfer-Encoding: chunked

7\r\n{"a":1}\r\n0\r\n\r\n
POST /2 HTTP/1.1
Host: x
Content-Type: application/json
Content-Length: 7

{"b":2}

Result: one response, one record ({"a"=>1}). The second request produces nothing.

Now send a third request on the same connection. The second one is then finally parsed — its record
({"b"=>2}) appears, tagged 2, before the third is handled. So the bytes were buffered correctly all along;
nothing re-ran the parser on them.

Root cause

plugins/in_http/http_conn.c, after MK_HTTP_PARSER_OK:

if (0 < (conn->buf_len - request_len)) {
    memmove(conn->buf_data, &conn->buf_data[request_len],
            conn->buf_len - request_len);
    conn->buf_data[conn->buf_len - request_len] = '\0';
    conn->buf_len -= request_len;
}
else { ... }

/* Reinitialize the parser ... */
memset(&conn->session.parser, 0, sizeof(struct mk_http_parser));
mk_http_parser_init(&conn->session.parser);
http_conn_request_init(&conn->session, &conn->request);

The parser is reset and the leftover data is in the buffer, but the function returns without calling
mk_http_parser() on it. Parsing only happens from http_conn_event(), which runs on a read event.

Expected behavior

After moving the leftover bytes down, the parser should be run again on them (loop, or re-enter the parse) so
pipelined requests are handled immediately.

Your Environment

  • Fluent Bit 5.1.5 (fluent/fluent-bit:latest)
  • Linux, aarch64, official container image
  • Input: http plugin, default settings

Impact

Pre-auth. HTTP pipelining is effectively broken: the second and later requests on a connection are not answered
until unrelated data arrives, and are lost entirely if it never does. Clients that pipeline see stalls up to the
keep-alive timeout.

Activity

  1. arygupt commented on Oct 25, 2026

    @arygupt
    Author

    Measured end state: the connection is not leaked forever — it is closed by the 10 s IO timeout ([downstream] connection #N ... timed out after 10 seconds). So a pipelining client gets one response, then a 10 s stall, then a close, and the second request is lost. Not a permanent leak, but a 10 s stall per pipelining connection.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions