Skip to content

gh-148292: Update SSLSocket.read() for OpenSSL 4#148602

Draft
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:sslsocket_eof
Draft

gh-148292: Update SSLSocket.read() for OpenSSL 4#148602
vstinner wants to merge 1 commit intopython:mainfrom
vstinner:sslsocket_eof

Conversation

@vstinner
Copy link
Copy Markdown
Member

@vstinner vstinner commented Apr 15, 2026

Add _got_eof attribute to avoid calling SSL_read_ex() again after SSL_ERROR_EOF.

Add _got_eof attribute to avoid calling SSL_read_ex() again after
SSL_ERROR_EOF.
@vstinner
Copy link
Copy Markdown
Member Author

@picnixz @gpshead: Would you mind to review this (draft) change?

I marked the PR as a draft since I'm not sure if the fix makes sense and is correct.

See #148600 (comment) to reproduce the issue and build Python 3.15 with OpenSSL 4.0.0.

Note: #148601 (Add Modules/_ssl_data_40.h data) has no effect on test_urllib2_localnet (it does still fail).

@vstinner
Copy link
Copy Markdown
Member Author

See #146217 (comment) for differences between OpenSSL 3 and OpenSSL 4.

In short:

  • On OpenSSL 3, the 3rd read fails with SSLEOFError("UNEXPECTED_EOF_WHILE_READING"), and the following 4th read fails with SSLEOFError("EOF occurred in violation of protocol").
  • On OpenSSL 4, the 3rd read fails with SSLEOFError("UNEXPECTED_EOF_WHILE_READING"), and the following 4th read fails with SSLError("A failure in the SSL library occurred").

@picnixz
Copy link
Copy Markdown
Member

picnixz commented Apr 15, 2026

I don't think it's the correct change because I need to investigate. The reason why I don't think it's correct is because the code path being taken to trigger "A failure in the SSL library occurred" means that the last OpenSSL error code was not set (either we cleared it accidently or they didn't set it correctly) and this is something that can happen elsewhere.

@picnixz
Copy link
Copy Markdown
Member

picnixz commented Apr 15, 2026

FTR, this may be related #148594.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants