Skip to content

ssl: raise IOError when reading from or writing to closed SSLSocket - #1106

Open
rhenium wants to merge 3 commits into
ruby:masterfrom
rhenium:ky/ssl-closed-stream
Open

ssl: raise IOError when reading from or writing to closed SSLSocket#1106
rhenium wants to merge 3 commits into
ruby:masterfrom
rhenium:ky/ssl-closed-stream

Conversation

@rhenium

@rhenium rhenium commented Sep 2, 2026

Copy link
Copy Markdown
Member

Core IO and socket classes raise IOError when a read or write is attempted on a closed stream. Make SSLSocket follow this behavior and use consistent error messages.

Currently, reading from or writing to to a closed SSLSocket may raise OpenSSL::SSL::SSLError, a SystemCallError, or IOError, depending on the internal state of the OpenSSL library and the underlying socket.

This changes SSLSocket#closed? to report the internally tracked state of the SSLSocket rather than the underlying socket. As a result, it may return false if the underlying socket is unexpectedly closed directly with IO#close.

Applies on top of #1105
Resolves #798

Let the extension only provide the most basic non-blocking form,
SSLSocket#ssl_connect, #ssl_accept, #ssl_read, #ssl_write.

Implement SSLSocket#connect, #accept, #sysread, and #syswrite in
lib/openssl/ssl.rb on top of these primitives and #wait_{read,writ}able.

Also, handle the keyword arguments for the public #*_nonblock methods
in Ruby to simplify and to avoid the Hash allocation.

This prepares for the upcoming changes to SSLSocket to add proper
timeout support and socket closed state tracking. These would be easier
to do in Ruby.

No user-visible behavior change is intended with this patch.
Core IO and socket classes raise IOError when a read or write is
attempted on a closed stream. Make SSLSocket follow this behavior and
use consistent error messages.

Currently, reading from or writing to to a closed SSLSocket may raise
OpenSSL::SSL::SSLError, a SystemCallError, or IOError, depending on the
internal state of the OpenSSL library and the underlying socket.

This changes SSLSocket#closed? to report the internally tracked state
of the SSLSocket rather than the underlying socket. As a result, it
may return false if the underlying socket is unexpectedly closed
directly with IO#close.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Consistenty - IOError vs EBADF?

1 participant