apply review

youknowone · youknowone · commit 0de09fe4b3e6 · 2026-03-13T17:55:19.000+09:00
diff --git a/crates/stdlib/src/ssl.rs b/crates/stdlib/src/ssl.rs
@@ -3629,19 +3629,9 @@ mod _ssl {
                             return return_data(buf, &buffer, vm);
                         }
                     }
-                    // Clean closure via close_notify from peer.
-                    // If we already sent close_notify (unwrap was called),
-                    // raise SSLZeroReturnError (bidirectional shutdown).
-                    // Otherwise return empty bytes, which callers (asyncore,
-                    // asyncio sslproto) interpret as EOF.
-                    let our_shutdown_state = *self.shutdown_state.lock();
-                    if our_shutdown_state == ShutdownState::SentCloseNotify
-                        || our_shutdown_state == ShutdownState::Completed
-                    {
-                        Err(create_ssl_zero_return_error(vm).upcast())
-                    } else {
-                        return_data(vec![], &buffer, vm)
-                    }
+                    // Python's read() returns empty bytes on SSL_ERROR_ZERO_RETURN
+                    // when the peer's close_notify has been received.
+                    return_data(vec![], &buffer, vm)
                 }
                 Err(crate::ssl::compat::SslError::WantRead) => {
                     // Non-blocking mode: would block
diff --git a/crates/stdlib/src/ssl/compat.rs b/crates/stdlib/src/ssl/compat.rs
@@ -1163,6 +1163,9 @@ fn handshake_write_loop(
 /// Returns (made_progress, is_first_sni_read).
 /// TLS record header size (content_type + version + length).
 const TLS_RECORD_HEADER_SIZE: usize = 5;
+/// Maximum on-the-wire TLS record size rustls accepts:
+/// 16 KiB payload + 2 KiB ciphertext overhead allowance + 5-byte header.
+const TLS_MAX_WIRE_RECORD_SIZE: usize = SSL3_RT_MAX_PLAIN_LENGTH + 2048 + TLS_RECORD_HEADER_SIZE;
 
 /// Read exactly one TLS record from the TCP socket.
 ///
@@ -1179,7 +1182,7 @@ const TLS_RECORD_HEADER_SIZE: usize = 5;
 /// buffer and remains visible to select().
 fn recv_one_tls_record(socket: &PySSLSocket, vm: &VirtualMachine) -> SslResult<PyObjectRef> {
     // Peek at what is available without consuming it.
-    let peeked_obj = match socket.sock_peek(SSL3_RT_MAX_PLAIN_LENGTH, vm) {
+    let peeked_obj = match socket.sock_peek(TLS_MAX_WIRE_RECORD_SIZE, vm) {
         Ok(d) => d,
         Err(e) => {
             if is_blocking_io_error(&e, vm) {
