Free the TLS connection state on close

[xuckless]

With use_bundled_tls = false an application can inject its own tls module. I'm injecting one backed by BoringSSL, which holds one SSL object (and its BIO) per connection, and nothing in dusty ever tears tls_conn down, so every connection leaked its SSL.

Server and client Connection.deinit now call tls.Connection.deinit when the module declares it. tls.zig's Connection owns no memory and has no deinit, so the @hasDecl check keeps the bundled module exactly as it was.

• Server: before the buffers are freed.
• Client: before the stream is closed.
• tls_conn is set to null afterwards in both.

No test here: with the bundled tls.zig there is nothing to observe. The BoringSSL module's own tests (24k handshakes, flat RSS, leaks clean) are what caught it.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lalinsky/dusty/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: ccce553c-e7b9-490c-b5fd-9f053d833c24

📥 Commits

Reviewing files that changed from the base of the PR and between d3cb485 and bd45796.

📒 Files selected for processing: 3

• CHANGELOG.md
• src/client.zig
• src/server.zig

Included review availability: This review used your included allowance. Your plan provides up to 2 included reviews per hour; 1 remain after this review.

📝 Walkthrough

Client and server connection cleanup now conditionally calls tls.Connection.deinit and clears the stored TLS connection. The Unreleased changelog records this behavior and describes the per-connection SSL object leak.

Changes: TLS connection cleanup

Layer / File(s)	Summary
Client and server TLS cleanup src/client.zig, src/server.zig, CHANGELOG.md	Client and server connection cleanup calls tls.Connection.deinit when that method is declared, then clears the stored TLS connection. The changelog documents the change.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Suggested reviewers: lalinsky

Merge Risk: ⚪ Minimal · up to bd457

The change adds conditional TLS connection cleanup. No actionable merge-blocking issue is established by the available implementation evidence.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title clearly describes the main change: freeing TLS connection state when a connection closes.
Description check		The description directly explains the TLS cleanup behavior, the BoringSSL leak, the server and client changes, and the testing context.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{TLS connections close their book
Each declared cleanup gets a look
The stored handle clears away
The changelog marks the day
One SSL object less to stay}

_{Comment @coderabbitai help to get the list of available commands.}

[lalinsky]

Never occurred to me to use the tls.zig API as an interface, but it kind of makes sense. I'll see if I can upstream the deinit() method so we can get rid of the hasDecl later on.