net.http: fix TLS server close_idle fd-reuse race and remove dead set_read_timeout (#27542)

* net.http: fix TLS server close_idle fd-reuse race and remove dead set_read_timeout

close_idle (server_tls_idle.v): move t.mu.unlock() to after the
net.shutdown loop instead of before it. The old code dropped the lock
before calling net.shutdown, leaving a window where a worker could
race through unmark_idle → conn.shutdown() → net.close(fd), the OS
could reuse that fd for a freshly accepted socket, and the subsequent
net.shutdown would then interrupt an unrelated connection. Accepted TLS
connections are blocking sockets (accept_with_timeouts restores blocking
mode before returning), so net.shutdown returns immediately — holding
the lock across the loop does not introduce a liveness hazard.

listen_and_serve_tls (server_tls_notd_use_openssl.v): remove the
dead conn.set_read_timeout(s.read_timeout) call after accept. Accepted
connections are bound to the listener's ssl config (l.conf) via
mbedtls_ssl_setup; the per-conn conf that set_read_timeout writes to
is never bound to conn.ssl and has no effect on the live session. The
server read_timeout is already applied correctly when the SSLListener
is created with read_timeout: s.read_timeout in its config.

Fixes items 2 (dead call) and 4 (fd-reuse race) from #27433.

Co-Authored-By: WOZCODE <contact@withwoz.com>

* net.http: add Windows wakeup explanation to close_idle, use defer unlock

The Codex review of PR #27542 flagged that the lock-widening made
close_idle''s net.close(handle) and the worker''s deferred conn.shutdown()
a guaranteed double-close on Windows.

Removing net.close was the wrong fix: net.shutdown(SD_BOTH) alone does
NOT unblock a concurrent C.select() on Windows (only closesocket() does),
so workers blocked in wait_for_read would hang for up to 41 s
(mbedtls_server_read_timeout_ms) before noticing shutdown.

Keep net.close in the Windows path; the double-close is safe because:
- listen_and_serve_tls calls ch.close() before close_idle()
- the accept loop has already stopped at that point
- active handlers have called unmark_idle before w.handler.handle() runs,
  so close_idle only touches truly idle handles
- the worker''s second closesocket returns WSAENOTSOCK, swallowed by or {}

Also switch to defer { t.mu.unlock() } for consistency with mark_idle
and unmark_idle.

Co-Authored-By: WOZCODE <contact@withwoz.com>

* net.http: stop close_idle/worker double-closing the TLS fd on Windows

close_idle force-closes idle handles on Windows with net.close (closesocket) to
wake a worker blocked in select(), which net.shutdown(SD_BOTH) does not do there.
But the worker's handle_conn defer then ran conn.shutdown() unconditionally,
closing the same fd a second time. Between the two closes the SOCKET value can be
reused by ANY socket the process opens -- handle reuse is process-wide on
Windows, not limited to this server's accept loop -- so the worker's second close
could land on an unrelated socket. The previous "double-close is safe" comment
only reasoned about this server's accept loop and was wrong.

Transfer ownership: close_idle records the handles it force-closed (under the
lock, Windows only), and the worker consults was_force_closed and skips its own
conn.shutdown so the fd is closed exactly once. The tracker lock stays held
across the shutdown loop: on non-Windows the worker is still the sole closer, and
the held lock keeps its unmark_idle (hence its net.close) ordered after our
net.shutdown, so the fd cannot be closed and recycled before we shut it down.
Found by Codex on #27542.

Co-Authored-By: WOZCODE <contact@withwoz.com>

* net.http: free TLS resources for force-closed idle connections

The previous fix skipped conn.shutdown() entirely for an idle TLS connection
that close_idle force-closed on Windows, to avoid closing the socket a second
time. But SSLConn.shutdown() does two jobs: it frees the mbedtls TLS resources
(SSL context, config, certs, RNG state, ALPN allocation) AND closes the socket.
Skipping it leaked all of those for every force-closed idle connection at
server shutdown.

Split the two concerns instead of bypassing cleanup: when close_idle already
owns the socket close (was_force_closed), relinquish socket ownership
(conn.owns_socket = false) and still call conn.shutdown(). shutdown() then frees
the TLS resources but skips net.close, so the fd is still closed exactly once
(by close_idle) and nothing leaks. On non-Windows was_force_closed is always
false and the worker remains the sole closer, unchanged. Found by Codex on
#27542.

Co-Authored-By: WOZCODE <contact@withwoz.com>

---------

Co-authored-by: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/server_tls_idle.v

@@ -12,6 +12,12 @@ struct TlsIdleConnTracker {
 mut:
 	handles []int
 	closing bool
+	// closed records handles that close_idle force-closed on Windows. The woken
+	// worker consults was_force_closed and relinquishes socket ownership (so its
+	// conn.shutdown frees the TLS resources without closing the fd again), keeping
+	// the fd closed exactly once. Empty on non-Windows (close_idle only shuts the
+	// fd down there, leaving the worker the sole closer).
+	closed []int
 }
 
 fn (mut t TlsIdleConnTracker) mark_idle(handle int) bool {
@@ -37,12 +43,53 @@ fn (mut t TlsIdleConnTracker) unmark_idle(handle int) {
 	}
 }
 
+// was_force_closed reports whether close_idle has already closed `handle`
+// (Windows force-close to wake a worker blocked in select). The woken worker
+// must then relinquish socket ownership before its own conn.shutdown, which
+// then frees the TLS resources without closing the fd again: a second close
+// would race process-wide SOCKET reuse — the value can be reused by ANY socket
+// the process opens, not just this server's accept loop — and could close an
+// unrelated socket. Always false on non-Windows, where close_idle only shuts
+// the fd down and the worker remains the sole closer.
+fn (mut t TlsIdleConnTracker) was_force_closed(handle int) bool {
+	$if windows {
+		t.mu.lock()
+		defer {
+			t.mu.unlock()
+		}
+		return t.closed.index(handle) >= 0
+	} $else {
+		return false
+	}
+}
+
 fn (mut t TlsIdleConnTracker) close_idle() {
 	t.mu.lock()
+	defer {
+		t.mu.unlock()
+	}
 	t.closing = true
 	handles := t.handles.clone()
 	t.handles.clear()
-	t.mu.unlock()
+	$if windows {
+		// On Windows, net.shutdown(SD_BOTH) does not unblock a worker blocked in
+		// select() — only closesocket() (net.close, below) does — so we must
+		// force-close idle handles to wake their workers. Record ownership of
+		// those closes here, under the lock, so a worker that wakes (or exits for
+		// another reason) sees it via was_force_closed and relinquishes socket
+		// ownership instead of closing the fd again. Without that the fd would be
+		// closed twice, and between
+		// the two closes the SOCKET value can be reused by any socket the process
+		// opens, so the second close could hit an unrelated socket.
+		t.closed << handles
+	}
+	// Hold the lock across the loop. On non-Windows, was_force_closed is always
+	// false, so the worker remains the sole closer (via conn.shutdown); holding
+	// the lock blocks its unmark_idle until our net.shutdown below has run, so
+	// the worker cannot close the fd — and let the OS recycle the value — before
+	// we shut it down. (Releasing the lock here would reopen exactly that race.)
+	// On Windows the woken worker skips its close regardless, so the held lock
+	// only briefly delays it and is otherwise harmless.
 	for handle in handles {
 		net.shutdown(handle)
 		$if windows {

vlib/net/http/server_tls_notd_use_openssl.v

@@ -109,9 +109,6 @@ fn (mut s Server) listen_and_serve_tls() {
 			}
 			continue
 		}
-		if s.read_timeout > 0 {
-			conn.set_read_timeout(s.read_timeout)
-		}
 		ch <- conn
 	}
 	ch.close()
@@ -161,6 +158,17 @@ fn (mut w TlsHandlerWorker) handle_conn(mut conn mbedtls.SSLConn) {
 		if !is_h2 {
 			w.idle_conns.unmark_idle(conn.handle)
 		}
+		// close_idle may have already closed conn.handle on Windows (a forced
+		// closesocket to wake this worker from a blocked read). conn.shutdown()
+		// both frees the mbedtls TLS resources (SSL ctx, config, certs, RNG,
+		// ALPN alloc) AND closes the socket; we must always do the former but
+		// must not close the socket a second time — that would race process-wide
+		// SOCKET reuse and could close an unrelated socket. So relinquish socket
+		// ownership and still call shutdown for the TLS cleanup. On non-Windows
+		// was_force_closed is always false and the worker remains the sole closer.
+		if w.idle_conns.was_force_closed(conn.handle) {
+			conn.owns_socket = false
+		}
 		conn.shutdown() or {}
 	}
 	// If the TLS handshake negotiated HTTP/2 via ALPN, switch to the HTTP/2