fix: close TCP socket on SSL connection failure (#125)

* fix: close TCP socket on SSL connection failure

Prevents socket leak when ssl:connect/3 fails by closing the
underlying TCP socket before returning the error.

* test: verify TCP socket cleanup on SSL connection failure

Author: Taure

src/pgo_handler.erl

@@ -157,6 +157,7 @@ setup_ssl(Conn=#conn{socket=Socket}, Options) ->
                         {ok, SSLSocket} ->
                             setup_startup(Conn#conn{socket=SSLSocket}, Options);
                         {error, _} = SSLConnectErr ->
+                            gen_tcp:close(Socket),
                             SSLConnectErr
                     end;
                 {ok, <<$N>>} ->

test/pgo_basic_SUITE.erl

@@ -15,7 +15,7 @@ all() ->
 
 groups() ->
     [{clear, [], cases()},
-     {ssl, [], [int4_range, exceptions]},
+     {ssl, [], [int4_range, exceptions, ssl_connect_failure_closes_socket]},
      {domain_socket, [], [int4_range]}].
 
 cases() ->
@@ -198,6 +198,26 @@ exceptions(_Config) ->
 
     ok.
 
+ssl_connect_failure_closes_socket(_Config) ->
+    %% Connect with invalid SSL options to force ssl:connect/3 to fail
+    %% after the server accepts the SSL request. Verify the TCP socket
+    %% is properly closed and not leaked.
+    TcpPortsBefore = [P || P <- erlang:ports(),
+                           erlang:port_info(P, name) =:= {name, "tcp_inet"}],
+    {error, _} = pgo_handler:open(default,
+                                  #{host => "127.0.0.1",
+                                    port => 5434,
+                                    user => "test",
+                                    password => "password",
+                                    database => "test",
+                                    ssl => true,
+                                    ssl_options => [{cacertfile, "/nonexistent/ca.pem"},
+                                                    {verify, verify_peer}]}),
+    TcpPortsAfter = [P || P <- erlang:ports(),
+                          erlang:port_info(P, name) =:= {name, "tcp_inet"}],
+    ?assertEqual(length(TcpPortsBefore), length(TcpPortsAfter)),
+    ok.
+
 select(_Config) ->
     {error, {Module, Reason}} = pgo:query("select $1", []),
     ?assertEqual("parameters needed for query not equal to number of arguments 1 != 0", Module:format_error(Reason)),