[ssl] Reading from non-blocking socket wrapped by SSLContext returns an empty bytes object in case if the client stays connected

Bug report

Bug description:

I run my client-server application using SSLContext. And during communication I faced with situation when I receive an empty bytes object from the socket on server side. But in Wireshark dump I can see that client is present and sends data. If I add some delay after I receive empty bytes and try read from socket again I get some data. My code properly works on python 3.8 but it fails on 3.12. Also I tested without ssl on 3.12 and it works fine.

# how the socket initiated:
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain(*ssl_context)
self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.socket.bind((host, port))
self.socket.listen(1)
self.socket = context.wrap_socket(self.socket, server_side=True)


# how I accept client:
while not True:
    self.socket.settimeout(1)
    try:
        self.connection, _ = self.socket.accept()
        self.connection.settimeout(0.01)
        break
    except (socket.timeout, ssl.SSLError):
        continue


# how I read the data:
def read_data(self):
    data = b''
    if self.connection is not None:
        try:
            print(f"start recv at: {datetime.now().isoformat()}")
            if data := self.connection.recv(256):
                print(f"finish recv at: {datetime.now().isoformat()}")
                return data
            else:
                print(f"no data at: {datetime.now().isoformat()}")
                self.connection = None
                return b''
        except (socket.timeout, OSError):
            return data
    return data

CPython versions tested on:

3.12

Operating systems tested on:

Linux

El payload no menciona archivos ni pruebas del repositorio. Empieza reproduciendo la secuencia proporcionada de SSLContext y socket en Linux con Python 3.8 y 3.12, y luego sigue la ruta de lectura del socket envuelto en SSL. Se considera terminado cuando los datos pendientes de un cliente conectado no se reportan como una lectura vacía en el escenario afectado.