gh-98078: fix asyncio SSL transports not sending the fatal TLS alert to the peer when the TLS handshake fails#153620
Open
kumaraditya303 wants to merge 3 commits into
Open
Conversation
peer when the TLS handshake fails
|
🤖 New build scheduled with the buildbot fleet by @kumaraditya303 for commit d6eeb93 🤖 Results will be shown at: https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F153620%2Fmerge If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #98078
When an
ssl.SSLErroroccurs on an asyncio SSL transport,SSLProtocolforce-closed the transport without flushing the outgoingMemoryBIO, dropping the data OpenSSL left there for the peer: thefatal TLS alert on handshake failure or on receiving invalid data, and
the
close_notifyalert on shutdown failure. The peer only saw theconnection abruptly closed with no way to tell why, while blocking
ssl.SSLSockets do send these alerts.Fix this by calling
_process_outgoing()before_fatal_error()onthe three
SSLErrorpaths (_on_handshake_complete(),_do_read(),_do_shutdown()). For example, a server whose certificate is rejectednow gets
SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA]instead ofConnectionResetError, and a peer of a failed shutdown gets a cleanTLS EOF instead of a reset.