Report unexpected EOF as SSL_ERROR_SSL for OpenSSL 3.x parity

[prasden]

Context and motivation

Before OpenSSL 3.0, an unexpected transport EOF during SSL_read (the peer closing the connection without sending a close_notify alert) surfaced as SSL_ERROR_SYSCALL with an empty error stack and errno == 0.

OpenSSL 3.0 changed the default as this behavior now raises SSL_ERROR_SSL with SSL_R_UNEXPECTED_EOF_WHILE_READING on the stack. AWS-LC should match OSSL 3.x's behavior on this case to provide parity for consumers.

Description of changes

When the peer closes without close_notify, SSL_read now returns -1 and SSL_get_error reports SSL_ERROR_SSL with SSL_R_UNEXPECTED_EOF_WHILE_READING on the stack, matching OpenSSL 3.x.

Adds the SSL_R_UNEXPECTED_EOF_WHILE_READING reason code with the code 509, different from OpenSSL's 294, because 294 already belongs to SSL_R_UNKNOWN_CERT_COMPRESSION_ALG in AWS-LC. Consumers match on the macro name.

Call-outs

• Previously passing tests that relied on the old behavior have been updated by setting SSL_OP_IGNORE_UNEXPECTED_EOF: Support SSL_OP_IGNORE_UNEXPECTED_EOF option #3294

• rust-openssl integration test skips one test as it connects to a live server that closes without a close_notify, and the upstream test doesn't set SSL_OP_IGNORE_UNEXPECTED_EOF

• OpenSSL 3.x parity is limited to post-handshake reads because this change preserves the !SSL_in_init(ssl) guard

Testing

• Added SSLTest.UnexpectedEOF to test an unexpected EOF fails the read and matches ossl's behavior.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 97.22222% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 78.18%. Comparing base (973b592) to head (6da23b6).

Files with missing lines	Patch %	Lines
tool/transport_common.cc	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3484      +/-   ##
==========================================
- Coverage   78.37%   78.18%   -0.20%     
==========================================
  Files         700      700              
  Lines      125744   125770      +26     
  Branches    17388    17386       -2     
==========================================
- Hits        98553    98327     -226     
- Misses      26318    26573     +255     
+ Partials      873      870       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[justsmth]

Also:

• include/openssl/ssl.h:642 -- stale doc comment. The default is now SSL_ERROR_SSL, not SSL_ERROR_SYSCALL:

// ... When set, |SSL_read| reports
// |SSL_ERROR_ZERO_RETURN| instead of the default |SSL_ERROR_SSL| /
// |SSL_R_UNEXPECTED_EOF_WHILE_READING|.

• ssl/ssl_misc_test.cc:342 and :384 -- stale comments in the pre-existing IgnoreUnexpectedEOF test. Both still contrast the option against SSL_ERROR_SYSCALL; since the default changed, update them to reference the new default SSL_ERROR_SSL.

[justsmth]

Additional point from the second pass:

• include/openssl/ssl.h:440 -- SSL_ERROR_ZERO_RETURN documentation. This can also result from SSL_OP_IGNORE_UNEXPECTED_EOF, where no close_notify was received. This predates the PR, so I view it as optional cleanup.

[github-actions]

🔒 Security Review — View Report

Please review before merging.