SSLSocket documentation mentions shutdown as analogue to socket.shutdown. However, instead of forbidding communication, it removes SSL wrapper from socket. For example, the following script doesn't work and returns garbage:

    import socket
    import ssl

    s = socket.socket()
    s.connect(('google.com', 443))
    client = ssl.wrap_socket(s)
    client.sendall(b'GET / HTTP/1.0\nConnection: close\n\n')
    client.shutdown(socket.SHUT_WR)

    print(repr(client.recv(40)))

Attached patch makes shutdown raise exception if how != SHUT_RDWR, as closing one side of socket over SSL doesn't make sense (unless I'm missing something).

Christian,

What do you think about this issue ?

1. Fix for 3.5 and 3.6
2. Maybe for 2.7 ?

Sounds fine, but it's not a security issue. I'm re-targeting the bug for 3.7.

Sounds like a good idea.

This will needlessly break code which until now accepts both kinds of sockets.

By the way, socket.shutdown() doesn't specify that *only* one direction is shut down when using SHUT_RD or SHUT_WR; what is guaranteed is that *at least* the given direction will shut down.  But there may be socket types where unidirectional shutdown is not supported and both directions will be shut down.  This is (approximately) what SSLSocket does -- though the SSL unwrapping part is a bit unintuitive as well.

I agree with Antoine. I tried to test your patch and found out that is not compatible with socketserver. The socketserver module shuts down the connection with SHUT_WR.

We could either ignore the problem or ignore the how and use SHUT_RDWR in all cases.