tls_wrap: handle empty writes