fix: cleanly close the connect tunnel

[agrimault-dinum]

No description provided.

[rlahfa-dinum]

If you want to salvage this to solve #50, feel free. Otherwise, I will let you close it.

[agrimault-dinum]

I began this code to fix #50 but thought it might be useful with regards to the bug we were experiencing.

The question I keep pondering is: should we actually mute the warning? I am hesitating here, since the protocol inside the tls tunnel might be vulnerable to truncation. Since we don't inspect, we can't differentiate between legitimate and not. How about putting the error as a warning as subsystem=proxy_access?

In order to fix #50:

• add a e2e test that we correctly propagate the close_notify
• do something about the error

[rlahfa-dinum]

I began this code to fix #50 but thought it might be useful with regards to the bug we were experiencing.

The question I keep pondering is: should we actually mute the warning? I am hesitating here, since the protocol inside the tls tunnel might be vulnerable to truncation. Since we don't inspect, we can't differentiate between legitimate and not. How about putting the error as a warning as subsystem=proxy_access?

In order to fix #50:

• add a e2e test that we correctly propagate the close_notify
• do something about the error

The way I would fix this is I would write a truncation attack as an E2E test and verify things behave reasonably.