From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Mon, 13 Apr 2026 21:30:52 +0000 (+0200)
Subject: [3.13] gh-146139: Disable `socketpair` authentication on WASI (GH-146140) (#148527)
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=d82c491b2ebb8fa952efa1dfddb2e873d867ccb2;p=thirdparty%2FPython%2Fcpython.git

[3.13] gh-146139: Disable `socketpair` authentication on WASI (GH-146140) (#148527)

gh-146139: Disable `socketpair` authentication on WASI (GH-146140)

Calling `connect(2)` on a non-blocking socket on WASI may leave the socket in a
"connecting" but not yet "connected" state.  In the former case, calling
`getpeername(2)` on it will fail, leading to an unhandled exception in Python.
(cherry picked from commit a5b76d53bb29afd864243f44ef22968f6385dfa0)

Co-authored-by: Joel Dice <joel.dice@akamai.com>
Co-authored-by: Victor Stinner <vstinner@python.org>
Co-authored-by: Brett Cannon <brett@python.org>
---

diff --git a/Lib/socket.py b/Lib/socket.py
index 35d87eff34de..55644bd4c17d 100644
--- a/Lib/socket.py
+++ b/Lib/socket.py
@@ -634,18 +634,22 @@ def _fallback_socketpair(family=AF_INET, type=SOCK_STREAM, proto=0):
     # Authenticating avoids using a connection from something else
     # able to connect to {host}:{port} instead of us.
     # We expect only AF_INET and AF_INET6 families.
-    try:
-        if (
-            ssock.getsockname() != csock.getpeername()
-            or csock.getsockname() != ssock.getpeername()
-        ):
-            raise ConnectionError("Unexpected peer connection")
-    except:
-        # getsockname() and getpeername() can fail
-        # if either socket isn't connected.
-        ssock.close()
-        csock.close()
-        raise
+    #
+    # Note that we skip this on WASI because on that platorm the client socket
+    # may not have finished connecting by the time we've reached this point (gh-146139).
+    if sys.platform != "wasi":
+        try:
+            if (
+                    ssock.getsockname() != csock.getpeername()
+                    or csock.getsockname() != ssock.getpeername()
+            ):
+                raise ConnectionError("Unexpected peer connection")
+        except:
+            # getsockname() and getpeername() can fail
+            # if either socket isn't connected.
+            ssock.close()
+            csock.close()
+            raise
 
     return (ssock, csock)