Deal with BrokenPipeError since openssl 3.4.x. #2103
Conversation
|
I am unable to reproduce this on Python 3.13.3 with OpenSSL 3.5.0 on either macOS or Linux (the manylinux 2014 image, in which I manually upgraded OpenSSL). Which specific test is failing, and how is it failing? (i.e., what's the rest of the log?) That aside, it's not clear to me that the approach in this PR is correct. EPIPE/BrokenPipeError means the remote connection has dropped unexpectedly; this is a layer below the SSL framing layer. Typically, you want this exception to propagate so the user of the socket knows there's been a problem; the standard library didn't add any code to hide this error when it occurs. |
|
Hi, it fails in python311 but not for newer python versions. Here is a good build and the attached file contains the build failure with OpenSSL 3.5.0. Thanks for you answer, I also think this should be handled only in the regression test and not in src/gevent/ssl.py to correctly propagate the exception. I'll change the PR as soon as possible. |
|
The logs you provided don't show an error in gevent's I can indeed reproduce that failure using Python 3.11.12 and OpenSSL 3.5.0. (And I can't produce a failure in However, I reproduce that failure whether or not I use gevent. That is, This indicates it is not a problem in gevent. Instead, it is a problem using Python 3.11.12 (which is only tested with OpenSSL 3.0) with OpenSSL 3.5. |
|
The relevant CPython change appears to be this one, which appears to only have been backported to 3.12, not 3.11 or older, probably because those versions are either in security-fix-only mode or unsupported altogether. |
|
I think gevent is running a copy of the test_ssl.py from cpython but its missing this recent commit: gh-126500: test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler;. This cpython PR was ported to 3.12 and 3.13 but not for 3.11. I have verified that adding those changes fixes it for 3.12 and 3.13 as well with the latest version. Note that, it was failing for us with 3.11 as we ported some of the fixes in 3.12 to work with OpenSSL 3.5.0. I think you would need to update the test_ssl to sync with cpython, I can change this PR to add those changes. Please, let me know your view on this. TIA |
test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler
4dd56d8 to
7ea6fa7
Compare
|
We don't make changes to the standard library tests. We don't backport changes the coredevs don't. |
https://build.opensuse.org/request/show/1272752 by user mcepl + anag_factory - Update to 25.4.2: [bsc#1241067, bsc#1241037] * Make gevent's queue classes subscriptable to match the standard library. See issue #2102. * Make the c-ares resolver build on Windows. * The gevent testsuite runs a copy of the test_ssl from cpython but the follwoing change has not been ported yet: - gh-126500: test_ssl: Don't stop ThreadedEchoServer on OSError in ConnectionHandler [gh#python/cpython/pull/126503] - Rebase gevent-openssl35-test-fix.patch - Upstream PR: [gh#gevent/gevent/pull/2103] - Update to 25.4.1 * Remove some legacy code that supported Python 2 for compatibility with the upcoming releases of Cython 3.1. * Add a new environment variable and configuration setting to control whether blocking reports are printed by the monitor threa
Couldn’t you just USE the standard library tests? I don’t know what happens when you build from the Python upstream tarball, but most distributions I know about have some package like (on openSUSE) called python311-testsuite which includes installed |
Follows from the changes in gh-127257 and the test adaption in gh-115627.
gh-127257: ssl: Raise OSError for ERR_LIB_SYS
gh-115627: Fix ssl test_pha_required_nocert()
We are building openSUSE Factory with OpenSSL 3.5 and we can see that gevent fails the test__server.py with BrokenPipeError, here is the error output:
Please, let me know if you need more info. TIA