ssl: pass test_ssl with the rustls backend by youknowone · Pull Request #8502 · RustPython/RustPython · GitHub
Skip to content

ssl: pass test_ssl with the rustls backend - #8502

Merged
youknowone merged 2 commits into
RustPython:mainfrom
youknowone:RustPython-7
Aug 12, 2026
Merged

youknowone merged 2 commits into
RustPython:mainfrom
youknowone:RustPython-7

Conversation

@youknowone

@youknowone youknowone commented Aug 12, 2026

Copy link
Copy Markdown
Member

Summary

  • align the rustls/AWS-LC SSL backend with CPython-visible test_ssl behavior
  • verify TLS 1.2 and TLS 1.3 handshake signatures even when certificate-chain verification is disabled
  • recognize legacy self-issued X.509v1 trust anchors and report the expected SNI callback error reason
  • give debug-build Python worker threads an 8 MiB default stack so the threaded SSL test server does not hit the native stack guard
  • add a regression test that checks the actual pthread stack size on Linux and macOS

Root cause

Several rustls compatibility details diverged from the behavior expected by CPython's SSL tests. In addition, Rust's 2 MiB default worker-thread stack is too small for RustPython's unoptimized debug call chains: the threaded SSL server reached the native stack guard at a Python recursion depth of only 21. The stack override is debug-only, preserves explicit threading.stack_size() values, and leaves release behavior unchanged.

Impact

cargo run -- -m test test_ssl now completes successfully with all 196 enabled tests passing. The changes keep the non-OpenSSL rustls/AWS-LC implementation and improve handshake correctness and certificate compatibility.

Validation

  • cargo run -- -m test test_ssl
  • cargo run --release -- -m test test_ssl test_thread
  • cargo test -p rustpython-vm --features threading default_python_thread_stack_size_debug -- --nocapture
  • cargo test --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi
  • (cd crates/capi && cargo test)
  • cargo fmt --all -- --check
  • cargo clippy --workspace --exclude rustpython_wasm --exclude rustpython-venvlauncher --exclude rustpython-capi --all-targets

The clippy run completed with only five pre-existing must_use_candidate warnings in rustpython-compiler-source.

Summary by CodeRabbit

  • Bug Fixes
    • Improved TLS compatibility reporting for the AWS-LC/rustls backend.
    • Corrected SNI error classification for clearer TLS failure handling.
    • Recognized legacy self-issued certificates as valid certificate authorities where appropriate.
    • TLS handshake signature verification now follows the configured provider’s supported schemes.
    • Debug-mode Python threads now use a consistent default stack size on supported platforms, improving reliability.

Assisted-by: OpenAI Codex:GPT-5
@coderabbitai

coderabbitai Bot commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

@youknowone
youknowone marked this pull request as ready for review August 12, 2026 07:17

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
crates/vm/src/stdlib/_thread.rs (1)

2034-2047: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Cover the explicit stack-size path.

The test only covers vm.state.stacksize == 0. Add a debug Linux/macOS test that sets a value larger than DEFAULT_THREAD_STACK_SIZE and verifies that the observed native stack size is at least that configured value. This verifies that an explicit threading.stack_size() value continues to override the debug default.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@crates/vm/src/stdlib/_thread.rs` around lines 2034 - 2047, Add a debug
Linux/macOS test alongside default_python_thread_stack_size_debug that sets
vm.state.stacksize to a value larger than DEFAULT_THREAD_STACK_SIZE before
calling apply_thread_stack_size, then spawn and join current_thread_stack_size
and assert the observed size is at least the configured value. Keep the test
scoped to the supported debug platforms and verify the explicit stack-size
setting overrides the default.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@crates/vm/src/stdlib/_thread.rs`:
- Around line 2034-2047: Add a debug Linux/macOS test alongside
default_python_thread_stack_size_debug that sets vm.state.stacksize to a value
larger than DEFAULT_THREAD_STACK_SIZE before calling apply_thread_stack_size,
then spawn and join current_thread_stack_size and assert the observed size is at
least the configured value. Keep the test scoped to the supported debug
platforms and verify the explicit stack-size setting overrides the default.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Pro Plus

Run ID: b11c80dd-21cb-4f69-a121-1691a32525ec

📥 Commits

Reviewing files that changed from the base of the PR and between 81df1ff and 2ab612f.

📒 Files selected for processing (3)
  • crates/stdlib/src/ssl.rs
  • crates/stdlib/src/ssl/cert.rs
  • crates/vm/src/stdlib/_thread.rs

Assisted-by: OpenAI Codex:GPT-5
@youknowone
youknowone merged commit 24bd3b3 into RustPython:main Aug 12, 2026
27 checks passed
@youknowone
youknowone deleted the RustPython-7 branch August 12, 2026 08:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant