Keep rustls error in SslError until converted into Python error

im-0 · May 24, 2026 · May 26, 2026 · May 30, 2026 · May 27, 2026 · May 30, 2026
commit 76c92aeb9b596029e0c70255f05e255725c1e880
diff --git a/crates/stdlib/src/rustls.rs b/crates/stdlib/src/rustls.rs
@@ -1198,7 +1198,7 @@ mod _ssl {
             };
 
             Ok(ClientConnection::new(Arc::new(config), server_name)
-                .map_err(|e| SslError::from_rustls(e).into_py_err(vm))?
+                .map_err(|e| SslError::Rustls(e).into_py_err(vm))?
                 .into())
         }
 
@@ -1214,7 +1214,7 @@ mod _ssl {
             // TODO: Search by a requested host name too.
             let cert_chain = self.cert_chain.read();
             if cert_chain.is_empty() {
-                return Err(SslError::from_rustls(rustls::Error::PeerIncompatible(
+                return Err(SslError::Rustls(rustls::Error::PeerIncompatible(
                     rustls::PeerIncompatible::NoCipherSuitesInCommon,
                 ))
                 .into_py_err(vm));
@@ -2707,7 +2707,7 @@ impl State {
             Err(SslError::Ssl("TLS alert is too long or too short".to_string()).into_py_err(vm))
         } else {
             Ok(Self::ServerSendingAlert {
-                error: SslError::from_rustls(error).into_py_err(vm),
+                error: SslError::Rustls(error).into_py_err(vm),
                 alert_buf,
                 alert_buf_pos: 0,
             })
@@ -2847,7 +2847,7 @@ impl Io {
                     let err = err
                         .downcast::<rustls::Error>()
                         .expect("BUG: Not a rustls Error");
-                    Err(SslError::from_rustls(err).into_py_err(vm))
+                    Err(SslError::Rustls(err).into_py_err(vm))
                 }
 
                 _ => Err(SslError::Io(err).into_py_err(vm)),

diff --git a/crates/stdlib/src/ssl/compat.rs b/crates/stdlib/src/ssl/compat.rs
@@ -177,19 +177,15 @@ pub(super) enum SslError {
     ZeroReturn,
     /// Unexpected EOF without close_notify (protocol violation)
     Eof,
-    /// Certificate verification error
-    CertVerification(rustls::CertificateError),
+    /// rustls error
+    Rustls(rustls::Error),
     /// I/O error
     Io(std::io::Error),
     /// Timeout error (socket.timeout)
     #[expect(dead_code, reason = "TODO: Implement timeouts")]
     Timeout(String),
     /// Python exception (pass through directly)
     Py(PyBaseExceptionRef),
-    /// TLS alert received with OpenSSL-compatible error code
-    AlertReceived { lib: i32, reason: i32 },
-    /// OpenSSL-compatible SSL reason code
-    OpenSslReason(i32),
 }
 
 impl SslError {
@@ -200,60 +196,6 @@ impl SslError {
         1000 + (u8::from(alert) as i32)
     }
 
-    /// Convert rustls error to SslError
-    pub(super) fn from_rustls(err: rustls::Error) -> Self {
-        match err {
-            rustls::Error::InvalidCertificate(cert_err) => Self::CertVerification(cert_err),
-            rustls::Error::AlertReceived(alert_desc) => {
-                // Map TLS alerts to OpenSSL-compatible error codes
-                // lib = 20 (ERR_LIB_SSL), reason = 1000 + alert_code
-                match alert_desc {
-                    rustls::AlertDescription::CloseNotify => {
-                        // Special case: close_notify is handled as ZeroReturn
-                        Self::ZeroReturn
-                    }
-                    _ => {
-                        // All other alerts: convert to OpenSSL error code
-                        // This includes InternalError (80 -> reason 1080)
-                        Self::AlertReceived {
-                            lib: ERR_LIB_SSL,
-                            reason: Self::alert_to_openssl_reason(alert_desc),
-                        }
-                    }
-                }
-            }
-            rustls::Error::PeerIncompatible(peer_err) => {
-                use rustls::PeerIncompatible;
-                let reason = match peer_err {
-                    PeerIncompatible::NoCipherSuitesInCommon => SSL_R_NO_SHARED_CIPHER,
-                    PeerIncompatible::NoKxGroupsInCommon
-                    | PeerIncompatible::NoEcPointFormatsInCommon
-                    | PeerIncompatible::EcPointsExtensionRequired
-                    | PeerIncompatible::NamedGroupsExtensionRequired
-                    | PeerIncompatible::UncompressedEcPointsRequired => SSL_R_NO_SUITABLE_GROUPS,
-                    PeerIncompatible::KeyShareExtensionRequired => SSL_R_NO_SUITABLE_KEY_SHARE,
-                    PeerIncompatible::NoCertificateRequestSignatureSchemesInCommon
-                    | PeerIncompatible::NoSignatureSchemesInCommon
-                    | PeerIncompatible::SignatureAlgorithmsExtensionRequired => {
-                        SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
-                    }
-                    PeerIncompatible::ServerDoesNotSupportTls12Or13
-                    | PeerIncompatible::ServerTlsVersionIsDisabledByOurConfig
-                    | PeerIncompatible::SupportedVersionsExtensionRequired
-                    | PeerIncompatible::Tls12NotOffered
-                    | PeerIncompatible::Tls12NotOfferedOrEnabled
-                    | PeerIncompatible::Tls13RequiredForQuic => SSL_R_UNSUPPORTED_PROTOCOL,
-                    _ => return Self::Ssl(format!("peer is incompatible: {peer_err:?}")),
-                };
-                Self::OpenSslReason(reason)
-            }
-            rustls::Error::NoApplicationProtocol => {
-                Self::OpenSslReason(SSL_R_NO_APPLICATION_PROTOCOL)
-            }
-            _ => Self::Ssl(format!("{err}")),
-        }
-    }
-
     /// Create SSLError with library and reason from string values
     ///
     /// This is the base helper for creating SSLError with _library and _reason
@@ -366,6 +308,57 @@ impl SslError {
             Self::WantWrite => create_ssl_want_write_error(vm).upcast(),
             Self::Timeout(msg) => timeout_error_msg(vm, msg).upcast(),
             Self::Ssl(msg) => Self::create_plain_ssl_error(vm, msg),
+            Self::Rustls(err) => match err {
+                rustls::Error::InvalidCertificate(cert_err) => {
+                    create_ssl_cert_verification_error(vm, &cert_err).expect("unlikely to happen")
+                }
+                rustls::Error::AlertReceived(rustls::AlertDescription::CloseNotify) => {
+                    create_ssl_zero_return_error(vm).upcast()
+                }
+                rustls::Error::AlertReceived(alert_desc) => Self::create_ssl_error_from_codes(
+                    vm,
+                    ERR_LIB_SSL,
+                    Self::alert_to_openssl_reason(alert_desc),
+                ),
+                rustls::Error::PeerIncompatible(peer_err) => {
+                    use rustls::PeerIncompatible;
+                    let reason = match peer_err {
+                        PeerIncompatible::NoCipherSuitesInCommon => SSL_R_NO_SHARED_CIPHER,
+                        PeerIncompatible::NoKxGroupsInCommon
+                        | PeerIncompatible::NoEcPointFormatsInCommon
+                        | PeerIncompatible::EcPointsExtensionRequired
+                        | PeerIncompatible::NamedGroupsExtensionRequired
+                        | PeerIncompatible::UncompressedEcPointsRequired => {
+                            SSL_R_NO_SUITABLE_GROUPS
+                        }
+                        PeerIncompatible::KeyShareExtensionRequired => SSL_R_NO_SUITABLE_KEY_SHARE,
+                        PeerIncompatible::NoCertificateRequestSignatureSchemesInCommon
+                        | PeerIncompatible::NoSignatureSchemesInCommon
+                        | PeerIncompatible::SignatureAlgorithmsExtensionRequired => {
+                            SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
+                        }
+                        PeerIncompatible::ServerDoesNotSupportTls12Or13
+                        | PeerIncompatible::ServerTlsVersionIsDisabledByOurConfig
+                        | PeerIncompatible::SupportedVersionsExtensionRequired
+                        | PeerIncompatible::Tls12NotOffered
+                        | PeerIncompatible::Tls12NotOfferedOrEnabled
+                        | PeerIncompatible::Tls13RequiredForQuic => SSL_R_UNSUPPORTED_PROTOCOL,
+                        _ => {
+                            return Self::create_plain_ssl_error(
+                                vm,
+                                format!("peer is incompatible: {peer_err:?}"),
+                            );
+                        }
+                    };
+                    Self::create_ssl_error_from_codes(vm, ERR_LIB_SSL, reason)
+                }
+                rustls::Error::NoApplicationProtocol => Self::create_ssl_error_from_codes(
+                    vm,
+                    ERR_LIB_SSL,
+                    SSL_R_NO_APPLICATION_PROTOCOL,
+                ),
+                _ => Self::create_plain_ssl_error(vm, err.to_string()),
+            },
             Self::PemLib(msg) => Self::create_pem_ssl_error(vm, format!("PEM lib: {msg}"))
                 .expect("unlikely to happen"),
             Self::FailedToReadDer(msg) => {
@@ -381,10 +374,6 @@ impl SslError {
             ),
             Self::ZeroReturn => create_ssl_zero_return_error(vm).upcast(),
             Self::Eof => create_ssl_eof_error(vm).upcast(),
-            Self::CertVerification(cert_err) => {
-                // Use the proper cert verification error creator
-                create_ssl_cert_verification_error(vm, &cert_err).expect("unlikely to happen")
-            }
             Self::Io(err) if err.kind() == std::io::ErrorKind::UnexpectedEof => {
                 create_ssl_eof_error(vm).upcast()
             }
@@ -397,12 +386,6 @@ impl SslError {
                 .upcast(),
             Self::Io(err) => err.into_pyexception(vm),
             Self::Py(exc) => exc,
-            Self::AlertReceived { lib, reason } => {
-                Self::create_ssl_error_from_codes(vm, lib, reason)
-            }
-            Self::OpenSslReason(reason) => {
-                Self::create_ssl_error_from_codes(vm, ERR_LIB_SSL, reason)
-            }
         }
     }
 }