Skip to content

tls: close the TLS socket in _TLSAutomaton.destroy() - #5294

Open
glaziermag wants to merge 1 commit into
secdev:masterfrom
glaziermag:fix/tls-destroy-close-socket
Open

glaziermag wants to merge 1 commit into
secdev:masterfrom
glaziermag:fix/tls-destroy-close-socket

Conversation

@glaziermag

Copy link
Copy Markdown
Contributor

Description

Since #5248 added a test where the client aborts, the TLS 1.3 tests of tlsclientserver.uts fail on master with (False, "...ResourceWarning: unclosed <socket.socket ... laddr=('127.0.0.1', 4433), raddr=...>") (15 of the 21 completed Scapy unit tests runs on master since then), e.g. https://github.com/secdev/scapy/actions/runs/43394327187/job/131781532428 and https://github.com/secdev/scapy/actions/runs/43394327187/job/131781532621. On that path test_tls_client() calls atmtsrv.stop(wait=False) (tlsclientserver.uts#L335-L349), the server can stop before close_session runs, and Automaton.destroy() (automaton.py#L1615-L1634) does not close the socket accepted at automaton_srv.py#L299, so its ResourceWarning is written to the stderr captured by a later test.

This closes the socket in _TLSAutomaton.destroy() and checks it in test_tls_client(). Delaying the server's reads makes the race deterministic; without the change to automaton.py, tests 19 and 29 then fail on the new check:

python -m scapy.tools.UTscapy -t test/scapy/layers/tls/tlsclientserver.uts -K server -N -n 0,10,19,29 -P 'import time; from scapy.layers.tls.automaton_srv import TLSServerAutomaton as S; g = S.get_next_msg; S.get_next_msg = lambda s, *a, **k: time.sleep(0.3) or g(s, *a, **k)'

This message was written with the help of AI (Claude Opus 5.5).

🤖 Generated with Claude Code

Automaton.destroy() does not close the TCP socket of a TLS automaton.
When test_tls_client() stops the server after a client failure (the
invalid ServerKeyExchange signature test from secdev#5248), the server can
stop before close_session runs; the accepted socket is then garbage
collected during a later test, and its ResourceWarning in the captured
stderr fails that test.

AI-Assisted: yes (Claude Opus 5.5)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@codecov

codecov Bot commented Nov 13, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.66%. Comparing base (0e2f6ba) to head (22ffee2).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5294      +/-   ##
==========================================
+ Coverage   80.06%   80.66%   +0.60%     
==========================================
  Files         375      375              
  Lines       98775    98779       +4     
==========================================
+ Hits        79083    79680     +597     
+ Misses      19692    19099     -593     
Files with missing lines Coverage Δ
scapy/layers/tls/automaton.py 86.61% <100.00%> (+0.38%) ⬆️

... and 30 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant