Fix Drop to prevent TLS data loss#6825

youknowone

Remove pending_tls_output.clear() from Drop implementation.

SSLSocket._real_close() in Python doesn't call shutdown() before closing - it just sets _sslobj = None. This means pending TLS data in the output buffer may not have been flushed to the socket yet. Clearing this buffer in Drop causes data loss, resulting in empty HTTP responses (test_socketserver failure on Windows).

The explicit clearing is also unnecessary since all struct fields are automatically freed when the struct is dropped.

Summary by CodeRabbit

Refactor
- Improved SSL socket cleanup behavior to mitigate potential data loss risks during resource cleanup.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Remove pending_tls_output.clear() from Drop implementation. SSLSocket._real_close() in Python doesn't call shutdown() before closing - it just sets _sslobj = None. This means pending TLS data in the output buffer may not have been flushed to the socket yet. Clearing this buffer in Drop causes data loss, resulting in empty HTTP responses (test_socketserver failure on Windows). The explicit clearing is also unnecessary since all struct fields are automatically freed when the struct is dropped.

coderabbitai

📝 Walkthrough

Walkthrough

Modified the PySSLSocket Drop implementation to remove explicit field clearing for pending_tls_output, write_buffered_len, and shutdown_state. Now only clears the connection explicitly while relying on automatic memory cleanup for other fields. Added explanatory comments about the rationale.

Changes

Cohort / File(s)	Summary
PySSLSocket Drop Cleanup Refactoring `crates/stdlib/src/ssl.rs`	Simplified Drop implementation by removing explicit clearing of pending_tls_output, write_buffered_len, and shutdown_state. Now only explicitly clears self.connection via lock().take(). Added inline comments explaining why pending_tls_output should not be cleared and noting that other fields are automatically freed on drop.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Possibly related PRs

Drop for PySSLSocket #6791: Directly modifies the same Drop implementation for PySSLSocket in ssl.rs, specifically changing which connection/cleanup fields are cleared during drop.

Poem

🐰 A drop of wisdom, clean and bright,
We let the memory take its flight,
No need to clear what fades away,
The Rust will handle it, hooray! 🌿

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: preventing TLS data loss by modifying the Drop implementation to not clear pending TLS output.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

📝 Generate docstrings

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

youknowone marked this pull request as ready for review January 21, 2026 08:16

youknowone deleted the ssl-drop branch January 21, 2026 08:29

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix Drop to prevent TLS data loss#6825