parent
f6bb05f57d
commit
e4df500e21
@ -1,49 +0,0 @@
|
|||||||
From 9103bda257e235b26bdbeb9198299cbc13a0d515 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Ralph Bean <rbean@redhat.com>
|
|
||||||
Date: Sat, 15 Aug 2015 14:35:03 -0400
|
|
||||||
Subject: [PATCH] Be more careful when detect cert-expiry exceptions.
|
|
||||||
|
|
||||||
We ran into this in the Fedora koji instance today after an upgrade last night.
|
|
||||||
The inline comments explain the reasoning
|
|
||||||
---
|
|
||||||
koji/__init__.py | 23 ++++++++++++++++++++++-
|
|
||||||
1 file changed, 22 insertions(+), 1 deletion(-)
|
|
||||||
|
|
||||||
diff --git a/koji/__init__.py b/koji/__init__.py
|
|
||||||
index 81064c3..f45ff70 100644
|
|
||||||
--- a/koji/__init__.py
|
|
||||||
+++ b/koji/__init__.py
|
|
||||||
@@ -1943,8 +1943,29 @@ class ClientSession(object):
|
|
||||||
except Exception, e:
|
|
||||||
self._close_connection()
|
|
||||||
if isinstance(e, OpenSSL.SSL.Error):
|
|
||||||
+ # pyOpenSSL doesn't use different exception
|
|
||||||
+ # subclasses, we have to actually parse the args
|
|
||||||
for arg in e.args:
|
|
||||||
- for _, _, ssl_reason in arg:
|
|
||||||
+ # First, check to see if 'arg' is iterable because
|
|
||||||
+ # it can be anything..
|
|
||||||
+ try:
|
|
||||||
+ iter(arg)
|
|
||||||
+ except TypeError:
|
|
||||||
+ continue
|
|
||||||
+
|
|
||||||
+ # We do all this so that we can detect cert expiry
|
|
||||||
+ # so we can avoid retrying those over and over.
|
|
||||||
+ for items in arg:
|
|
||||||
+ try:
|
|
||||||
+ iter(items)
|
|
||||||
+ except TypeError:
|
|
||||||
+ continue
|
|
||||||
+
|
|
||||||
+ if len(items) != 3:
|
|
||||||
+ continue
|
|
||||||
+
|
|
||||||
+ _, _, ssl_reason = items
|
|
||||||
+
|
|
||||||
if ('certificate revoked' in ssl_reason or
|
|
||||||
'certificate expired' in ssl_reason):
|
|
||||||
# There's no point in retrying for this
|
|
||||||
--
|
|
||||||
2.5.0
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
|||||||
From ab0b2e465d0f8ad930f28eb3a49850afb57250c2 Mon Sep 17 00:00:00 2001
|
|
||||||
From: Mathieu Bridon <bochecha@daitauha.fr>
|
|
||||||
Date: Thu, 23 Jul 2015 10:19:23 +0200
|
|
||||||
Subject: [PATCH] Better catch SSL errors
|
|
||||||
|
|
||||||
Commit 4de27c52de80596d256b059a67d10c7ed5e61238 made Koji to not retry
|
|
||||||
on SSL errors.
|
|
||||||
|
|
||||||
However, it turns out that some SSL errors are transient, and Koji
|
|
||||||
should still retry for them.
|
|
||||||
|
|
||||||
This commit changes that, so that we are more specific about which SSL
|
|
||||||
errors should be fatal: expired or revoked certificates.
|
|
||||||
|
|
||||||
https://bugzilla.redhat.com/show_bug.cgi?id=1207178
|
|
||||||
---
|
|
||||||
koji/__init__.py | 10 +++++++---
|
|
||||||
1 file changed, 7 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/koji/__init__.py b/koji/__init__.py
|
|
||||||
index fadbada..e7a66f2 100644
|
|
||||||
--- a/koji/__init__.py
|
|
||||||
+++ b/koji/__init__.py
|
|
||||||
@@ -1940,11 +1940,15 @@ class ClientSession(object):
|
|
||||||
except (SystemExit, KeyboardInterrupt):
|
|
||||||
#(depending on the python version, these may or may not be subclasses of Exception)
|
|
||||||
raise
|
|
||||||
- except OpenSSL.SSL.Error as e:
|
|
||||||
- # There's no point in retrying this
|
|
||||||
- raise
|
|
||||||
except Exception, e:
|
|
||||||
self._close_connection()
|
|
||||||
+ if isinstance(e, OpenSSL.SSL.Error):
|
|
||||||
+ for arg in e.args:
|
|
||||||
+ for _, _, ssl_reason in arg:
|
|
||||||
+ if ('certificate revoked' in ssl_reason or
|
|
||||||
+ 'certificate expired' in ssl_reason):
|
|
||||||
+ # There's no point in retrying for this
|
|
||||||
+ raise
|
|
||||||
if not self.logged_in:
|
|
||||||
#in the past, non-logged-in sessions did not retry. For compatibility purposes
|
|
||||||
#this behavior is governed by the anon_retry opt.
|
|
||||||
--
|
|
||||||
2.5.0
|
|
||||||
|
|
Loading…
Reference in new issue