tls: yield downstream read retries to the event loop

[edsiper]

Summary

Fixes #11551. (workaround for v5.0.x)

A downstream TLS connection can return FLB_TLS_WANT_READ after consuming an incomplete TLS record. Event-driven server consumers currently enter the synchronous flb_tls_net_read() retry loop, which prevents the event loop from servicing another connection and can consume 100% CPU.

This change:

• returns retryable TLS read states to the downstream event loop;
• updates downstream consumers to retain connections on retryable I/O results;
• rearms read/write interest according to the TLS backend request;
• preserves each connection's existing event dispatch type while changing TLS interest masks;
• preserves partial secure-forward PING data across event callbacks;
• grows and bounds the secure-forward handshake buffer within buffer_max_size; and
• adds integration coverage for partial TLS records and secure-forward authentication with a 64-byte receive chunk.

Approach

Registered downstream connections are already owned by an event loop, even when a plugin does not use the coroutine-based FLB_IO_ASYNC path. For those connections, flb_tls_net_read() now returns FLB_IO_WANT_READ or FLB_IO_WANT_WRITE after updating event interest instead of retrying synchronously.

TLS event-mask changes reuse event->type, so FLB_ENGINE_EV_CUSTOM handlers remain dispatchable and coroutine-backed FLB_ENGINE_EV_THREAD connections retain their coroutine dispatch.

Secure-forward PING reads retain partial data in the connection buffer. When the configured chunk is smaller than the PING, the buffer grows in configured chunks up to the smaller of the protocol limit and buffer_max_size; each read is capped by currently allocated capacity.

Unregistered and upstream synchronous connections retain their existing behavior. Successful I/O remains the only operation that refreshes net.io_timeout; a retryable result does not count as activity.

Relationship to #11547

This is an event-driven alternative to #11547. It yields ownership to the existing event loop and preserves configured networking timeout semantics without adding a private polling delay or hard-coded timeout.

Validation

Configured and built successfully:

./tests/integration/setup-venv.sh
cmake -S . -B build -DFLB_TESTS_RUNTIME=On -DFLB_TESTS_INTERNAL=On
cmake --build build -j8

Focused runtime/internal coverage:

ctest --test-dir build -R '^(flb-rt-in_http|flb-rt-in_mqtt|flb-rt-in_syslog|flb-rt-in_tcp|flb-rt-in_forward|in_http_tls_expect\.sh|in_syslog_tcp_tls_expect\.sh|flb-it-downstream_worker|flb-it-upstream_tls|flb-it-http_server)$' --output-on-failure

Nine of ten CTest targets passed. flb-rt-in_forward could not bind its hard-coded 0.0.0.0:24224 because another host service owns that port. The dynamic-port Forward integration coverage below passed.

Focused integration run:

tests/integration/.venv/bin/python -m pytest \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_downstream_coro_partial_record_keeps_listener_responsive \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_message_mode \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_secure_forward_auth_success -q

Result: 9 passed.

Strict Valgrind run:

VALGRIND=1 VALGRIND_STRICT=1 tests/integration/.venv/bin/python -m pytest \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_downstream_coro_partial_record_keeps_listener_responsive \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_message_mode \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_secure_forward_auth_success -q

Result: 9 passed, strict Valgrind clean.

The full rebased PR commit range passes .github/scripts/commit_prefix_check.py in pull-request mode.

Summary by CodeRabbit

• Bug Fixes

  • Improved handling of temporary network read conditions across TCP, HTTP, MQTT, Syslog, Unix socket, and Forward inputs.
  • Prevented connections from being incorrectly closed when network operations require retrying.
  • Improved TLS event handling during non-blocking reads and writes.
  • Improved Secure Forward handshake processing, including operation with small receive buffers.

• Tests

  • Expanded Secure Forward integration coverage to include small-buffer configurations.

[edsiper]

superseded by #12146