Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.maint.python > #13163 > unrolled thread

Downgrading dnspython back to 1.16.0 to fix Eventlet

Back to article view | Back to linux.debian.maint.python

Contents

  Downgrading dnspython back to 1.16.0 to fix Eventlet Thomas Goirand <zigo@debian.org> - 2021-02-02 19:50 +0100
    Re: Downgrading dnspython back to 1.16.0 to fix Eventlet Thomas Goirand <zigo@debian.org> - 2021-02-04 10:50 +0100
      Re: Downgrading dnspython back to 1.16.0 to fix Eventlet Scott Kitterman <debian@kitterman.com> - 2021-02-06 00:10 +0100

#13163 — Downgrading dnspython back to 1.16.0 to fix Eventlet

Hi Scott, Robert,

As you may know, Eventlet is at the hart of OpenStack. Unfortunately,
version 0.26.1 currently in Sid/Testing fails when connecting over SSL,
with a traceback that looks like this:

  File "/usr/lib/python3/dist-packages/urllib3/connection.py", line 392,
in connect
    self.ssl_context = create_urllib3_context(
  File "/usr/lib/python3/dist-packages/urllib3/util/ssl_.py", line 303,
in create_urllib3_context
    context.options |= options
  File "/usr/lib/python3.9/ssl.py", line 602, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  File "/usr/lib/python3.9/ssl.py", line 602, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  File "/usr/lib/python3.9/ssl.py", line 602, in options
    super(SSLContext, SSLContext).options.__set__(self, value)
  [Previous line repeated 458 more times]
RecursionError: maximum recursion depth exceeded (txn:
txad38d097c88545ecbd274-0060127626)

In OpenStack, this happens whenever a service attempts to validate a
Keystone token, meaning whenever any component connects to the OpenStack
API (in most deployments: this is done over SSL). In other words: all of
OpenStack is currently completely broken because of this.

Both Eventlet and DNSPython are monkey patching the standard SSL library
in potentially conflicting ways (for those who don't know: this means
they override the standard Python SSL objects/functions to re-write /
overload them).

This incompatibility is well known upstream. Some has been addressed in
Eventlet, but not all. Currently, Eventlet has:

'dnspython >= 1.15.0, < 2.0.0'

as dependency in upstream setup.py.

So I am currently wondering if we could revert DNSPython in Sid/Testing
to 1.16.0 until this is fixed upstream. That is, unless someone here in
this list knows how to fix Eventlet, but this looks like non-trivial...

Note that Ubuntu has version 2.0.0+really1.16.0-2ubuntu2, as they
understood the above.

Scott, Robert, your thoughts? Do you think it's ok to downgrade
dnspython? Or will it break some other reverse-dependencies? Is there
another way to fix the current situation?

Cheers,

Thomas Goirand (zigo)

P.S: The current reverse-dependency tree is:

Reverse-Recommends
==================
* 2ping
* calibre
* dnstwist

Reverse-Depends
===============
* ansible
* b4
* dehydrated-hook-ddns-tsig
* designate-tempest-plugin
* dhcpy6d
* dkimpy-milter
* dnsdiag
* dnsrecon
* dnsviz
* fierce
* knockpy
* linkchecker [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x]
* mailman3
* patator
* python3-aioxmpp
* python3-authheaders
* python3-certbot-dns-rfc2136
* python3-designate
* python3-dkim
* python3-dnsq
* python3-electrum
* python3-email-validator
* python3-etcd
* python3-eventlet
* python3-exchangelib
* python3-formencode
* python3-kdcproxy
* python3-ldapdomaindump
* python3-sleekxmpp
* python3-spf
* recon-ng
* samba [amd64 arm64 armel armhf i386 mips64el mipsel ppc64el s390x]

[toc] | [next] | [standalone]

#13167

On 2/2/21 7:46 PM, Thomas Goirand wrote:
> Both Eventlet and DNSPython are monkey patching the standard SSL library
> in potentially conflicting ways
After checking, that's *NOT* the case. Though Eventlet is doing
monkey-patching of dnspython, in a possible not-compatible with 2.x.

Anyways, looks like this small patch fixes Eventlet with dnspython 2:

https://github.com/tipabu/eventlet/commit/2f9b7969f9a66a75e72908454246b88bf57fe58a

I've uploaded Debian release 0.26.1-5, and when it reaches the mirrors,
I'll try again to make OpenStack work, and see how it goes. If it fixes
everything, then we're good to go. Otherwise, my questioning about
downgrading dnspython to 1.16.0 still stand. I'll let you know.

Cheers,

Thomas Goirand (zigo)

P.S: Thanks to Tim Burke for this patch

[toc] | [prev] | [next] | [standalone]

#13171

[Multipart message — attachments visible in raw view] — view raw

On Thursday, February 4, 2021 4:49:21 AM EST Thomas Goirand wrote:
> On 2/2/21 7:46 PM, Thomas Goirand wrote:
> > Both Eventlet and DNSPython are monkey patching the standard SSL library
> > in potentially conflicting ways
> 
> After checking, that's *NOT* the case. Though Eventlet is doing
> monkey-patching of dnspython, in a possible not-compatible with 2.x.
> 
> Anyways, looks like this small patch fixes Eventlet with dnspython 2:
> 
> https://github.com/tipabu/eventlet/commit/2f9b7969f9a66a75e72908454246b88bf5
> 7fe58a
> 
> I've uploaded Debian release 0.26.1-5, and when it reaches the mirrors,
> I'll try again to make OpenStack work, and see how it goes. If it fixes
> everything, then we're good to go. Otherwise, my questioning about
> downgrading dnspython to 1.16.0 still stand. I'll let you know.
> 
> Cheers,
> 
> Thomas Goirand (zigo)
> 
> P.S: Thanks to Tim Burke for this patch

If Eventlet is monkey patching DNSPython and it doesn't work, I think that's 
totally Eventlet's problem.  Hopefully your patch works.  I do not think 
downgrading DNSPython for this is a good idea.

Scott K

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.maint.python

csiph-web