Michael Smith has posted comments on this change. ( http://gerrit.cloudera.org:8080/23519 )
Change subject: IMPALA-14452: Fix impala-shell SSL with Python 3.12 ...................................................................... Patch Set 12: (1 comment) http://gerrit.cloudera.org:8080/#/c/23519/12/shell/impala_shell/TSSLSocketWithFixes.py File shell/impala_shell/TSSLSocketWithFixes.py: http://gerrit.cloudera.org:8080/#/c/23519/12/shell/impala_shell/TSSLSocketWithFixes.py@59 PS12, Line 59: ssl_version = ssl.PROTOCOL_TLS_CLIENT Error message changes when we set this. It enables check_hostname in OpenSSL, which causes TSocket.open() to fail before TSSLSocket calls _validate_callback. Thrift itself swallows the detailed exception from SSL in https://github.com/apache/thrift/blob/v0.22.0/lib/py/src/transport/TSocket.py#L143-L149: ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: IP address mismatch, certificate is not valid for '::1'. (_ssl.c:1131) I don't see a clean way to improve this without updates to Thrift; it would be a lot of overriding in TSSLSocket and TSocket. It's apparently a long-standing issue - https://issues.apache.org/jira/browse/THRIFT-792 - that is made worse with fixes for Python 3.12. I've updated this case to only use PROTOCOL_TLS_CLIENT for Python 3.12+ to avoid regressing the error message in earlier versions. -- To view, visit http://gerrit.cloudera.org:8080/23519 To unsubscribe, visit http://gerrit.cloudera.org:8080/settings Gerrit-Project: Impala-ASF Gerrit-Branch: master Gerrit-MessageType: comment Gerrit-Change-Id: I046a9010ac4cb1f7d705935054b306cddaf8bdc7 Gerrit-Change-Number: 23519 Gerrit-PatchSet: 12 Gerrit-Owner: Michael Smith <[email protected]> Gerrit-Reviewer: Csaba Ringhofer <[email protected]> Gerrit-Reviewer: Impala Public Jenkins <[email protected]> Gerrit-Reviewer: Joe McDonnell <[email protected]> Gerrit-Reviewer: Laszlo Gaal <[email protected]> Gerrit-Reviewer: Michael Smith <[email protected]> Gerrit-Comment-Date: Fri, 17 Oct 2025 21:59:35 +0000 Gerrit-HasComments: Yes
