From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Tue, 14 Apr 2026 04:41:37 +0000 (+0200)
Subject: [3.14] gh-148508: Add resilience to SSL preauth tests on iOS (GH-148536) (#148539)
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=adb2a3ac51d695d773e2ae167c6eae80ed876407;p=thirdparty%2FPython%2Fcpython.git

[3.14] gh-148508: Add resilience to SSL preauth tests on iOS (GH-148536) (#148539)

Adds handling for a test case seen in the iOS SSL tests where an SSL connection fails to
handshake correctly.
(cherry picked from commit c40e8b016a90820e4d799922903b90a505ffaf55)

Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
---

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index b0c6eca2091a..10615365a27e 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -5294,15 +5294,20 @@ class TestPreHandshakeClose(unittest.TestCase):
             return  # Expect the full test setup to always work on Linux.
         if (isinstance(err, ConnectionResetError) or
             (isinstance(err, OSError) and err.errno == errno.EINVAL) or
-            re.search('wrong.version.number', str(getattr(err, "reason", "")), re.I)):
+            re.search('wrong.version.number', str(getattr(err, "reason", "")), re.I) or
+            re.search('record.layer.failure', str(getattr(err, "reason", "")), re.I)
+        ):
             # On Windows the TCP RST leads to a ConnectionResetError
             # (ECONNRESET) which Linux doesn't appear to surface to userspace.
             # If wrap_socket() winds up on the "if connected:" path and doing
-            # the actual wrapping... we get an SSLError from OpenSSL. Typically
-            # WRONG_VERSION_NUMBER. While appropriate, neither is the scenario
-            # we're specifically trying to test. The way this test is written
-            # is known to work on Linux. We'll skip it anywhere else that it
-            # does not present as doing so.
+            # the actual wrapping... we get an SSLError from OpenSSL. This is
+            # typically WRONG_VERSION_NUMBER. The same happens on iOS, but
+            # RECORD_LAYER_FAILURE is the error.
+            #
+            # While appropriate, neither is the scenario we're specifically
+            # trying to test. The way this test is written is known to work on
+            # Linux. We'll skip it anywhere else that it does not present as
+            # doing so.
             try:
                 self.skipTest(f"Could not recreate conditions on {sys.platform}:"
                               f" {err=}")
diff --git a/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst b/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst
new file mode 100644
index 000000000000..7995dec397f7
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst
@@ -0,0 +1,2 @@
+An intermittent timing error when running SSL tests on iOS has been
+resolved.