Skip to content

Rustls integration improvements #7946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
youknowone merged 11 commits into from
May 22, 2026
Merged

Rustls integration improvements #7946

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
ad3060c
Do not call `import socket` on each send()/recv() when using rustls
im-0 May 18, 2026
7fa757d
Implement reading of at most one TLS record from socket
im-0 May 18, 2026
bc2dbf9
Remove special handling of rustls "buffer full" errors
im-0 May 19, 2026
023c754
Replace own TlsConnection with rustls::Connection
im-0 May 19, 2026
e99f0c4
Fix waiting on a socket
im-0 May 19, 2026
e9e359c
Remove dead code from rustls glue
im-0 May 20, 2026
7a10b53
Do not present rustls errors as OSError(0, "Success")
im-0 May 21, 2026
86ec36b
Remove infinite loop "detection" from rustls glue
im-0 May 21, 2026
fbe1f80
Add test for 1-byte max recv in TLS client
im-0 May 21, 2026
6905963
Add regression test for https://github.com/RustPython/RustPython/issu…
im-0 May 21, 2026
6c0e292
Fix constants in rustls glue code
im-0 May 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Remove infinite loop "detection" from rustls glue 
TLS handshake cannot be infinite. Any infinite loop here is a serious
bug in implementation and should be fixed properly.

This code triggers in some cases (very short reads) with misleading
`ssl_error.SSLWantReadError: The operation did not complete (read)`.
  • Loading branch information
@im-0
im-0 committed May 21, 2026
commit 86ec36b3111c1fde7f022818db06b055f36303f9
14 changes: 3 additions & 11 deletions crates/stdlib/src/ssl/compat.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1242,10 +1242,7 @@ pub(super) fn ssl_do_handshake(
let is_bio = socket.is_bio_mode();
let is_server = matches!(conn, Connection::Server(_));
let mut first_iteration = true; // Track if this is the first loop iteration
let mut iteration_count = 0;

loop {
iteration_count += 1;
let mut made_progress = false;

// IMPORTANT: In BIO mode, force initial write even if wants_write() is false
Expand Down Expand Up @@ -1363,11 +1360,6 @@ pub(super) fn ssl_do_handshake(
if !should_continue {
break;
}

// Safety check: prevent truly infinite loops (should never happen)
if iteration_count > 1000 {
break;
}
}

// If we exit the loop without completing handshake, return appropriate error
Expand All @@ -1381,9 +1373,9 @@ pub(super) fn ssl_do_handshake(
return Err(SslError::WantRead);
}
// Neither wants_read nor wants_write - this is a real error
Err(SslError::Syscall(format!(
"SSL handshake failed: incomplete after {iteration_count} iterations",
)))
Err(SslError::Syscall(
"SSL handshake failed: incomplete handshake".to_string(),
))
} else {
// Handshake completed successfully (shouldn't reach here normally)
Ok(())
Expand Down