module service_identity has no attribute SICertificateError

XMLWordPrintableJSON

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Unknown
    • 4.13.2
    • Affects Version/s: None
    • Component/s: None
    • None
    • None
    • Python Drivers
    • Not Needed
    • None
    • None
    • None
    • None
    • None
    • None

      There is a bug in our pyopenssl code which leads to certification verification errors being obfuscated by a "module service_identity has no attribute SICertificateError" attribute error.

      Reported here: https://github.com/mongodb/mongo-python-driver/pull/2382

      When there is a mistake in the certificates configuration, PyMongo would give the following error:

      pymongo.errors.ServerSelectionTimeoutError: module service_identity has no attribute SICertificateError, Timeout: 30s, Topology Description: <…>
      Because the except block expected non-existing errors, the error gets transformed to "module … has no attribute …". The errors in the service_identity have never had the SI prefix:
      https://github.com/pyca/service-identity/blob/18.1.0/src/service_identity/exceptions.py
      It looks like the errors were imported with an alias before, but this aliasing was (only partially) removed when rewriting to lazy imports in this commit:
      42a08c4#diff-b277a2f4cfbb5decab333d0b90a08a4ad64b91fb1691ed8412b15949d1aaceee
      The lazy imports were removed again in this commit, but the error remained:
      49987e6#diff-b277a2f4cfbb5decab333d0b90a08a4ad64b91fb1691ed8412b15949d1aaceee
      After changing the expected errors manually in my virtual environment, the error I received earlier turned into this, so I could continue debugging my certificates configuration:

      pymongo.errors.ServerSelectionTimeoutError: […]: ("VerificationError(errors=[IPAddressMismatch(…)])",) (configured timeouts: socketTimeoutMS: 20000.0ms, connectTimeoutMS: 20000.0ms), Timeout: 30s, Topology Description: <…>
      Most likely, the # type: ignore[misc] comment can now also be removed (but I have not set up this repository for development on my machine, so I'll let the automated checks be the judge of that).

            Assignee:
            Shane Harvey
            Reporter:
            Shane Harvey
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: