Walkthrough

Adds socket-peek-based TLS shutdown/read logic to the SSL module to distinguish TLS records from post-TLS cleartext during close-notify handling, plus a private helper to consume exactly one TLS record when appropriate. Also adds tests tracking comparison calls in sorting.

Changes

Sequence Diagram(s)

sequenceDiagram
    participant Client
    participant PySSLSocket
    participant Socket
    participant TlsConnection
    participant VM

    Client->>Socket: send data (may be TLS record or cleartext)
    PySSLSocket->>Socket: sock_peek(size)  -- MSG_PEEK
    Socket-->>PySSLSocket: peeked bytes
    PySSLSocket->>TlsConnection: analyze peeked bytes (record header)
    alt TLS record present
        PySSLSocket->>Socket: sock_recv(exact_record_len)
        Socket-->>PySSLSocket: TLS record bytes
        PySSLSocket->>TlsConnection: feed bytes, process_new_packets()
        TlsConnection-->>PySSLSocket: decrypted/plain data
        PySSLSocket->>VM: return decrypted data / handle close-notify
    else Post-TLS cleartext
        PySSLSocket-->>VM: treat peeked bytes as cleartext (do not consume TLS)
    end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• fix ssl MSG_PEEK #6892: Modifies same ssl.rs helpers and introduces peek-based TLS shutdown/read logic.
• better ssl write handling #6763: Overlaps on PySSLSocket I/O and shutdown/read handling around close-notify and process_new_packets.
• Share more ssl consts and fix openssl  #6462: Related changes to SSL read/shutdown behavior and BIO vs socket handling.

Suggested reviewers

• ShaharNaveh

Poem

"I'm a rabbit with a curious peek,
I nibble bytes but never take a sweep—
Close-notify whispers, I listen right,
I pass along records, keep the rest light.
Hooray for sorts that choose lt to leap!"

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

• 📝 Generate docstrings

• X
• Mastodon
• Reddit
• LinkedIn