proposal: crypto/tls: closeNotify failure should be a well-known error type for easy exclusion

[oakad]

Proposal Details

In many cases, servers don't wait for TLS closeNotify from the client. For example, both MySQL and PostgreSQL will sometime drop the connection the moment appropriate "disconnect" command is received, without waiting for further comms from the client (this is a deliberate implementation choice, given that all the messages are length prefixed and such).

Right now, failure to "closeNotify" is a free form error:

go/src/crypto/tls/conn.go

Line 1443 in f15cd63

alertErr = fmt.Errorf("tls: failed to send closeNotify alert (but connection was closed anyway): %w", err)

It will be substantially safer to make it a named error type, so in cases where client knows, that server can drop the connection, it can be easily suppressed with errors.Is without relying on unsafe string matching.

[seankhliao]

cc @golang/security