net.http: free TLS resources for force-closed idle connections

The previous fix skipped conn.shutdown() entirely for an idle TLS connection
that close_idle force-closed on Windows, to avoid closing the socket a second
time. But SSLConn.shutdown() does two jobs: it frees the mbedtls TLS resources
(SSL context, config, certs, RNG state, ALPN allocation) AND closes the socket.
Skipping it leaked all of those for every force-closed idle connection at
server shutdown.

Split the two concerns instead of bypassing cleanup: when close_idle already
owns the socket close (was_force_closed), relinquish socket ownership
(conn.owns_socket = false) and still call conn.shutdown(). shutdown() then frees
the TLS resources but skips net.close, so the fd is still closed exactly once
(by close_idle) and nothing leaks. On non-Windows was_force_closed is always
false and the worker remains the sole closer, unchanged. Found by Codex on
#27542.

Co-Authored-By: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/server_tls_idle.v

@@ -13,9 +13,10 @@ mut:
 	handles []int
 	closing bool
 	// closed records handles that close_idle force-closed on Windows. The woken
-	// worker consults was_force_closed and skips its own conn.shutdown so the fd
-	// is closed exactly once. Empty on non-Windows (close_idle only shuts the fd
-	// down there, leaving the worker the sole closer).
+	// worker consults was_force_closed and relinquishes socket ownership (so its
+	// conn.shutdown frees the TLS resources without closing the fd again), keeping
+	// the fd closed exactly once. Empty on non-Windows (close_idle only shuts the
+	// fd down there, leaving the worker the sole closer).
 	closed []int
 }
 
@@ -44,11 +45,12 @@ fn (mut t TlsIdleConnTracker) unmark_idle(handle int) {
 
 // was_force_closed reports whether close_idle has already closed `handle`
 // (Windows force-close to wake a worker blocked in select). The woken worker
-// must then skip its own conn.shutdown: a second close would race process-wide
-// SOCKET reuse — the value can be reused by ANY socket the process opens, not
-// just this server's accept loop — and could close an unrelated socket. Always
-// false on non-Windows, where close_idle only shuts the fd down and the worker
-// remains the sole closer.
+// must then relinquish socket ownership before its own conn.shutdown, which
+// then frees the TLS resources without closing the fd again: a second close
+// would race process-wide SOCKET reuse — the value can be reused by ANY socket
+// the process opens, not just this server's accept loop — and could close an
+// unrelated socket. Always false on non-Windows, where close_idle only shuts
+// the fd down and the worker remains the sole closer.
 fn (mut t TlsIdleConnTracker) was_force_closed(handle int) bool {
 	$if windows {
 		t.mu.lock()
@@ -74,8 +76,9 @@ fn (mut t TlsIdleConnTracker) close_idle() {
 		// select() — only closesocket() (net.close, below) does — so we must
 		// force-close idle handles to wake their workers. Record ownership of
 		// those closes here, under the lock, so a worker that wakes (or exits for
-		// another reason) sees it via was_force_closed and skips its own
-		// conn.shutdown. Without that the fd would be closed twice, and between
+		// another reason) sees it via was_force_closed and relinquishes socket
+		// ownership instead of closing the fd again. Without that the fd would be
+		// closed twice, and between
 		// the two closes the SOCKET value can be reused by any socket the process
 		// opens, so the second close could hit an unrelated socket.
 		t.closed << handles

vlib/net/http/server_tls_notd_use_openssl.v

@@ -159,13 +159,17 @@ fn (mut w TlsHandlerWorker) handle_conn(mut conn mbedtls.SSLConn) {
 			w.idle_conns.unmark_idle(conn.handle)
 		}
 		// close_idle may have already closed conn.handle on Windows (a forced
-		// closesocket to wake this worker from a blocked read). Closing it again
-		// would race process-wide SOCKET reuse and could close an unrelated
-		// socket, so skip our close when close_idle owns it. On non-Windows this
-		// is always false and the worker remains the sole closer.
-		if !w.idle_conns.was_force_closed(conn.handle) {
-			conn.shutdown() or {}
+		// closesocket to wake this worker from a blocked read). conn.shutdown()
+		// both frees the mbedtls TLS resources (SSL ctx, config, certs, RNG,
+		// ALPN alloc) AND closes the socket; we must always do the former but
+		// must not close the socket a second time — that would race process-wide
+		// SOCKET reuse and could close an unrelated socket. So relinquish socket
+		// ownership and still call shutdown for the TLS cleanup. On non-Windows
+		// was_force_closed is always false and the worker remains the sole closer.
+		if w.idle_conns.was_force_closed(conn.handle) {
+			conn.owns_socket = false
 		}
+		conn.shutdown() or {}
 	}
 	// If the TLS handshake negotiated HTTP/2 via ALPN, switch to the HTTP/2
 	// driver; otherwise fall through to the existing HTTP/1.1 path unchanged.