Skip to content

gh-98078: fix asyncio SSL transports not sending the fatal TLS alert to the peer when the TLS handshake fails#153620

Open
kumaraditya303 wants to merge 3 commits into
python:mainfrom
kumaraditya303:gh-98078-ssl-fatal-alert
Open

gh-98078: fix asyncio SSL transports not sending the fatal TLS alert to the peer when the TLS handshake fails#153620
kumaraditya303 wants to merge 3 commits into
python:mainfrom
kumaraditya303:gh-98078-ssl-fatal-alert

Conversation

@kumaraditya303

@kumaraditya303 kumaraditya303 commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Fixes #98078

When an ssl.SSLError occurs on an asyncio SSL transport,
SSLProtocol force-closed the transport without flushing the outgoing
MemoryBIO, dropping the data OpenSSL left there for the peer: the
fatal TLS alert on handshake failure or on receiving invalid data, and
the close_notify alert on shutdown failure. The peer only saw the
connection abruptly closed with no way to tell why, while blocking
ssl.SSLSockets do send these alerts.

Fix this by calling _process_outgoing() before _fatal_error() on
the three SSLError paths (_on_handshake_complete(), _do_read(),
_do_shutdown()). For example, a server whose certificate is rejected
now gets SSLError: [SSL: TLSV1_ALERT_UNKNOWN_CA] instead of
ConnectionResetError, and a peer of a failed shutdown gets a clean
TLS EOF instead of a reset.

@kumaraditya303 kumaraditya303 added the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jul 12, 2026
@bedevere-bot

Copy link
Copy Markdown

🤖 New build scheduled with the buildbot fleet by @kumaraditya303 for commit d6eeb93 🤖

Results will be shown at:

https://buildbot.python.org/all/#/grid?branch=refs%2Fpull%2F153620%2Fmerge

If you want to schedule another build, you need to add the 🔨 test-with-buildbots label again.

@bedevere-bot bedevere-bot removed the 🔨 test-with-buildbots Test PR w/ buildbots; report in status section label Jul 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

asyncio SSL not sending TLS Fatal Alerts

2 participants