Correctly discard data after close_notify alert

rustls/src/conn.rs

@@ -793,7 +793,8 @@ impl<Data> ConnectionCore<Data> {
             {
                 // "Any data received after a closure alert has been received MUST be ignored."
                 // -- <https://datatracker.ietf.org/doc/html/rfc8446#section-6.1>
-                discard = borrowed_buffer.filled().len();
+                // This is data that has already been accepted in `read_tls`.
+                discard += borrowed_buffer.filled().len();
                 break;
             }
         }

rustls/tests/api.rs

@@ -6390,6 +6390,7 @@ fn test_junk_after_close_notify_received() {
         .read_tls(&mut io::Cursor::new(&client_buffer[..]))
         .unwrap();
     server.process_new_packets().unwrap();
+    server.process_new_packets().unwrap(); // check for desync
 
     // can read data received prior to close_notify
     let mut received_data = [0u8; 128];