Set SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER in calling OpenSSL

CHANGELOG.rst

@@ -4,6 +4,20 @@ Changelog
 Versions are year-based with a strict backward-compatibility policy.
 The third digit is only for regressions.
 
+25.2.0 (UNRELEASED)
+-------------------
+Backward-incompatible changes:
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+pyOpenSSL now sets SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER by default, matching CPython's behavior. #1287.
+The minimum cryptography version is now 42.0.0.
+
+Deprecations:
+^^^^^^^^^^^^^
+
+Changes:
+^^^^^^^^
+
+
 25.1.0 (2025-05-17)
 -------------------
 

setup.py

@@ -94,7 +94,7 @@ def find_meta(meta):
         packages=find_packages(where="src"),
         package_dir={"": "src"},
         install_requires=[
-            "cryptography>=41.0.5,<46",
+            "cryptography>=42.0.0,<46",
             (
                 "typing-extensions>=4.9; "
                 "python_version < '3.13' and python_version >= '3.8'"

src/OpenSSL/SSL.py

@@ -915,7 +915,10 @@ def __init__(self, method: int) -> None:
         )
         self._cookie_verify_helper: _CookieVerifyCallbackHelper | None = None
 
-        self.set_mode(_lib.SSL_MODE_ENABLE_PARTIAL_WRITE)
+        self.set_mode(
+            _lib.SSL_MODE_ENABLE_PARTIAL_WRITE
+            | _lib.SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER
+        )
         if version is not None:
             self.set_min_proto_version(version)
             self.set_max_proto_version(version)
@@ -1714,6 +1717,14 @@ def set_mode(self, mode: int) -> int:
 
         return _lib.SSL_CTX_set_mode(self._context, mode)
 
+    @_require_not_used
+    def clear_mode(self, mode_to_clear: int) -> int:
+        """
+        Modes previously set cannot be overwritten without being
+        cleared first. This method should be used to clear existing modes.
+        """
+        return _lib.SSL_CTX_clear_mode(self._context, mode_to_clear)
+
     @_require_not_used
     def set_tlsext_servername_callback(
         self, callback: Callable[[Connection], None]