From b2eab68fd72dfb5bd46b93eb6346cf330ad6977a Mon Sep 17 00:00:00 2001
From: Andrew Svetlov <andrew.svetlov@gmail.com>
Date: Wed, 28 Oct 2026 20:37:02 +0100
Subject: [PATCH] gh-158646: Fix race in
 test_shutdown_corrupted_ssl_sends_close_notify

The server called unwrap() right after corrupting the client's TLS
stream, which sent its own close_notify to a client that was about to
close its socket.  That turned the client's close into a TCP reset, and
on Windows a reset discards the client's close_notify that is still
unread, so the server failed with WinError 10054 (or 10053).

Wait for the client's close_notify with recv() before calling unwrap().
A ragged EOF without close_notify still makes unwrap() raise SSLError,
so the test keeps catching the gh-98078 regression.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 Lib/test/test_asyncio/test_sslproto.py                 | 10 +++++++++-
 .../2026-10-28-20-40-00.gh-issue-158646.k2Xw7q.rst     |  3 +++
 2 files changed, 12 insertions(+), 1 deletion(-)
 create mode 100644 Misc/NEWS.d/next/Tests/2026-10-28-20-40-00.gh-issue-158646.k2Xw7q.rst

diff --git a/Lib/test/test_asyncio/test_sslproto.py b/Lib/test/test_asyncio/test_sslproto.py
index 464d55cf80ca031..08f680893ad7926 100644
--- a/Lib/test/test_asyncio/test_sslproto.py
+++ b/Lib/test/test_asyncio/test_sslproto.py
@@ -1099,7 +1099,15 @@ def server(sock):
                 orig_sock.send(b'please corrupt the SSL connection')
                 # the client now closes the connection; although its
                 # TLS shutdown fails on the corrupted record, it must
-                # still send close_notify, completing our unwrap()
+                # still send close_notify, on which recv() returns b''.
+                # Wait for it before sending ours: unwrap() right away
+                # would send close_notify to a peer that is about to
+                # close its socket, which turns that close into a TCP
+                # reset, and on Windows a reset discards the client's
+                # close_notify that is still unread (gh-158646).
+                sock.recv(1)
+                # recv() also returns b'' on a ragged EOF, i.e. without
+                # close_notify, but then unwrap() fails with an SSLError.
                 sock.unwrap()
             except ssl.SSLError as exc:
                 server_err = exc
diff --git a/Misc/NEWS.d/next/Tests/2026-10-28-20-40-00.gh-issue-158646.k2Xw7q.rst b/Misc/NEWS.d/next/Tests/2026-10-28-20-40-00.gh-issue-158646.k2Xw7q.rst
new file mode 100644
index 000000000000000..93a7c26c6321405
--- /dev/null
+++ b/Misc/NEWS.d/next/Tests/2026-10-28-20-40-00.gh-issue-158646.k2Xw7q.rst
@@ -0,0 +1,3 @@
+Fix a race in ``test_asyncio.test_sslproto`` where the server side of
+``test_shutdown_corrupted_ssl_sends_close_notify`` could fail with a
+connection reset on Windows.