OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_RECORD', 'decryption failed or bad record mac')]

It seems that latest requests (2.2.1) is also affected by bug:
 OpenSSL.SSL.Error: [('SSL routines', 'SSL3_GET_RECORD', 'decryption failed or bad record mac')]

It seems to be an workaround here http://stackoverflow.com/questions/21497591/urllib2-reading-https-url-failure but I don't know how to apply it to requests.


Thanks for this!

Yeah, this isn't really a request bug, as the SO question highlights: it's a Debian or OpenSSL bug.

With that said, a possible workaround would be an extension of the transport adapter demonstrated on my blog, here: https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/


It's a real problem and I do not have the confirmation that the workaround works. What is even more awkward is that my automation script that used to query a server every hour for few hundred requests started to fail suddenly, even without me changing anything on the machine. I guess they may have changed the configuration of the web server.

Still, still problems occurs on latest distro of Ubuntu, with all patches and the last version of OpenSSL is one year old. We need to implement an workaround for this. 

Also, I tried the workaround specified on OpenSSL forums but it doesn't work, I will try your approach and see.


I agree that it's a real problem. I do not necessarily agree that Requests needs a workaround for every bug in any of our dependencies. 

What is not clear to me at this time is how severe this bug is, how widespread it is, and how easy it is to work around. It's also not easy for me to find those things out today: I'm at a conference and won't have time near a laptop. It would be useful if @sigmavirus24 could take a look: otherwise I'll have to dig into it tomorrow. 

The key thing to know is that OpenSSL has had other bugs in the past that we haven't worked around in the core Requests code. Most notably, 0.9.8f (I think) that ships on OS X 10.8 has a similar bug in it that we have never worked around. 

We are not required to fix every bug in all of our dependencies, especially implicit ones. We _may_ fix this one, but I don't know yet. 

Note that another workaround is to use a different version of OpenSSL. Just saying. 


Your workaround didn't work this time, I tried it and same error. And regarding using a new openssl, that's not easy at all openssl is very well tied into the system and I imagine that installing another one will only bring more problems.

If we would have a working-workaround it would be fine, I don't mind applying a patch to this script, but it doesn't work. I tried with ssl_version=ssl.PROTOCOL_TLSv1

... I am trying now to build a minimal test-case.


Oops, it seems that it was a red herring, it's not related to this. Instead it seems to be related to multiprocessing. I was using multiprocessing in order to perform requests on 10 threads, to speedup the process. This worked well for weeks but suddenly stopped working a couple of days ago... with this error.


What does your multiprocessing code look like? If you're sharing `Session` objects across processes, bad stuff will happen. =)


I was not sharing any session, in fact I was calling a function on each thread, passing a parameter and inside this function I has my code which was creating a session, performing 2-3 requests and returning. I know, strange.


That's very odd. Is it easily reproducible?


@ssbarnea can you at least share the URL so that we can attempt to reproduce it? So far I think we have almost sufficient information, we just need the URL or characteristics of the server to reproduce it:
- Multiprocessing using _10 threads_
- Function that instantiates a Session and makes more than one request (ostensibly to the same server) with it.


Started getting this as well running https://github.com/edx/dyno-slayer

Problem started when changing:

``` python
DEFAULT_MIN_TIMING_WINDOW = 60
DEFAULT_MAX_TIMING_WINDOW = 120
```

to:

``` python
DEFAULT_MIN_TIMING_WINDOW = 20
DEFAULT_MAX_TIMING_WINDOW = 30
```


@crizCraig I'm not familiar with that project. What is the significance of those values? Are they:
- Configuration file values?
- Environment values?
- Other?


Sorry, those just define a length of time to sample heroku logs via their API. The entire program is this file:

https://github.com/edx/dyno-slayer/blob/master/scripts/slayer.py


We need substantially better diagnostics than that I'm afraid. =) Can you provide us a traceback, for instance?


I wonder if someone who works @heroku could give us a hand. They might have some insight. @catsby can you give us some info about the SSL configuration on a default Heroku box? Can you point us at someone who can?


@crizCraig Ping. =)


I'm experiencing this issue in Windows 7 with Python 2.7.9 x32

```
SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:581)
```


@zvodd Have you tried forcing SSL negotiation at different versions, as per [this article](https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/)?


Closed for inactivity.


Ran into this issue using multiprocessing. Have not been able to fix it.


@maxcountryman can you provide any of the details we've been asking for?


@sigmavirus24 well, I'm not using Heroku. What other details did you want?


@maxcountryman 
- Your version of python and openssl
- You operatingsystem and version
- A minimal breaking code snippet
- If possible a public URL which triggers the bug (together with the mentioned code snippet)


Hi @Lukasa @sigmavirus24 @t-8ch ,
Is your article (https://lukasa.co.uk/2013/01/Choosing_SSL_Version_In_Requests/) compatible with Python 3? Is it right that the current issue will be solved by updating python to version 2.7.9?


@ulandj The article should be Python 3 compatible. Upgrading to Python 2.7.9 will solve a lot of problems.


@Lukasa i.e. after upgrading to Python 2.7.9 I don't need use your adapter in the article, right? And 

``` python
import requests
conn = requests.Session()
conn.put(url, data=body, headers=headers)
conn.delete(url, data=body, headers=headers)
```

will work with any count of multiprocesses?


If you're encountering this problem with multiprocessing, I've never been given a repro scenario for it, so I don't actually know what's happening. If you can demonstrate the problem with a bit of sample code I'd like to see it.


well, we first upgrade to python 2.7.9 and will try to run with multiprocessing. if this error appears again, I will let you know. Thanks.


@Lukasa our customer says that they have the following error: 

```
Traceback (most recent call last): 
File "/opt/SketchSync/WorkersApp.py", line 230, in run self.producer.release_job(self.worker_id, payload, done) 
File "/opt/SketchSync/SketchSyncProducer.py", line 88, in release_job self.queue.delete_job(payload) 
File "/opt/SketchSync/SketchSyncProducer.py", line 177, in delete_job self.queue.delete(mid) 
File "/usr/local/lib/python2.7/site-packages/iron_mq.py", line 58, in delete result = self.client.delete(url) 
File "/usr/local/lib/python2.7/site-packages/iron_core.py", line 233, in delete retry=retry, body=body) 
File "/usr/local/lib/python2.7/site-packages/iron_core.py", line 152, in request r = self._doRequest(url, method, body, headers) 
File "/usr/local/lib/python2.7/site-packages/iron_core.py", line 117, in _doRequest r = self.conn.delete(url, data=body, headers=headers) 
File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 527, in delete return self.request('DELETE', url, **kwargs) 
File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 456, in request resp = self.send(prep, **send_kwargs) 
File "/usr/local/lib/python2.7/site-packages/requests/sessions.py", line 559, in send r = adapter.send(request, **kwargs) 
File "/usr/local/lib/python2.7/site-packages/requests/adapters.py", line 382, in send raise SSLError(e, request=request) 
SSLError: [SSL: DECRYPTION_FAILED_OR_BAD_RECORD_MAC] decryption failed or bad record mac (_ssl.c:1750) 
```

Does it say about something?

Using:
python (2.7.9)
requests (2.3.0)


@ulandj sounds like you're running into http://stackoverflow.com/a/3724938/1953283


@sigmavirus24 
you think that if I move this line of code (from constructor of class) - https://github.com/iron-io/iron_core_python/blob/master/iron_core.py#L162  here - https://github.com/iron-io/iron_core_python/blob/master/iron_core.py#L188, then it will work without errors?