Function recv_one_tls_record

crates/stdlib/src/ssl/compat.rs:1180–1241

Read exactly one TLS record from the TCP socket. OpenSSL reads one TLS record at a time (no read-ahead by default). Rustls, however, consumes all available TCP data when fed via read_tls(). If a close_notify or other control record arrives alongside application data, the eager read drains the TCP buffer, leaving the control record in rustls's internal buffer where select() cannot see it. This ca

(socket: &PySSLSocket, vm: &VirtualMachine)

/// and recv() only that many bytes.  Any remaining data stays in the kernel
/// buffer and remains visible to select().
fn recv_one_tls_record(socket: &PySSLSocket, vm: &VirtualMachine) -> SslResult<PyObjectRef> {
    // Peek at what is available without consuming it.
    let peeked_obj = match socket.sock_peek(SSL3_RT_MAX_PLAIN_LENGTH, vm) {
        Ok(d) => d,
        Err(e) => {
            if is_blocking_io_error(&e, vm) {
                return Err(SslError::WantRead);
            }
            return Err(SslError::Py(e));
        }
    };

    let peeked = ArgBytesLike::try_from_object(vm, peeked_obj)
        .map_err(|_| SslError::Syscall("Expected bytes-like object from peek".to_string()))?;
    let peeked_bytes = peeked.borrow_buf();

    if peeked_bytes.is_empty() {
        // Empty peek means the peer has closed the TCP connection (FIN).
        // Non-blocking sockets would have returned EAGAIN/EWOULDBLOCK
        // (caught above as WantRead), so empty bytes here always means EOF.
        return Err(SslError::Eof);
    }

    if peeked_bytes.len() < TLS_RECORD_HEADER_SIZE {
        // Not enough data for a TLS record header yet.
        // Read all available bytes so rustls can buffer the partial header;
        // this avoids busy-waiting because the kernel buffer is now empty
        // and select() will only wake us when new data arrives.
        return socket.sock_recv(peeked_bytes.len(), vm).map_err(|e| {
            if is_blocking_io_error(&e, vm) {
                SslError::WantRead
            } else {
                SslError::Py(e)
            }
        });
    }

    // Parse the TLS record length from the header.
    let record_body_len = u16::from_be_bytes([peeked_bytes[3], peeked_bytes[4]]) as usize;
    let total_record_size = TLS_RECORD_HEADER_SIZE + record_body_len;

    let recv_size = if peeked_bytes.len() >= total_record_size {
        // Complete record available — consume exactly one record.
        total_record_size
    } else {
        // Incomplete record — consume everything so the kernel buffer is
        // drained and select() will block until more data arrives.
        peeked_bytes.len()
    };

    // Must drop the borrow before calling sock_recv (which re-enters Python).
    drop(peeked_bytes);
    drop(peeked);

    socket.sock_recv(recv_size, vm).map_err(|e| {
        if is_blocking_io_error(&e, vm) {
            SslError::WantRead
        } else {