Skip to content

tls: send the second request once in the post-handshake auth test - #5200

Merged
gpotter2 merged 1 commit into
secdev:masterfrom
glaziermag:fix/tls-pha-test-double-send
Sep 26, 2026
Merged

gpotter2 merged 1 commit into
secdev:masterfrom
glaziermag:fix/tls-pha-test-double-send

Conversation

@glaziermag

Copy link
Copy Markdown
Contributor

Description

test_tls_client_native() hands REQS[1] to the client automaton twice, with send() and then with sr1() (

# Second request
a.send(REQS[1])
pkt = a.sr1(REQS[1], timeout=1, verbose=0)
). The ssl_server thread reads one request, answers it and shuts the connection down (
t = ssl_client_socket.verify_client_post_handshake()
# Receive / send data
resp = ssl_client_socket.read(len(REQS[1]))
assert resp == bytes(REQS[1])
ssl_client_socket.send(bytes(RESPS[1]))
# close socket
try:
ssl_client_socket.shutdown(socket.SHUT_RDWR)
finally:
ssl_client_socket.close()
try:
), which can happen while the client is still building its post-handshake Certificate. That flight then lands on the shut-down socket and is answered with a RST, so the send of the second copy raises BrokenPipeError in flush_records() under should_send_ClientData() (
@ATMT.condition(ADDED_CLIENTDATA)
def should_send_ClientData(self):
self.flush_records()
raise self.SENT_CLIENTDATA()
), the automaton stops, and the 200 Welcome record already queued on the socket is never read, so sr1() returns None.

That is the macos-14 3.14 failure of Testing TLS client against ssl.SSLContext server with TLS 1.3 and a post-handshake authentication on master (AttributeError: 'NoneType' object has no attribute 'load'), e.g. https://github.com/secdev/scapy/actions/runs/35789038699/job/106956973992 and https://github.com/secdev/scapy/actions/runs/35743207536/job/106801186588; locally on macOS it fails about 1 run in 100. The OSError: [Errno 57] traceback printed by the server thread in those logs is server.shutdown() on the listening socket and appears in passing runs too.

Sending the request once removes the write on the closed connection.

This message was written with the help of AI (Claude Fable 5.1).

🤖 Generated with Claude Code

test_tls_client_native() handed REQS[1] to the client automaton twice,
with send() and then with sr1(). The ssl_server thread answers the first
copy and closes the connection while the client may still be sending
its post-handshake Certificate; the second copy then fails with EPIPE
in should_send_ClientData(), the automaton stops, and the queued 200
response is never read, so sr1() returns None. Seen on the macos-14
leg on master. Send the request once.

AI-Assisted: yes (Claude Fable 5.1)
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
@codecov

codecov Bot commented Sep 26, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.17%. Comparing base (e4742a5) to head (f2a2d06).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5200      +/-   ##
==========================================
+ Coverage   80.92%   81.17%   +0.25%     
==========================================
  Files         393      393              
  Lines       98107    98107              
==========================================
+ Hits        79392    79638     +246     
+ Misses      18715    18469     -246     

see 12 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@gpotter2
gpotter2 merged commit c5e9a5b into secdev:master Sep 26, 2026
23 checks passed
@gpotter2

Copy link
Copy Markdown
Member

Thanks for the PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants