Fix SSL connection testing in Python 3.7 #1661

seanthegeek · 2018-11-27T19:03:01Z

Closes issue #1549

This change is

Fix SSL connection testing in Python 3.7

kafka/conn.py

jeffwidman · 2018-11-30T10:01:18Z

Thanks for this! A couple of comments... I have no convenient way to test this, so which environment(s) have you tested it in?

kafka/conn.py

Co-Authored-By: seanthegeek <[email protected]>

seanthegeek · 2018-11-30T19:42:56Z

@jeffwidman Python 3.7 on Windows and Python 3.6 on Debian Buster.

mooperd · 2018-12-01T09:26:21Z

+1

jeffwidman

Can you clean up the commit history?

jeffwidman · 2018-12-01T10:51:11Z

kafka/conn.py

+                if sys.version_info >= (3, 7):
+                    ret = None
+                else:
+                    raise err


IIRC, you only need this to be raise and it will re-raise the most recent one

jeffwidman · 2018-12-01T10:51:47Z

build_integration.sh

@@ -54,6 +54,9 @@ pushd servers
          fi
          echo
          echo "Extracting kafka ${kafka} binaries"
+          if [ ! -d ../$kafka ]; then
+            mkdir ../$kafka
+          fi


Like the .gitignore change, this feels like a distinct PR / commit which wouldn't happen if I merge by squashing

jeffwidman · 2018-12-01T10:53:32Z

.gitignore

@@ -15,3 +15,4 @@ docs/_build
 integration-test/
 tests-env/
 .pytest_cache/
+venv/


This makes sense to me to add, but as a separate commit from the SSL fix.

However your commit history is a mess, so normally I'd merge this PR by squashing... but that would conflict with above...

mooperd · 2018-12-01T11:57:28Z

Hi,

With the following code:

from kafka import KafkaAdminClient

adminclient = KafkaAdminClient(
    bootstrap_servers="kafka-317b40d8-andrew-e213.aivencloud.com:18224",
    security_protocol="SSL",
    ssl_cafile="ca.pem",
    ssl_certfile="service.cert",
    ssl_keyfile="service.key",
)

adminclient.create_topics(['meow'], timeout_ms=None, validate_only=False)

I get an error:

Traceback (most recent call last):
  File "ensure-kafka-topic.py", line 10, in <module>
    ssl_keyfile="service.key",
  File "/Users/andrew/dev/aiven/kafka/admin/client.py", line 195, in __init__
    **self.config)
  File "/Users/andrew/dev/aiven/kafka/client_async.py", line 231, in __init__
    self.config['api_version'] = self.check_version(timeout=check_timeout)
  File "/Users/andrew/dev/aiven/kafka/client_async.py", line 857, in check_version
    version = conn.check_version(timeout=remaining, strict=strict, topics=list(self.config['bootstrap_topics_filter']))
  File "/Users/andrew/dev/aiven/kafka/conn.py", line 953, in check_version
    if not self.connect_blocking(timeout_at - time.time()):
  File "/Users/andrew/dev/aiven/kafka/conn.py", line 304, in connect_blocking
    self.connect()
  File "/Users/andrew/dev/aiven/kafka/conn.py", line 402, in connect
    if self._try_handshake():
  File "/Users/andrew/dev/aiven/kafka/conn.py", line 465, in _try_handshake
    self._sock.do_handshake()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 1112, in do_handshake
    self._check_connected()
  File "/Library/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 900, in _check_connected
    self.getpeername()
OSError: [Errno 57] Socket is not connected

Python 3.7.1 on OSX connecting to Aiven Kafka 2.0.1
System Version: macOS 10.13.5 (17F77)

Similarly, on linux:

Traceback (most recent call last):
  File "hit_kafka.py", line 10, in <module>
    ssl_keyfile="service.key",
  File "/hello/kafka/producer/kafka.py", line 372, in __init__
    **self.config)
  File "/hello/kafka/client_async.py", line 231, in __init__
    self.config['api_version'] = self.check_version(timeout=check_timeout)
  File "/hello/kafka/client_async.py", line 857, in check_version
    version = conn.check_version(timeout=remaining, strict=strict, topics=list(self.config['bootstrap_topics_filter']))
  File "/hello/kafka/conn.py", line 953, in check_version
    if not self.connect_blocking(timeout_at - time.time()):
  File "/hello/kafka/conn.py", line 304, in connect_blocking
    self.connect()
  File "/hello/kafka/conn.py", line 402, in connect
    if self._try_handshake():
  File "/hello/kafka/conn.py", line 465, in _try_handshake
    self._sock.do_handshake()
  File "/usr/local/lib/python3.7/ssl.py", line 1112, in do_handshake
    self._check_connected()
  File "/usr/local/lib/python3.7/ssl.py", line 900, in _check_connected
    self.getpeername()
OSError: [Errno 107] Transport endpoint is not connected

Python 3.7.1
Debian Stretch

joagain · 2018-12-04T02:06:40Z

Hi,

I'm getting a similar (but not exactly the same) error as @mooperd 's when calling KafkaConsumer. beginning_offsets:

  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/consumer/group.py", line 986, in beginning_offsets
    partitions, self.config['request_timeout_ms'])
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/consumer/fetcher.py", line 213, in beginning_offsets
    partitions, OffsetResetStrategy.EARLIEST, timeout_ms)
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/consumer/fetcher.py", line 221, in beginning_or_end_offset
    offsets = self._retrieve_offsets(timestamps, timeout_ms)
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/consumer/fetcher.py", line 279, in _retrieve_offsets
    self._client.poll(future=future, timeout_ms=remaining_ms)
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/client_async.py", line 559, in poll
    self._maybe_connect(node_id)
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/client_async.py", line 386, in _maybe_connect
    conn.connect()
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/conn.py", line 402, in connect
    if self._try_handshake():
  File "/Users/myuser/myproject/virtualenv/lib/python3.7/site-packages/kafka/conn.py", line 465, in _try_handshake
    self._sock.do_handshake()
  File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 1112, in do_handshake
    self._check_connected()
  File "/usr/local/Cellar/python/3.7.1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/ssl.py", line 900, in _check_connected
    self.getpeername()
OSError: [Errno 57] Socket is not connected

Update: I was able to fix the issue above by catching the OSError that was thrown. My issue was that the socket wasn't connected the first time the client's poll happened, and the program just crashed. I'm catching the error to give some time to the polling loop.

    def _try_handshake(self):
        assert self.config['security_protocol'] in ('SSL', 'SASL_SSL')
        try:
            self._sock.do_handshake()
            return True
        # old ssl in python2.6 will swallow all SSLErrors here...
        except (SSLWantReadError, SSLWantWriteError, OSError): # FIX HERE
            pass
        except (SSLZeroReturnError, ConnectionError, SSLEOFError):
            log.warning('SSL connection closed by server during handshake.')
            self.close(Errors.KafkaConnectionError('SSL connection closed by server during handshake'))
        # Other SSLErrors will be raised to user

seanthegeek · 2018-12-20T16:54:42Z

Superseded by PR #1669

jeffwidman · 2019-01-03T21:58:03Z

@mooperd / @joagain I just merged #1669.

Please try the latest master and see if that fixes these issues... if not, please open a new issue. @joagain in particular, based on a quick glance I don't think you should need to hack around that error, I think we should be handling at a library level. Although that is only based on a quick glance, so I may be missing something.

danjo133 · 2019-01-07T12:45:00Z

I did: pip install git+https://github.com/dpkp/kafka-python after #1669 was merged and I need to add except OSError as well, otherwise I get the same:
OSError: [Errno 57] Socket is not connected

If I add the OSError catch there, it works for me (OSX, python 3.7.0)

jeffwidman · 2019-01-08T05:11:31Z

@danjo133 can you add this as a separate issue? Or better yet a new PR so that we can discuss the actual code change?

Commenting on old issues just tends to get lost in the noise...

Closes issue dpkp#1549

84846a2

Fix SSL connection testing in Python 3.7

jeffwidman reviewed Nov 30, 2018

View reviewed changes

kafka/conn.py Outdated Show resolved Hide resolved

jeffwidman reviewed Nov 30, 2018

View reviewed changes

kafka/conn.py Outdated Show resolved Hide resolved

Sean Whalen added 4 commits November 30, 2018 10:10

Only ignore ValueError on SSL connection if Python >=3.7

0ded822

Have TravisCI test Python 3.7 and Kafka 2.0.0-2.1.0

699cbf5

Fix build for Kafka 2.1.0

ad8e31e

Remove Kafka 2.0.0+ from tests

4e8fa5c

silentben reviewed Nov 30, 2018

View reviewed changes

kafka/conn.py Outdated Show resolved Hide resolved

silentben and others added 3 commits November 30, 2018 12:48

Update kafka/conn.py

6dca97d

Co-Authored-By: seanthegeek <[email protected]>

Fix Python 3.7 TravisCI build

2f5d358

Remove python 3.7 test

165ac85

jeffwidman reviewed Dec 1, 2018

View reviewed changes

silentben mentioned this pull request Dec 7, 2018

Fix SSL connection testing in Python 3.7 #1669

Merged

seanthegeek closed this Dec 20, 2018

danjo133 mentioned this pull request Jan 8, 2019

Catch thrown OSError by python 3.7 when creating a connection #1694

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix SSL connection testing in Python 3.7 #1661

Fix SSL connection testing in Python 3.7 #1661

seanthegeek commented Nov 27, 2018 •

edited by dpkp

Loading

jeffwidman commented Nov 30, 2018 •

edited

Loading

seanthegeek commented Nov 30, 2018

mooperd commented Dec 1, 2018

jeffwidman left a comment

jeffwidman Dec 1, 2018

jeffwidman Dec 1, 2018 •

edited

Loading

jeffwidman Dec 1, 2018

mooperd commented Dec 1, 2018 •

edited

Loading

joagain commented Dec 4, 2018 •

edited

Loading

seanthegeek commented Dec 20, 2018

jeffwidman commented Jan 3, 2019

danjo133 commented Jan 7, 2019

jeffwidman commented Jan 8, 2019

Fix SSL connection testing in Python 3.7 #1661

Fix SSL connection testing in Python 3.7 #1661

Conversation

seanthegeek commented Nov 27, 2018 • edited by dpkp Loading

jeffwidman commented Nov 30, 2018 • edited Loading

seanthegeek commented Nov 30, 2018

mooperd commented Dec 1, 2018

jeffwidman left a comment

Choose a reason for hiding this comment

jeffwidman Dec 1, 2018

Choose a reason for hiding this comment

jeffwidman Dec 1, 2018 • edited Loading

Choose a reason for hiding this comment

jeffwidman Dec 1, 2018

Choose a reason for hiding this comment

mooperd commented Dec 1, 2018 • edited Loading

joagain commented Dec 4, 2018 • edited Loading

seanthegeek commented Dec 20, 2018

jeffwidman commented Jan 3, 2019

danjo133 commented Jan 7, 2019

jeffwidman commented Jan 8, 2019

seanthegeek commented Nov 27, 2018 •

edited by dpkp

Loading

jeffwidman commented Nov 30, 2018 •

edited

Loading

jeffwidman Dec 1, 2018 •

edited

Loading

mooperd commented Dec 1, 2018 •

edited

Loading

joagain commented Dec 4, 2018 •

edited

Loading