net: fixed TLS buffer process via OpenSSL

- added the #459 #460 OpenSSL fix also for client sockets, because they expect the same behavior than plain recv/send socket API calls
- applied the options at the CTX level, which are inherited by every accepted socket.

Author: arnaud65110

src/lib/mormot.lib.openssl11.pas

@@ -11271,6 +11271,13 @@ procedure TOpenSslNetTls.SetupCtx(var Context: TNetTlsContext; Bind: boolean);
   SSL_CTX_set_min_proto_version(fCtx, v);
   if Context.DisableTls13 then
     SSL_CTX_set_max_proto_version(fCtx, TLS1_2_VERSION); // stick to TLS 1.2
+  // SSL_MODE_ENABLE_PARTIAL_WRITE ($01): SSL_write returns partial count on
+  // partial send, so mORMot can advance the buffer pointer correctly and
+  // issue a fresh SSL_write for the remainder (no retry-same-buffer constraint)
+  // SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER ($02): allow retry with different
+  // buffer pointer after WANT_WRITE (mORMot copies pending data to fWr)
+  SSL_CTX_set_mode(fCtx, SSL_MODE_ENABLE_PARTIAL_WRITE or
+                         SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 end;
 
 function AfterAcceptSNI(s: PSSL; ad: PInteger; arg: pointer): integer; cdecl;
@@ -11338,12 +11345,6 @@ procedure TOpenSslNetTls.AfterAccept(Socket: TNetSocket;
     if BoundContext.AcceptCert = nil then
       raise EOpenSslNetTls.Create('AfterAccept: missing AfterBind');
     fSsl := SSL_new(BoundContext.AcceptCert);
-    // SSL_MODE_ENABLE_PARTIAL_WRITE ($01): SSL_write returns partial count on
-    // partial send, so mORMot can advance the buffer pointer correctly and
-    // issue a fresh SSL_write for the remainder (no retry-same-buffer constraint)
-    // SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER ($02): allow retry with different
-    // buffer pointer after WANT_WRITE (mORMot copies pending data to fWr)
-    SSL_set_mode(fSsl, $00000003); // ENABLE_PARTIAL_WRITE | ACCEPT_MOVING_WRITE_BUFFER
     Check('AfterAccept set_fd', SSL_set_fd(fSsl, Socket.Socket));
     // server TLS negotiation with server
     Check('AfterAccept accept', SSL_accept(fSsl));

src/mormot.commit.inc

@@ -1 +1 @@
-'2.4.14852'
+'2.4.14853'