Python SSL module does not clear error queue before IO operations using SSL_get_error

[apc-cradlepoint]

BPO	37710
Nosy	@tiran, @apc-cradlepoint

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = None
created_at = <Date 2019-07-29.21:17:25.102>
labels = ['expert-SSL', '3.7', '3.8', '3.9']
title = 'Python SSL module does not clear error queue before IO operations using SSL_get_error'
updated_at = <Date 2019-07-29.21:17:25.102>
user = 'https://github.com/apc-cradlepoint'

bugs.python.org fields:

activity = <Date 2019-07-29.21:17:25.102>
actor = 'Andrew Collins'
assignee = 'christian.heimes'
closed = False
closed_date = None
closer = None
components = ['SSL']
creation = <Date 2019-07-29.21:17:25.102>
creator = 'Andrew Collins'
dependencies = []
files = []
hgrepos = []
issue_num = 37710
keywords = []
message_count = 1.0
messages = ['348684']
nosy_count = 2.0
nosy_names = ['christian.heimes', 'Andrew Collins']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = None
url = 'https://bugs.python.org/issue37710'
versions = ['Python 3.5', 'Python 3.6', 'Python 3.7', 'Python 3.8', 'Python 3.9']

[apc-cradlepoint]

Per the OpenSSL documentation:

"The current thread's error queue must be empty before the TLS/SSL I/O operation is attempted, or SSL_get_error() will not work reliably."

https://www.openssl.org/docs/man1.1.1/man3/SSL_get_error.html

Modules/_ssl.c does clear errors on socket creation, and upon handling an error itself, but does not clear before IO operations that are checked with SSL_get_error.

When using OpenSSL outside of Modules/_ssl.c in the same process context (for example, using libssh through python bindings), this can results in random ssl errors being picked up by Modules/_ssl.c.