I've ported asyncio's sslproto.py to uvloop and released a new major version of it yesterday.  Hynek discovered that the default SSL handshake timeout (10 seconds currently) is too low, and that there's a critical code path that is broken because it assumes all SSL exceptions have an 'errno' attribute.

The PR changes the default SSL handshake timeout to 60 seconds (as in nginx [1]) and fixes the AttributeError.

IMO this should go into 3.7.0rc1.


[1] https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-tcp/#speeding-up-secure-tcp-connections

For the reference, we added SSL handshake timeout a while ago in bpo-29970.

For some context: 10s seems to be more common than I liked to believe (seems like Go's http client uses it by default too).

Nevertheless I ran into the 10s after updating uvloop and stopped being able to connect to a server in India. Therefore I'd consider 10s at least a regression that should be fixed.

What was the effective timeout before? Depending on the old value, 60s could be excessive for clients and might lead to self-DoS on the client side…

P.S. I tried to reply on my phone and now I fully support Mariatta’s proposal of moving to GitHub issues.

> What was the effective timeout before? Depending on the old value, 60s could be excessive for clients and might lead to self-DoS on the client side…

Previous timeout was effectively infinite.

> Previous timeout was effectively infinite.

Oi, well then 60s are an improvement indeed. :)

New changeset 9602643120a509858d0bee4215d7f150e6125468 by Yury Selivanov in branch 'master':
bpo-33734: asyncio/ssl: a bunch of bugfixes (#7321)
https://github.com/python/cpython/commit/9602643120a509858d0bee4215d7f150e6125468

New changeset 87936d03cb29ca039c5799190e8da764e62b7882 by Yury Selivanov (Miss Islington (bot)) in branch '3.7':
bpo-33734: asyncio/ssl: a bunch of bugfixes (GH-7321) (GH-7396)
https://github.com/python/cpython/commit/87936d03cb29ca039c5799190e8da764e62b7882

Fixes are in master and 3.7 now, so this should be fixed in 3.7.0rc1.  

Ned, I'm not sure what's the workflow here, please feel free to close this issue and change its priority.

Thanks for the fix!  Since it apparently does not apply to 3.6, we should just close it like any other issue, right?  So doing!

> Since it apparently does not apply to 3.6, we should just close it like any other issue, right?  So doing!

Sure.  My understanding is that all changes including this one in 3.7 branch will end up in 3.7.0rc1, right?

> My understanding is that all changes including this one in 3.7 branch will end up in 3.7.0rc1, right?

Yes.  Don't worry, the train won't leave without it.