Summary

Backport the OpenSSL I/O error-classification fix and deterministic TLS regressions to 5.0.

• preserve errno immediately after SSL_read() and SSL_write()
• distinguish real syscall failures, legacy unexpected peer EOF, and authoritative OpenSSL protocol/library errors
• report fatal SSL_ERROR_SSL failures instead of silently discarding the error queue
• mark fatal OpenSSL I/O results as non-reusable while preserving a meaningful syscall errno when present
• preserve 5.0's existing silent clean-close_notify behavior without importing master's separate lifecycle fix
• exercise TCP RST, corrupted TLS record, and clean TLS shutdown paths

Root cause

The SSL_ERROR_SYSCALL path read errno after flb_errno() and logging operations could replace it with an unrelated value such as ENOTTY. The read path also used a dead ssl_ret < 0 condition; SSL_get_error() returns nonnegative constants, so SSL_ERROR_SSL and other fatal failures were silently discarded and left connection->net_error == -1.

The backport classifies failures as follows:

• non-empty OpenSSL queue: report the OpenSSL protocol/library error
• SSL_ERROR_SYSCALL with saved nonzero errno: report and preserve the real syscall failure
• SSL_ERROR_SYSCALL with an empty queue and zero errno: report legacy unexpected EOF and use ECONNRESET as the terminal marker
• other fatal OpenSSL results: report the queued error, or the numeric SSL result if the queue is unexpectedly empty, and prevent reuse
• SSL_ERROR_ZERO_RETURN: return terminally without logging, preserving the 5.0 baseline behavior

WANT_READ/WANT_WRITE behavior is unchanged. This branch does not import master's #12079 close-notify recycling fix, #12141's retry work, or any handshake EOF behavior change.

Compatibility and severity

An established-session peer EOF without close_notify is logged at error level. OpenSSL 3.x classifies this as a fatal TLS truncation/protocol error, and older OpenSSL versions already reached the error-level SSL_ERROR_SYSCALL path. This may make abrupt disconnects from non-compliant clients more visible, but Fluent Bit does not enable SSL_OP_IGNORE_UNEXPECTED_EOF because that would discard TLS truncation protection. An abrupt EOF during an incomplete SSL_write() is also error-level because application data may have been lost. A clean close_notify remains silent on 5.0.

Regression proof

The known-broken syscall path emitted the real reset followed by an unrelated Inappropriate ioctl for device; it now reports only Connection reset by peer. A corrupted encrypted record previously reached SSL_ERROR_SSL without a TLS log; it now reports the authoritative bad record mac queue entry.

The initial backport catch-all also reported a clean shutdown as:

[tls] unknown error (ssl_error=6)

An explicit SSL_ERROR_ZERO_RETURN branch removes that regression while preserving the 5.0 baseline. All three tests submit a valid TLS Forward payload afterward and verify responsiveness.

Validation

cmake --build build -j8

tests/integration/.venv/bin/python -m pytest \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_syscall_error_preserves_errno \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_protocol_error_is_reported \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_close_notify_is_not_an_error -q

VALGRIND=1 VALGRIND_STRICT=1 \
tests/integration/.venv/bin/python -m pytest \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_syscall_error_preserves_errno \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_protocol_error_is_reported \
  tests/integration/scenarios/in_forward/tests/test_in_forward_001.py::test_in_forward_tls_close_notify_is_not_an_error -q

All three normal and strict-Valgrind tests pass. Valgrind reports 0 errors, all heap blocks freed, and no allocations remaining at exit. The full six-commit range passes the repository prefix checker against 5.0.