gh-99813: Start using SSL_sendfile when available

[illia-v]

• Issue: Use SSL_sendfile() from OpenSSL 3.0 in SSLSocket.sendfile when available. #99813

New _ssl__SSLSocket_sendfile_impl function is very similar to _ssl__SSLSocket_write_impl with a few adjustments for the SSL_sendfile syscall.

I am glad there was non-SSL socket.socket.sendfile and underlying socket.socket._sendfile_use_sendfile implemented. I reused that code for new ssl.SSLSocket._sendfile_use_ssl_sendfile by moving shared logic to socket.socket._sendfile_zerocopy.

And test.test_ssl.ThreadedTests.test_sendfile needed to have a socket bound before an SSL context wrapped it because this seemed to affect kTLS availability.

[illia-v]

@gpshead could you please review this when you have a chance?

[illia-v]

I've recently pushed some changes after testing the new functionality manually by sending small and large files from Linux with the tls module loaded, it worked well

[gpshead]

I won't have time to look at this in detail for a while. I'm just dropping a note about one issue seen while quickly skimming it.

[illia-v]

I'd appreciate it if this can make it in 3.13

[picnixz]

Some comments. The if-else if blocks need to follow PEP-7 but you can also use a switch if you want (it can be clearer to read).

[picnixz]

few final comments

[picnixz]

Can you check whether it "seems" to work or not? (for a personal project I would accept this but I'm interested in knowing whether this is an issue with Python SSL or OpenSSL)

[illia-v]

Okay, I'll post more details about this soon

[illia-v]

I can reproduce the same issue with C code using OpenSSL (without Python). Please check my findings here. I mentioned a possible patch, let me know if we can apply it or there can be undesirable consequences.

FYI, ssl.OP_ENABLE_KTLS to enable kTLS has been available since Python 3.12 (and it could be added to options as a simple integer even before). And the issue is not specific to SSL_sendfile, it affects kTLS availability for simple reads and writes.

I added my reproducer to an existing OpenSSL issue openssl/openssl#19676 (comment).

[illia-v]

@picnixz OpenSSL provides SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE which will be good to have in Python together with the change. Should I add it in this PR or separately after this one is merged?

[picnixz]

I feel we need explicit functions for common error messages just to always use the same ones (but it's a separate issue)

[picnixz]

Just checking this:

• if the error message already exists, use the same text (namely capitalized text ending with a period)
• if not, try to see if error messages are using periods or not and/or are capitalized and pick the one that is the most common

[illia-v]

The exact error message exists in four other places in the file

[illia-v]

Regarding the message "The sendfile operation timed out" above without the period, it's siblings don't end with a period too:

• "The handshake operation timed out"
• "The write operation timed out"
• "The read operation timed out"