[ssl] Reading from non-blocking socket wrapped by SSLContext returns an empty bytes object in case if the client stays connected

Bug report

Bug description:

I run my client-server application using SSLContext. And during communication I faced with situation when I receive an empty bytes object from the socket on server side. But in Wireshark dump I can see that client is present and sends data. If I add some delay after I receive empty bytes and try read from socket again I get some data. My code properly works on python 3.8 but it fails on 3.12. Also I tested without ssl on 3.12 and it works fine.

# how the socket initiated:
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.load_cert_chain(*ssl_context)
self.socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
self.socket.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
self.socket.bind((host, port))
self.socket.listen(1)
self.socket = context.wrap_socket(self.socket, server_side=True)


# how I accept client:
while not True:
    self.socket.settimeout(1)
    try:
        self.connection, _ = self.socket.accept()
        self.connection.settimeout(0.01)
        break
    except (socket.timeout, ssl.SSLError):
        continue


# how I read the data:
def read_data(self):
    data = b''
    if self.connection is not None:
        try:
            print(f"start recv at: {datetime.now().isoformat()}")
            if data := self.connection.recv(256):
                print(f"finish recv at: {datetime.now().isoformat()}")
                return data
            else:
                print(f"no data at: {datetime.now().isoformat()}")
                self.connection = None
                return b''
        except (socket.timeout, OSError):
            return data
    return data

CPython versions tested on:

3.12

Operating systems tested on:

Linux

Le payload ne nomme aucun fichier ni test du dépôt. Commencez par reproduire la séquence fournie de SSLContext et socket sous Linux avec Python 3.8 et 3.12, puis suivez le chemin de lecture du socket enveloppé dans SSL. Le travail est terminé lorsque les données en attente d’un client connecté ne sont pas signalées comme une lecture vide dans le scénario concerné.