Walkthrough

The SSL handshake logic in compat.rs is enhanced to more thoroughly drain the rustls write buffer when WantWrite occurs during socket mode, and to explicitly flush all pending TLS data after handshake completion in non-BIO mode.

Changes

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

Possibly related PRs

• Fix SSL handshake partial send #6635: Modifies SSL handshake write/flush logic in ssl/compat.rs to ensure rustls-generated TLS bytes are fully drained with WantWrite handling.
• Share more ssl consts and fix openssl  #6462: Changes TLS write-flushing and handshake read/write behavior in ssl/compat.rs through explicit flush/EOF handling and draining pending rustls writes.

Poem

🐰 The buffers flow like morning dew,
No data left behind in queue,
Loop and drain with gentle care,
Flush it all, both here and there! 💫

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

• 📝 Generate docstrings

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro

Reviewing files that changed from the base of the PR and between e91bc11 and 0d559d0.

• crates/stdlib/src/ssl/compat.rs

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

**/*.rs: Follow the default rustfmt code style by running cargo fmt to format Rust code
Always run clippy to lint code (cargo clippy) before completing tasks and fix any warnings or lints introduced by changes
Follow Rust best practices for error handling and memory management
Use the macro system (pyclass, pymodule, pyfunction, etc.) when implementing Python functionality in Rust

Files:

• crates/stdlib/src/ssl/compat.rs

• GitHub Check: Run snippets and cpython tests (macos-latest)
• GitHub Check: Run snippets and cpython tests (windows-2025)
• GitHub Check: Run snippets and cpython tests (ubuntu-latest)

crates/stdlib/src/ssl/compat.rs (1)

1240-1268: The WantWrite handling logic is correct and properly implements buffer draining with timeout protection.

The approach of catching WantWrite, performing a blocking flush, and continuing the loop ensures all TLS handshake data reaches the peer. The blocking_flush_all_pending implementation provides:

• Timeout handling: Respects socket timeout via sock_select and returns timeout errors
• Error resilience: Retries on transient blocking IO errors, returns on real errors
• Bounded execution: Loops only while pending data exists, avoiding infinite loops
• Edge case handling: Handles sent == 0 case where socket wasn't ready despite select

The data flow is correct:

1. send_all_bytes buffers unsent data in pending_tls_output on WantWrite
2. blocking_flush_all_pending blocks until that buffer is emptied (with timeout safeguard)
3. Loop continues to drain remaining rustls buffer
4. Final flush after loop handles any edge cases

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

• X
• Mastodon
• Reddit
• LinkedIn

Comment @coderabbitai help to get the list of available commands and usage tips.