SSLWantWriteError being raised by blocking SSL socket

[njsmith]

BPO	32219
Nosy	@pitrou, @tiran, @alex, @njsmith, @dstufft, @altendky

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = 'https://github.com/tiran'
closed_at = None
created_at = <Date 2017-12-05.04:01:07.917>
labels = ['3.7', 'expert-SSL', 'type-bug', 'library']
title = 'SSLWantWriteError being raised by blocking SSL socket'
updated_at = <Date 2021-06-11.13:48:18.143>
user = 'https://github.com/njsmith'

bugs.python.org fields:

activity = <Date 2021-06-11.13:48:18.143>
actor = 'altendky'
assignee = 'christian.heimes'
closed = False
closed_date = None
closer = None
components = ['Library (Lib)', 'SSL']
creation = <Date 2017-12-05.04:01:07.917>
creator = 'njs'
dependencies = []
files = []
hgrepos = []
issue_num = 32219
keywords = []
message_count = 6.0
messages = ['307634', '307636', '307648', '307655', '391304', '391307']
nosy_count = 7.0
nosy_names = ['janssen', 'pitrou', 'christian.heimes', 'alex', 'njs', 'dstufft', 'altendky']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'open'
superseder = None
type = 'behavior'
url = 'https://bugs.python.org/issue32219'
versions = ['Python 3.6', 'Python 3.7']

[njsmith]

I have a test case that sets up a blocking SSLSocket, and eventually calls unwrap() to do a proper SSL shutdown.

Every once in a while, the test blows up, because unwrap() unexpectedly raises SSLWantWriteError. This is very unexpected for a blocking socket.

Unfortunately, since this is intermittent, I don't have a reliable reproducer.

Both of the times I've seen this so far, it was on MacOS with CPython 3.6 (the official python.org build, so whichever openssl it uses), and it was specifically in unwrap():

https://travis-ci.org/python-trio/trio/jobs/298164123
https://travis-ci.org/python-trio/trio/jobs/311618077

Here's the code that fails -- as you can see it's just a straightforward blocking echo server using SSLContext.wrap_socket:

https://github.com/python-trio/trio/blob/3e62bf64946b1dcbf42c2d03e39435d4b1ba00ac/trio/tests/test_ssl.py#L92

[njsmith]

Oh darn, I restarted the 311618077 build on Travis and apparently that makes it delete the log. Well, it was the same traceback as the one that's left, but triggered by a different test.

[pitrou]

You might want to add debugging code in _ssl__SSLSocket_shutdown_impl() (Modules/_ssl.c) and see what happens exactly.

Does your socket have a timeout? If not, you may want to ask the OpenSSL mailing-list whether it's possible for SSL_shutdown to return SSL_ERROR_WANT_WRITE on a blocking socket...

PS: it seems the _ssl module doesn't retry I/O routines on EINTR. See also https://stackoverflow.com/questions/24188013/openssl-and-signals

[njsmith]

There's no timeout. The man page claims SSL_ERROR_WANT_WRITE can't happen on a blocking socket, but who knows...

Re: EINTR, this is all happening in a child thread. On Linux, this would mean that it almost certainly isn't receiving any signals. I'm not sure about MacOS, though. (POSIX allows signals to be delivered to any thread, but most Unixes are much more conservative in practice.)

[tiran]

Nathaniel, is this still an issue with recent OpenSSL and Python versions?

[njsmith]

I don't know :-( After filing this upstream we started ignoring these exceptions, to make our CI less flaky: https://github.com/python-trio/trio/pull/365/files

But unfortunately that means I don't know if we've been hitting them since then or not.