[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[miss-islington]

miss-islington  added the comment:


New changeset fc8ffe27b6f29d67b76fb2ef57466c95af5a9f82 by Miss Islington (bot) 
in branch '3.9':
bpo-31122: ssl.wrap_socket() now raises ssl.SSLEOFError rather than OSError 
when peer closes connection during TLS negotiation (GH-18772)
https://github.com/python/cpython/commit/fc8ffe27b6f29d67b76fb2ef57466c95af5a9f82


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[miss-islington]

miss-islington  added the comment:


New changeset 243458115e2cb295fb5bbb61e6ac528c6b2cf5be by Miss Islington (bot) 
in branch '3.8':
bpo-31122: ssl.wrap_socket() now raises ssl.SSLEOFError rather than OSError 
when peer closes connection during TLS negotiation (GH-18772)
https://github.com/python/cpython/commit/243458115e2cb295fb5bbb61e6ac528c6b2cf5be


--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Gregory P. Smith  added the comment:

While this is present in 3.7 (and earlier?), 3.7 is EOL - security fix only 
stage.  the 3.8 and 3.9 PRs should automerge after CI finishes.

please reopen the issue or ping me on those PRs if they somehow fail to do so.

--
resolution:  -> fixed
stage: patch review -> resolved
status: open -> closed

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[miss-islington]

miss-islington  added the comment:


New changeset 495bd035662fda29639f9d52bb6baebea31d72fa by Dima Tisnek in branch 
'master':
bpo-31122: ssl.wrap_socket() now raises ssl.SSLEOFError rather than OSError 
when peer closes connection during TLS negotiation (GH-18772)
https://github.com/python/cpython/commit/495bd035662fda29639f9d52bb6baebea31d72fa


--
nosy: +miss-islington

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Gregory P. Smith  added the comment:

Thanks!

fyi for confirmation incase anyone doubted:

>>> issubclass(ssl.SSLEOFError, OSError)
True

So from a code point of view, anything already catching the error still catches 
the error.  100% bugfix.

--
assignee: christian.heimes -> gregory.p.smith

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[miss-islington]

Change by miss-islington :


--
pull_requests: +21007
pull_request: https://github.com/python/cpython/pull/21888

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[miss-islington]

Change by miss-islington :


--
pull_requests: +21008
pull_request: https://github.com/python/cpython/pull/21889

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Safihre]

Safihre  added the comment:

Would anyone be able to review this? People keep reporting this bug in my 
project.
Months are just passing while the PR is just a few lines of code:
https://github.com/python/cpython/pull/18772/files

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Joshua Bronson]

Change by Joshua Bronson :


--
nosy: +jab

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Rémi Lapeyre]

Change by Rémi Lapeyre :


--
nosy: +remi.lapeyre

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

I know Christian is very busy, so what can I do to have this patch reviewed?
* it's concise
* there's a reproducer

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

If someone can review https://github.com/python/cpython/pull/18772 then 
pretty-please review 

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

https://github.com/python/cpython/pull/18772 posted

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Change by Dima Tisnek :


--
keywords: +patch
pull_requests: +18130
stage: needs patch -> patch review
pull_request: https://github.com/python/cpython/pull/18772

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

I've traced it down to here: 
https://github.com/python/cpython/blob/be501ca2419a91546dea85ef4f36945545458589/Modules/_ssl.c#L791-L798

`err.c` (errno) == 0, no error, and `err.ssl` == 5, SSL_ERROR_SYSCALL, 
helpfully commented "look at error stack/return value/errno" in openssl/ssl.h 

I'm a bit suspicious about `s->errorhandler()` which is some old convention 
(git blame: 8 years ago), commented "checks errno, returns NULL, set a Python 
exception", but at this point, we know that errno is 0, so why call it?

I'm thinking to just change that to SSLEOFError, but I wonder if something else 
might break?

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

Rejoice: https://github.com/dimaqq/bpo-31122
Short, easy to reproduce :)
(I've tested on Mac: 3.7, 3.8, 3.9a from python.org, linked against OpenSSL 
1.1.1c/d)
Funnily enough, Python 2.7 raises an ssl.SSLEOFError instead 路‍♂️

--
versions: +Python 3.9

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Dima Tisnek  added the comment:

I volunteer to test the theory that the connection is closed mid-flight.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Shevis Johnson]

Change by Shevis Johnson :


--
nosy: +shevis

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Dima Tisnek]

Change by Dima Tisnek :


--
nosy: +Dima.Tisnek

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Safihre]

Safihre  added the comment:

In the CherryPy project it is also observed on Windows with Python 3,7.2.
In CherryPy it's triggered by Checker plugin, which connects to the app 
listening to the socket port in TLS mode via plain HTTP during startup (from 
the same process).
It has been around for a while: 
https://github.com/cherrypy/cherrypy/issues/1618#issuecomment-454150794

--
nosy: +Safihre

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Change by Gregory P. Smith :


--
stage:  -> needs patch

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Change by Gregory P. Smith :


--
versions:  -Python 3.5, Python 3.6

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Change by Gregory P. Smith :


--
versions: +Python 3.6, Python 3.7, Python 3.8

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Gregory P. Smith]

Gregory P. Smith  added the comment:

This flakiness just caused a PR merge to be blocked by AppVeyor for me:

==
ERROR: test_with_statement (test.test_nntplib.NetworkedNNTP_SSLTests)
--
Traceback (most recent call last):
  File "C:\projects\cpython\lib\test\test_nntplib.py", line 242, in wrapped
meth(self)
  File "C:\projects\cpython\lib\test\test_nntplib.py", line 264, in 
test_with_statement
with self.NNTP_CLASS(self.NNTP_HOST, timeout=TIMEOUT, usenetrc=False) as 
server:
  File "C:\projects\cpython\lib\nntplib.py", line 1077, in __init__
self.sock = _encrypt_on(self.sock, ssl_context, host)
  File "C:\projects\cpython\lib\nntplib.py", line 292, in _encrypt_on
return context.wrap_socket(sock, server_hostname=hostname)
  File "C:\projects\cpython\lib\ssl.py", line 405, in wrap_socket
return self.sslsocket_class._create(
  File "C:\projects\cpython\lib\ssl.py", line 853, in _create
self.do_handshake()
  File "C:\projects\cpython\lib\ssl.py", line 1117, in do_handshake
self._sslobj.do_handshake()
OSError: [Errno 0] Error
--

https://ci.appveyor.com/project/python/cpython/builds/21299396

I lucked out by kicking it with a no-op change to re-trigger an appveyor run 
where it passed.

--
nosy: +gregory.p.smith

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Ben Darnell]

Ben Darnell  added the comment:

We have an easy reproduction of this "[Errno 0] Error" on the server side in 
https://github.com/tornadoweb/tornado/issues/2504#issuecomment-426782158

It is triggered by a connection from `nc -z` (which I think is doing a TCP 
handshake and shutting down the connection cleanly, but I'm not sure. It might 
just send an RST instead of the clean shutdown). On macos, I get SSL_ERROR_EOF 
(as expected), but on linux it raises an OSError with errno 0. (Note that the 
script as posted has a small mistake in that it is using a client-side 
SSLContext on the server side. The same error is seen when that mistake is 
fixed) 

I'm going to add "errno 0" to the list of errors that Tornado should swallow 
silently here, so if you're trying to reproduce this in the future use Tornado 
5.1.1.

--
nosy: +Ben.Darnell

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Xavier G. Domingo]

Change by Xavier G. Domingo :


--
nosy: +xgdomingo

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Nikolaus Rath]

Nikolaus Rath added the comment:

Regarding "atrocious connection": I wish I knew, but I have no control of the 
connection. All I can tell is that there are frequent disconnects, occasional 
latency spikes, my remote ip address seems to change frequently (while the 
apparent local one stays as-is, so presumably some NAT in between), temporary 
bandwidth drops, etc.

--

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Martin Panter]

Martin Panter added the comment:

It might help if you explained what “atrocities” are happening on your network. 
Is there a proxy or man-in-the-middle (or the remote peer) that shuts down TCP 
connections?

If so, perhaps this is similar to Issue 10808. From my memory, in that case an 
OS “recv” or “read” call returns zero to indicate a connection was shut down. 
Python and/or Open SSL correctly treats this as an error, but then assumes 
“errno” is valid. Perhaps Python should be raising SSLEOFError in this 
situation.

Maybe also check the “suppress_ragged_eofs” setting, but I think that only 
affects later stages, after the handshake succeeds.

--
nosy: +martin.panter

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com

[issue31122] SSLContext.wrap_socket() throws OSError with errno == 0

[Nikolaus Rath]

New submission from Nikolaus Rath:

With a particularly atrocious network connection, I often get the following 
exception:

  File "/usr/lib/python3/dist-packages/dugong/__init__.py", line 503, in connect
self._sock = self.ssl_context.wrap_socket(self._sock, 
server_hostname=server_hostname)
  File "/usr/lib/python3.5/ssl.py", line 385, in wrap_socket
_context=self)
  File "/usr/lib/python3.5/ssl.py", line 760, in __init__
self.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 996, in do_handshake
self._sslobj.do_handshake()
  File "/usr/lib/python3.5/ssl.py", line 641, in do_handshake
self._sslobj.do_handshake()
OSError: [Errno 0] Error

I don't think an error with errno == 0 should ever be raised by Python.

--
assignee: christian.heimes
components: SSL
messages: 299759
nosy: christian.heimes, nikratio
priority: normal
severity: normal
status: open
title: SSLContext.wrap_socket() throws OSError with errno == 0
type: behavior
versions: Python 3.5

___
Python tracker 

___
___
Python-bugs-list mailing list
Unsubscribe: 
https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com