Re-raise PyOpenSSL SysCallErrors as respective errno-mapped standard Python ConnectionError subclasses
#786
+156
−7
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
julianz-
force-pushed
the
pyopenssl-error-translation
branch
from
d147658 to
9618049
Compare
julianz-
force-pushed
the
pyopenssl-error-translation
branch
from
9618049 to
350bac4
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #786 +/- ##
==========================================
+ Coverage 79.30% 79.32% +0.02%
==========================================
Files 29 30 +1
Lines 4203 4237 +34
Branches 539 539
==========================================
+ Hits 3333 3361 +28
- Misses 728 730 +2
- Partials 142 146 +4 |
webknjaz
reviewed
Oct 31, 2025
webknjaz
reviewed
Oct 31, 2025
There was a problem hiding this comment.
webknjaz
reviewed
Oct 31, 2025
julianz-
force-pushed
the
pyopenssl-error-translation
branch
3 times, most recently
from
e2f0a3b to
b594cd5
Compare
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
julianz-
force-pushed
the
pyopenssl-error-translation
branch
3 times, most recently
from
cbc0181 to
4444f9d
Compare
webknjaz
reviewed
Nov 1, 2025
cheroot/ssl/pyopenssl.py
Outdated
Comment on lines
273
to
275
| # translate any SysCallError to ConnectionError | ||
| with _morph_syscall_to_connection_error(method): | ||
| return getattr(self._ssl_conn, method)(*new_args) |
There was a problem hiding this comment.
I guess this is one way of solving that.. we could do so for now. Although, I'd be good to get rid of SSLConnectionProxyMeta in some future iteration/PR. I've always found this metaclass patching confusing and wanted to simplify it if possible.
There was a problem hiding this comment.
I tried refactoring to remove the metaclass and I think it works but will add as a new PR.
webknjaz
reviewed
Nov 1, 2025
webknjaz
reviewed
Nov 1, 2025
webknjaz
reviewed
Nov 1, 2025
webknjaz
reviewed
Nov 1, 2025
webknjaz
changed the title
SysCallErrors as respective errno-mapped standard Python ConnectionError subclasses
julianz-
force-pushed
the
pyopenssl-error-translation
branch
from
4444f9d to
8dc9dc5
Compare
julianz-
force-pushed
the
pyopenssl-error-translation
branch
5 times, most recently
from
f691222 to
b1308b5
Compare
|
|
||
| # Create SSLConnection object. The patched SSL.Connection() call returns | ||
| # a mock that is stored internally as conn._ssl_conn. | ||
| conn = SSLConnection(mock_ssl_context) |
Check failure
Code scanning / CodeQL
Non-callable called Error test
julianz-
force-pushed
the
pyopenssl-error-translation
branch
2 times, most recently
from
1dabdf8 to
b768b11
Compare
julianz-
force-pushed
the
pyopenssl-error-translation
branch
2 times, most recently
from
bf8e9e0 to
e9a31db
Compare
PyOpenSSL raises SysCallError which cheroot does not translate, leading to unhandled exceptions when the underlying connection is closed or shut down abruptly. This commit ensures all relevant errno codes are translated into standard Python ConnectionError types for reliable handling by consumers.
julianz-
force-pushed
the
pyopenssl-error-translation
branch
2 times, most recently
from
85afc8e to
a26fd31
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds a more robust error-handling mechanism to the
PyOpenSSLSSLConnectionwrapper to better manage exceptions raised during connection shutdown and close operations.The
pyopenssl.pymodule now includes the context manager,_morph_syscall_to_connection_error, to wrap error-prone methods. This context manager intercepts low-levelOpenSSL.SSL.SysCallErrorexceptions and translates them into standard Python exception types (e.g.,ConnectionAbortedError,BrokenPipeError,ConnectionRefusedError, etc.) based on the underlyingerrnocode.Why this is useful: Currently, when a connection fails due to a system event (like a remote peer abruptly closing the socket), the resulting
SysCallErrorcan be difficult to catch and handle cleanly in application code.This change ensures that applications using Cheroot can reliably catch a standard
ConnectionErroror one of its subclasses, improving the robustness and usability of the SSL connection handling.This change is