Expose OpenSSL's error queue

Feature or enhancement

Proposal:

On $BIG_CORP's weird OpenSSL that's in a FIPS 140-3 environment, attempting to
connect to a Website with (it's deliberate we're using sockets rather than
something like requests or urllib):

#!/usr/bin/env python3
"""Test TLS 1.2 connection to a site using only stdlib."""

import pprint
import ssl
import socket

def main():
    hostname = "www.example.com"

    # Create SSL context with TLS 1.2 maximum
    context = ssl.create_default_context()
    context.maximum_version = ssl.TLSVersion.TLSv1_2

    try:
        with socket.create_connection((hostname, 443)) as sock:
            with context.wrap_socket(sock, server_hostname=hostname) as ssock:
                print(f"Connected to {hostname}")
                print(f"TLS version: {ssock.version()}")
                print(f"Cipher: {ssock.cipher()}")

                # Send a simple HTTP request
                request = f"GET / HTTP/1.1\r\nHost: {hostname}\r\nConnection: close\r\n\r\n".encode('ascii')
                ssock.sendall(request)

                response = ssock.recv(4096)
                status_line = response.split(b'\r\n')[0].decode('utf-8', errors='replace')
                print(f"\nResponse status: {status_line}")
    except ssl.SSLError as e:
        raise

if __name__ == "__main__":
    main()

blows up very strangely:

$ python3.13 test_tls1.2.py
Traceback (most recent call last):
  File "/opt/bigcorp/test_tls1.2.py", line 30, in <module>
    main()
  File "/opt/bigcorp/test_tls1.2.py", line 16, in main
    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
  File "/opt/bigcorp/lib/python3.9/ssl.py", line 506, in wrap_socket
    return self.sslsocket_class._create(
  File "/opt/bigcorp/lib/python3.9/ssl.py", line 1084, in _create
    self.do_handshake()
  File "/opt/bigcorp/lib/python3.9/ssl.py", line 1353, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLError: [SSL] internal error (_ssl.c:1162)

This is very hard to debug. OpenSSL has an error queue internally that can be
accessed via ERR_error_string
and friends, but Python doesn't expose anything but the top-most message
of the queue, and there's not an easy way to access the rest of it otherwise.
NOTE: the hard way: pull out a debugger, get into OpenSSL, pull
out it's error code, and than map the numbers from the bits to messages. Not
recommended.

We should make the OpenSSL error queue available.

Has this already been discussed elsewhere?

No response given

Links to previous discussion of this feature:

May indirectly fix https://github.com/python/cpython/issues/148594

Linked PRs

• gh-150103

Bắt đầu với các đường đi wrap_socket và do_handshake của ssl.py, sau đó kiểm tra _ssl.c quanh vị trí lỗi được báo cáo và API ERR_error_string của OpenSSL. Xem xét PR được liên kết gh-150103 và xác định việc hoàn thành là làm cho toàn bộ hàng đợi lỗi OpenSSL khả dụng cho Python thay vì chỉ thông báo SSLError cấp cao nhất.