[PATCH] Be more careful when detect cert-expiry exceptions.

[Ralph Bean]

We ran into this in the Fedora koji instance today after an upgrade last night.
The inline comments explain the reasoning
---
 koji/__init__.py | 23 ++++++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/koji/__init__.py b/koji/__init__.py
index e7a66f2..939b05a 100644
--- a/koji/__init__.py
+++ b/koji/__init__.py
@@ -1943,8 +1943,29 @@ class ClientSession(object):
                 except Exception, e:
                     self._close_connection()
                     if isinstance(e, OpenSSL.SSL.Error):
+                        # pyOpenSSL doesn't use different exception
+                        # subclasses, we have to actually parse the args
                         for arg in e.args:
-                            for _, _, ssl_reason in arg:
+                            # First, check to see if 'arg' is iterable because
+                            # it can be anything..
+                            try:
+                                iter(arg)
+                            except TypeError:
+                                continue
+
+                            # We do all this so that we can detect cert expiry
+                            # so we can avoid retrying those over and over.
+                            for items in arg:
+                                try:
+                                    iter(items)
+                                except TypeError:
+                                    continue
+
+                                if len(items) != 3:
+                                    continue
+
+                                _, _, ssl_reason = items
+
                                 if ('certificate revoked' in ssl_reason or
                                         'certificate expired' in ssl_reason):
                                     # There's no point in retrying for this

[Ralph Bean]

Noting here that this patch is somewhat urgent as it fixes otherwise
totally broken kojid instances.

[Kevin Fenzi]

On Mon, 17 Aug 2015 12:53:34 -0400
Ralph Bean  wrote:
> Noting here that this patch is somewhat urgent as it fixes otherwise
> totally broken kojid instances.

With this patch things are running along fine in Fedora.

Additionally, a user said it fixed untag-build for their client.

They were getting:

$ koji untag-build f23-gnome vala-0.29.3-1.fc23
SysCallError: (-1, 'Unexpected EOF')

and it worked fine with.

kevin

[Mike McLean]

On 08/15/2015 02:35 PM, Ralph Bean wrote:
> We ran into this in the Fedora koji instance today after an upgrade last night.
> The inline comments explain the reasoning

pushed upstream. I've been expecting to make a 1.10.1 release. Are there
any other critical issues with 1.10 that we should also fix?
> koji/__init__.py | 23 ++++++++++++++++++++++-
>  1 file changed, 22 insertions(+), 1 deletion(-)
>
> diff --git a/koji/__init__.py b/koji/__init__.py
> index e7a66f2..939b05a 100644
> --- a/koji/__init__.py
> +++ b/koji/__init__.py
> @@ -1943,8 +1943,29 @@ class ClientSession(object):
>                  except Exception, e:
>                      self._close_connection()
>                      if isinstance(e, OpenSSL.SSL.Error):
>                    # pyOpenSSL doesn't use different exception
>                    # subclasses, we have to actually parse the args
>                    for arg in e.args:
>                        for _, _, ssl_reason in arg:
>                        # First, check to see if 'arg' is iterable because
>                        # it can be anything..
>                        try:
>                            iter(arg)
>                        except TypeError:
>                            continue
>                        # We do all this so that we can detect cert expiry
>                        # so we can avoid retrying those over and over.
>                        for items in arg:
>                            try:
>                                iter(items)
>                            except TypeError:
>                                continue
>                            if len(items) != 3:
>                                continue
>                            _, _, ssl_reason = items
>                            if ('certificate revoked' in ssl_reason or
>                                    'certificate expired' in ssl_reason):
>                                # There's no point in retrying for this