Bug 1988429

Sent upstream at https://patchwork.ozlabs.org/project/openvswitch/patch/057c448a2071837817697a74aab3746b921b001f.1631284442.git.tredaelli@redhat.com/

* Wed Nov 10 2021 Timothy Redaelli <tredaelli> - 2.16.0-30
- python: Replace pyOpenSSL with ssl. [RH git: 0cd5867531] (#1988429)
    Currently, pyOpenSSL is half-deprecated upstream and so it's removed on
    some distributions (for example on CentOS Stream 9,
    https://issues.redhat.com/browse/CS-336), but since OVS only
    supports Python 3 it's possible to replace pyOpenSSL with "import ssl"
    included in base Python 3.
    
    Stream recv and send had to be splitted as _recv and _send, since SSLError
    is a subclass of socket.error and so it was not possible to except for
    SSLWantReadError and SSLWantWriteError in recv and send of SSLStream.
    
    TCPstream._open cannot be used in SSLStream, since Python ssl module
    requires the SSL socket to be created before connecting it, so
    SSLStream._open needs to create the socket, create SSL socket and then
    connect the SSL socket.
    
    Reported-by: Timothy Redaelli <tredaelli>
    Reported-at: https://bugzilla.redhat.com/1988429
    Signed-off-by: Timothy Redaelli <tredaelli>
    Acked-by: Terry Wilson <twilson>
    Tested-by: Terry Wilson <twilson>
    Signed-off-by: Ilya Maximets <i.maximets>
    Signed-off-by: Timothy Redaelli <tredaelli>


* Wed Nov 10 2021 Timothy Redaelli <tredaelli> - 2.16.0-29
- python: socket-util: Split inet_open_active function and use connect_ex. [RH git: 2e704b371c]
    In an upcoming patch, PyOpenSSL will be replaced with Python ssl module,
    but in order to do an async connection with Python ssl module the ssl
    socket must be created when the socket is created, but before the
    socket is connected.
    
    So, inet_open_active function is splitted in 3 parts:
    - inet_create_socket_active: creates the socket and returns the family and
      the socket, or (error, None) if some error needs to be returned.
    - inet_connect_active: connect the socket and returns the errno (it
      returns 0 if errno is EINPROGRESS or EWOULDBLOCK).
    
    connect is replaced by connect_ex, since Python suggest to use it for
    asynchronous connects and it's also cleaner since inet_connect_active
    returns errno that connect_ex already returns, moreover due to a Python
    limitation connect cannot not be used with ssl module.
    
    inet_open_active function is changed in order to use the new functions
    inet_create_socket_active and inet_connect_active.
    
    Signed-off-by: Timothy Redaelli <tredaelli>
    Acked-by: Terry Wilson <twilson>
    Tested-by: Terry Wilson <twilson>
    Signed-off-by: Ilya Maximets <i.maximets>
    Signed-off-by: Timothy Redaelli <tredaelli>

Hi Tim,
Please let me know how to test this.
Using this command: rpm -qpR http://download-node-02.eng.bos.redhat.com/brewroot/packages/openvswitch2.16/2.16.0/32.el8fdp/x86_64/openvswitch2.16-2.16.0-32.el8fdp.x86_64.rpm
What to look for ?
Thanks!
Jean

Hi, you should install python3-openvswitch2.16 and do:
fgrep -i 'import ssl' /usr/lib64/python*/site-packages/ovs/{poller,stream}.py

and you should read "import ssl" instead of "from OpenSSL import SSL"

The openvswitch package passed the test per Comment 7:

[root@netqe20 ~]# fgrep -i 'import ssl' /usr/lib64/python*/site-packages/ovs/{poller,stream}.py
/usr/lib64/python3.6/site-packages/ovs/poller.py:    import ssl
/usr/lib64/python3.6/site-packages/ovs/stream.py:    import ssl
[root@netqe20 ~]# rpm -qa | grep openvswitch
openvswitch2.16-2.16.0-32.el8fdp.x86_64
python3-openvswitch2.16-2.16.0-32.el8fdp.x86_64
kernel-kernel-networking-openvswitch-common-2.0-186.noarch
openvswitch-selinux-extra-policy-1.0-28.el8fdp.noarch
[root@netqe20 ~]# uname -r
4.18.0-305.25.1.el8_4.x86_64
[root@netqe20 ~]#

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (openvswitch2.16 bug fix update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2022:0053