urllib3: Need to update error handling for pyOpenSSL

If an SSLError comes from pyOpenSSL, we attempt to determine if it’s an error due to request timeouts on python 2.6 being raised as BaseSSLErrors here. If the handshake ends unexpectedly under pyOpenSSL, then we get an SSLError that has a captured SysCallError which when you call str(SSLError(msg, SysCallError(code, msg))) you get

TypeError: __str__ returned non-string (type SysCallError)

So we might want to update how we handle SSLErrors to accomodate pyOpenSSL. To be clear, I observed this on: python 2.7.9 with openssl 1.0.1l (from brew) and I was using requests to debug an issue with https://apissl.cloudfactory.com, e.g., requests.get('https://apissl.cloudfactory.com')

About this issue

Original URL
State: closed
Created 9 years ago
Reactions: 1
Comments: 29 (17 by maintainers)

Commits related to this issue

Upgraded requests to git-master and forced urllib3 to git-master. Fixes strange errors with pyOpenSSL. See https://github.com/shazow/urllib3/issues/556. — committed to rembo10/headphones by basilfx 9 years ago
urllib3 workaround, see https://github.com/shazow/urllib3/issues/556 — committed to Beanow/wikiteam by Beanow 9 years ago
Patch: TypeError: __str__ returned non-string (type Error) (https://github.com/shazow/urllib3/issues/556) — committed to orbweb/requests by allanlei 8 years ago

Most upvoted comments

I had to fix this on a production server by editing requests/packages/urllib3/connectionpool.py. At line 315, before if 'timed out' in str(err) or 'did not complete (read)' in str(err): I inserted:

if not isinstance(err, str) and hasattr(err, 'strerror'):
        raise ProtocolError(self, url, "{}".format(err.strerror))

At least I get some inkling on what’s going on - in my case this bubbles up to my application from requests as:

requests.exceptions.ConnectionError: (<requests.packages.urllib3.connectionpool.HTTPSConnectionPool object at 0x7f3999ba18d0>, ‘/’, “[(‘SSL routines’, ‘SSL3_GET_SERVER_CERTIFICATE’, ‘certificate verify failed’)]”)

lorenzog on Jun 26, 2015

Yea that whole process is voodoo. 😕

Open to basically any kind of change. What do you have in mind?

shazow on Feb 28, 2015