I think it's not right to shutdown when eof received. It's better to wait for app resume when app reading paused. I wrote a test case(test_close_notify.py) for this situation. The server first sends 1024 * 50 bytes to client, then sends 7 bytes. The client reads the first payload(1024 * 50) then pauses reading and handles the payload in 3 seconds. After that the client resumes reading. So the client should totally receive 1024 * 50 + 7 bytes, not just 1024 * 50 bytes.

Even when there are no app reading pause, reading from buffer is needed before shutdown, cause sometimes ssl eof is in the same package of tcp fin. So when connection is closing, reading buffer is still needed to parse the EOF alert message in this package.