Repository navigation
Python SSL module does not clear error queue before IO operations using SSL_get_error #81891
Description
| BPO | 37710 |
|---|---|
| Nosy | @tiran, @apc-cradlepoint |
Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.
Show more details
GitHub fields:
assignee = 'https://github.com/tiran'
closed_at = None
created_at = <Date 2019-07-29.21:17:25.102>
labels = ['expert-SSL', '3.7', '3.8', '3.9']
title = 'Python SSL module does not clear error queue before IO operations using SSL_get_error'
updated_at = <Date 2019-07-29.21:17:25.102>
user = 'https://github.com/apc-cradlepoint'bugs.python.org fields:
activity = <Date 2019-07-29.21:17:25.102>
actor = 'Andrew Collins'
assignee = 'christian.heimes'
closed = False
closed_date = None
closer = None
components = ['SSL']
creation = <Date 2019-07-29.21:17:25.102>
creator = 'Andrew Collins'
dependencies = []
files = []
hgrepos = []
issue_num = 37710
keywords = []
message_count = 1.0
messages = ['348684']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'Andrew Collins']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = None
url = 'https://bugs.python.org/issue37710'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']
Activity
apc-cradlepoint commentedon Jul 29, 2019
Per the OpenSSL documentation:
"The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably."
https://www.openssl.org/docs/man1.1.1/man3/SSL_get_error.html
Modules/_ssl.c does clear errors on socket creation, and upon handling an error itself, but does not clear before IO operations that are checked with SSL_get_error.
When using OpenSSL outside of Modules/_ssl.c in the same process context (for example, using libssh through python bindings), this can results in random ssl errors being picked up by Modules/_ssl.c.