[bug] TCP socket is left open when the TLS handshake is cancelled from outside (AnyIO backend start_tls)

[MrEricKing]

Summary

If the task that is opening an HTTPS connection gets cancelled while the TLS handshake is in progress (for example by asyncio.wait_for, anyio.fail_after, or task.cancel() around client.get(...)), the underlying TCP socket is never closed. If httpx2's own connect timeout ends the handshake instead, the socket is closed correctly.

Where

httpcore2/_backends/anyio.py, AnyIOStream.start_tls:

try:
    with anyio.fail_after(timeout):
        ssl_stream = await anyio.streams.tls.TLSStream.wrap(...)
except Exception as exc:  # pragma: no cover
    await self.aclose()
    raise exc

Cancellation (asyncio.CancelledError, or AnyIO's cancellation exception) is a BaseException, so it skips the except Exception block and aclose() never runs. The caller cannot clean up either: AsyncHTTPConnection._connect keeps the plain TCP stream in a local variable and has no try/finally around start_tls. #983 removes the half-open connection object from the pool after a cancellation, but the socket that start_tls was wrapping stays open.

Reproduction

httpx2 2.13.1, httpcore2 2.13.1, anyio 4.14.2, CPython 3.11.15, asyncio, macOS. The server accepts TCP and never answers the ClientHello.

import asyncio
import ssl

import httpx2


async def attempt(label: str, *, outer: float, connect: float) -> None:
    closed = asyncio.Event()

    async def handle(reader, writer):
        await reader.read()  # swallow the ClientHello, never answer; returns at client EOF
        closed.set()
        writer.close()

    server = await asyncio.start_server(handle, "127.0.0.1", 0)
    port = server.sockets[0].getsockname()[1]
    timeout = httpx2.Timeout(30.0, connect=connect)
    async with httpx2.AsyncClient(timeout=timeout, verify=ssl.create_default_context()) as client:
        try:
            await asyncio.wait_for(client.get(f"https://127.0.0.1:{port}/"), outer)
        except (TimeoutError, asyncio.TimeoutError):
            outcome = "cancelled by outer deadline"
        except httpx2.ConnectTimeout:
            outcome = "httpx2 ConnectTimeout"
        try:
            await asyncio.wait_for(closed.wait(), 2.0)
            state = "closed"
        except (TimeoutError, asyncio.TimeoutError):
            state = "STILL OPEN 2s later"
    print(f"{label}: {outcome}; client socket {state}")
    server.close()


async def main() -> None:
    await attempt("outer cancellation", outer=0.5, connect=10.0)
    await attempt("httpx2 connect timeout", outer=10.0, connect=0.5)


asyncio.run(main())

Output (the same on repeated runs):

outer cancellation: cancelled by outer deadline; client socket STILL OPEN 2s later
httpx2 connect timeout: httpx2 ConnectTimeout; client socket closed

Suggested fix

Close the stream on any exit from the handshake, shielded so that the close itself is not cancelled:

except BaseException:
    with anyio.CancelScope(shield=True):
        await self.aclose()
    raise

With start_tls patched this way, the reproduction prints client socket closed for both cases. I did not check the Trio backend or the sync backend, and I have not run your test suite against this change.

Related, but none of them covers this case: #983 (pool cleanup after cancellation during connect), #1243 (cancellation during HTTP/1.1 response cleanup), #1010 and #1226 (proxy tunnel when TLS fails with an exception). #1170's new asyncio backend also closes the transport only on timeout, OSError and ssl.SSLError in start_tls, so cancellation would still skip the cleanup there.

Workaround

We set the connect timeout shorter than our outer deadline, so httpx2's own timeout always ends a stuck handshake before the outer cancellation does.