[desc]

Summary

ssl_connect() hardcoded socket(AF_INET, …), making TLS and DTLS connections to IPv6-only peers impossible — connect() failed with EAFNOSUPPORT on any IPv6 destination.

Extract ssl_socket() which derives the address family from the SocketAddress, supporting both AF_INET and AF_INET6 for TLS (SOCK_STREAM/IPPROTO_TCP) and DTLS (SOCK_DGRAM). Also correct the error code for SSL_connect failures from ENOMEM to EIO.

Add test-tls-socket.c covering all four combinations (IPv4/IPv6 × TLS/DTLS) plus rejection of unsupported address families. TLS tests use port 6514, DTLS tests use port 4433.

Fixes: #151

Changes

• Extract ssl_socket() from ssl_connect() — uses sa.sa_family instead of hardcoded AF_INET, enabling IPv6 for both TLS and DTLS
• Add SOCK_CLOEXEC to the socket creation flags
• Correct SSL_connect() failure error code from ENOMEM to EIO in both ssl_connect_tls() and ssl_connect_dtls()
• Declare ssl_socket() in netlog-ssl-common.h
• Add tests/test-tls-socket.c with 5 cmocka tests covering all four combinations (IPv4/IPv6 × TLS/DTLS) plus rejection of unsupported address families
• Register test-tls-socket in tests/meson.build
• Document the new test in TESTING.md

Testing

• meson test -C build passes
• Tested with UDP/TCP/TLS as applicable
• New code has test coverage (if applicable)

Checklist

• Code follows systemd coding style
• Commit messages are clear and descriptive
• Documentation updated (if applicable)
• No new compiler warnings

[desc]

Feedback would be appreciated.