From 14c530e7dc3f37a9d81f1d98bd9957852d1e55fd Mon Sep 17 00:00:00 2001
From: Russell Keith-Magee <russell@keith-magee.com>
Date: Tue, 14 Apr 2026 11:12:37 +0800
Subject: [PATCH] gh-148508: Add resilience to SSL preauth tests on iOS
 (GH-148536)

Adds handling for a test case seen in the iOS SSL tests where an SSL connection fails to
handshake correctly.
(cherry picked from commit c40e8b016a90820e4d799922903b90a505ffaf55)

Co-authored-by: Russell Keith-Magee <russell@keith-magee.com>
---
 Lib/test/test_ssl.py                            | 17 +++++++++++------
 ...26-04-14-09-04-35.gh-issue-148508.-GiXml.rst |  2 ++
 2 files changed, 13 insertions(+), 6 deletions(-)
 create mode 100644 Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index b0c6eca2091a74..10615365a27e54 100644
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -5294,15 +5294,20 @@ def non_linux_skip_if_other_okay_error(self, err):
             return  # Expect the full test setup to always work on Linux.
         if (isinstance(err, ConnectionResetError) or
             (isinstance(err, OSError) and err.errno == errno.EINVAL) or
-            re.search('wrong.version.number', str(getattr(err, "reason", "")), re.I)):
+            re.search('wrong.version.number', str(getattr(err, "reason", "")), re.I) or
+            re.search('record.layer.failure', str(getattr(err, "reason", "")), re.I)
+        ):
             # On Windows the TCP RST leads to a ConnectionResetError
             # (ECONNRESET) which Linux doesn't appear to surface to userspace.
             # If wrap_socket() winds up on the "if connected:" path and doing
-            # the actual wrapping... we get an SSLError from OpenSSL. Typically
-            # WRONG_VERSION_NUMBER. While appropriate, neither is the scenario
-            # we're specifically trying to test. The way this test is written
-            # is known to work on Linux. We'll skip it anywhere else that it
-            # does not present as doing so.
+            # the actual wrapping... we get an SSLError from OpenSSL. This is
+            # typically WRONG_VERSION_NUMBER. The same happens on iOS, but
+            # RECORD_LAYER_FAILURE is the error.
+            #
+            # While appropriate, neither is the scenario we're specifically
+            # trying to test. The way this test is written is known to work on
+            # Linux. We'll skip it anywhere else that it does not present as
+            # doing so.
             try:
                 self.skipTest(f"Could not recreate conditions on {sys.platform}:"
                               f" {err=}")
diff --git a/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst b/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst
new file mode 100644
index 00000000000000..7995dec397f7b7
--- /dev/null
+++ b/Misc/NEWS.d/next/Library/2026-04-14-09-04-35.gh-issue-148508.-GiXml.rst
@@ -0,0 +1,2 @@
+An intermittent timing error when running SSL tests on iOS has been
+resolved.