Map WANT_WRITE from SSLSocket.recv_into() to SSLWantWriteError (F-3907)

recv_into() shares read()'s error-mapping pattern and inherited the
same omission: wolfSSL_read returning WOLFSSL_ERROR_WANT_WRITE (during
a renegotiation needing a write) was reported as a generic SSLError
instead of SSLWantWriteError, breaking non-blocking callers that
distinguish readiness directions. Add the WANT_WRITE branch.

tests/test_io_error_mapping.py

@@ -102,3 +102,18 @@ def test_read_want_read_still_raises_wantread(monkeypatch):
     sock = _make_socket()
     with pytest.raises(wolfssl.SSLWantReadError):
         sock.read(16)
+
+
+def test_recv_into_want_write_raises_wantwrite(monkeypatch):
+    """F-3907: wolfSSL_read in recv_into returning WANT_WRITE."""
+    _patch_lib(monkeypatch, -1, wolfssl._SSL_ERROR_WANT_WRITE)
+    sock = _make_socket()
+    with pytest.raises(wolfssl.SSLWantWriteError):
+        sock.recv_into(bytearray(16))
+
+
+def test_recv_into_want_read_still_raises_wantread(monkeypatch):
+    _patch_lib(monkeypatch, -1, wolfssl._SSL_ERROR_WANT_READ)
+    sock = _make_socket()
+    with pytest.raises(wolfssl.SSLWantReadError):
+        sock.recv_into(bytearray(16))

wolfssl/__init__.py

@@ -702,6 +702,9 @@ class SSLSocket(object):
             err = _lib.wolfSSL_get_error(self.native_object, 0)
             if err == _SSL_ERROR_WANT_READ:
                 raise SSLWantReadError()
+            elif err == _SSL_ERROR_WANT_WRITE:
+                # wolfSSL_read can require a write first (e.g. renegotiation).
+                raise SSLWantWriteError()
             else:
                 raise SSLError("wolfSSL_read error (%d)" % err)