kafka-python 3.0.6__tar.gz → 3.0.8__tar.gz

{kafka_python-3.0.6 → kafka_python-3.0.8}/CHANGES.md

@@ -1,9 +1,19 @@
+# 3.0.8 (Jul 9, 2026)
+
+### Fixes
+* transport: Fix TLS SNI when `ssl_check_hostname=False` (#3114)
+
+# 3.0.7 (Jun 28, 2026)
+
+### Fixes
+* transport: cancel pending io coroutines on close() (#3109)
+* producer: fix stalled shutdown when brokers unreachable (#3108)
+
 # 3.0.6 (Jun 25, 2026)
 
 ### Fixes
 * consumer: track current leader epoch in addition to record epoch (#3107)
 
-
 ### CI
 * Also `wait_for_topics` on <0.10 test fixtures (#3105)
 

{kafka_python-3.0.6 → kafka_python-3.0.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kafka-python
-Version: 3.0.6
+Version: 3.0.8
 Summary: Pure Python client for Apache Kafka
 Author-email: Dana Powers <dana.powers@gmail.com>
 License-Expression: Apache-2.0

{kafka_python-3.0.6 → kafka_python-3.0.8}/kafka/net/manager.py

@@ -3,7 +3,6 @@ import logging
 import inspect
 import random
 import socket
-import ssl
 import time
 
 from .inet import create_connection
@@ -205,35 +204,16 @@ class KafkaConnectionManager:
     def ssl_enabled(self):
         return self.config['security_protocol'] in ('SSL', 'SASL_SSL')
 
-    def _build_ssl_context(self):
-        if self.config['ssl_context'] is not None:
-            return self.config['ssl_context']
-        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
-        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
-        ctx.check_hostname = self.config['ssl_check_hostname']
-        if self.config['ssl_cafile']:
-            ctx.load_verify_locations(self.config['ssl_cafile'])
-        else:
-            ctx.load_default_certs()
-        if self.config['ssl_certfile']:
-            ctx.load_cert_chain(
-                certfile=self.config['ssl_certfile'],
-                keyfile=self.config['ssl_keyfile'],
-                password=self.config['ssl_password'],
-            )
-        if self.config['ssl_crlfile']:
-            ctx.load_verify_locations(crl=self.config['ssl_crlfile'])
-            ctx.verify_flags |= ssl.VERIFY_CRL_CHECK_LEAF
-        return ctx
-
     async def _build_transport(self, node, timeout_at=None):
         sock = await create_connection(self._net, node.host, node.port,
                                        self.config['socket_options'],
                                        proxy_url=self.config['proxy_url'],
                                        timeout_at=timeout_at)
         if self.ssl_enabled:
-            transport = KafkaSSLTransport(self._net, sock, self._build_ssl_context(),
-                                          host=node.host, ssl_check_hostname=self.config['ssl_check_hostname'])
+            ssl_configs = {key: value
+                           for key, value in self.config.items()
+                           if key.startswith('ssl_')}
+            transport = KafkaSSLTransport(self._net, sock, host=node.host, **ssl_configs)
         else:
             transport = KafkaTCPTransport(self._net, sock, host=node.host)
 

{kafka_python-3.0.6 → kafka_python-3.0.8}/kafka/net/transport.py

@@ -1,4 +1,5 @@
 from collections import deque
+import copy
 import logging
 import selectors
 import socket
@@ -19,6 +20,8 @@ class KafkaTCPTransport:
         self._closed = False
         self._write_buffer = deque()
         self._writing = False
+        self._read_task = None
+        self._write_task = None
         self._protocol = None
         self._read = False
         self._write = True
@@ -80,7 +83,7 @@ class KafkaTCPTransport:
         data_received() method.
         """
         if not self._read:
-            self._net.call_soon(self._read_from_sock)
+            self._read_task = self._net.call_soon(self._read_from_sock)
         self._read = True
         log.debug('%s: Resumed reading', self)
 
@@ -173,7 +176,7 @@ class KafkaTCPTransport:
         self._write_buffer.append(data)
         if not self._writing:
             self._writing = True
-            self._net.call_soon(self._write_to_sock)
+            self._write_task =  self._net.call_soon(self._write_to_sock)
 
     def writelines(self, list_of_data):
         """Write a list (or any iterable) of data bytes to the transport."""
@@ -182,7 +185,7 @@ class KafkaTCPTransport:
         self._write_buffer.extend(list_of_data)
         if not self._writing:
             self._writing = True
-            self._net.call_soon(self._write_to_sock)
+            self._write_task = self._net.call_soon(self._write_to_sock)
 
     async def _write_to_sock(self):
         try:
@@ -272,6 +275,10 @@ class KafkaTCPTransport:
             except OSError:
                 pass
             sock.close()
+        for task in (self._read_task, self._write_task):
+            if task is not None:
+                self._net.cancel(task)
+        self._read_task = self._write_task = None
         proto = self._protocol
         self._protocol = None
         if proto is not None:
@@ -365,13 +372,49 @@ class KafkaTCPTransport:
 
 
 class KafkaSSLTransport(KafkaTCPTransport):
-    def __init__(self, net, sock, ssl_context, host=None, ssl_check_hostname=False):
-        self._ssl_context = ssl_context
-        server_hostname = host if ssl_check_hostname else None
-        sock = ssl_context.wrap_socket(
-            sock, server_hostname=server_hostname, do_handshake_on_connect=False)
+    DEFAULT_CONFIG = {
+        'ssl_context': None,
+        'ssl_check_hostname': True,
+        'ssl_cafile': None,
+        'ssl_certfile': None,
+        'ssl_keyfile': None,
+        'ssl_password': None,
+        'ssl_crlfile': None,
+    }
+    def __init__(self, net, sock, host=None, **configs):
+        self.ssl_config = copy.copy(self.DEFAULT_CONFIG)
+        for key in self.ssl_config:
+            if key in configs:
+                self.ssl_config[key] = configs[key]
+        self._ssl_context = self._build_ssl_context(self.ssl_config)
+        server_hostname = host.rstrip('.') if host is not None else None
+        sock = self._ssl_context.wrap_socket(
+            sock, server_hostname=server_hostname,
+            do_handshake_on_connect=False)
         super().__init__(net, sock, host=host)
 
+    @staticmethod
+    def _build_ssl_context(config):
+        if config['ssl_context'] is not None:
+            return config['ssl_context']
+        ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+        ctx.check_hostname = config['ssl_check_hostname']
+        if config['ssl_cafile']:
+            ctx.load_verify_locations(config['ssl_cafile'])
+        else:
+            ctx.load_default_certs()
+        if config['ssl_certfile']:
+            ctx.load_cert_chain(
+                certfile=config['ssl_certfile'],
+                keyfile=config['ssl_keyfile'],
+                password=config['ssl_password'],
+            )
+        if config['ssl_crlfile']:
+            ctx.load_verify_locations(crl=config['ssl_crlfile'])
+            ctx.verify_flags |= ssl.VERIFY_CRL_CHECK_LEAF
+        return ctx
+
     async def handshake(self):
         while True:
             try:

{kafka_python-3.0.6 → kafka_python-3.0.8}/kafka/producer/kafka.py

@@ -646,7 +646,7 @@ class KafkaProducer:
         _self = weakref.proxy(self)
         def wrapper():
             try:
-                _self.close(timeout=0, null_logger=True)
+                _self.close(timeout=1, null_logger=True)
             except (ReferenceError, AttributeError):
                 pass
         return wrapper

{kafka_python-3.0.6 → kafka_python-3.0.8}/kafka/producer/sender.py

@@ -310,7 +310,7 @@ class Sender(threading.Thread):
             return False
 
         log.debug("%s: Sending transactional request %s", str(self), next_request_handler.request)
-        while not self._force_close:
+        while self._running and not self._force_close:
             target_node = None
             try:
                 if next_request_handler.needs_coordinator():
@@ -325,7 +325,8 @@ class Sender(threading.Thread):
                 else:
                     target_node = self._client.least_loaded_node()
                     if target_node is None:
-                        self._client.poll(future=self._metadata.request_update())
+                        self._client.poll(timeout_ms=self.config['retry_backoff_ms'],
+                                          future=self._metadata.request_update())
                     elif not self._client.await_ready(target_node, timeout_ms=self.config['request_timeout_ms']):
                         continue
 

kafka_python-3.0.8/kafka/version.py

@@ -0,0 +1 @@
+__version__ = '3.0.8'

{kafka_python-3.0.6 → kafka_python-3.0.8}/kafka_python.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kafka-python
-Version: 3.0.6
+Version: 3.0.8
 Summary: Pure Python client for Apache Kafka
 Author-email: Dana Powers <dana.powers@gmail.com>
 License-Expression: Apache-2.0

{kafka_python-3.0.6 → kafka_python-3.0.8}/test/net/test_transport.py

@@ -6,8 +6,8 @@ import pytest
 
 import kafka.errors as Errors
 from kafka.future import Future
-from kafka.net.selector import NetworkSelector
-from kafka.net.transport import KafkaTCPTransport
+from kafka.net.selector import NetworkSelector, TaskState
+from kafka.net.transport import KafkaSSLTransport, KafkaTCPTransport
 
 
 @pytest.fixture
@@ -365,3 +365,145 @@ class TestKafkaTCPTransport:
         t._closed = True
         s = str(t)
         assert 'closed' in s
+
+
+class TestKafkaSSLTransport:
+    """Regression tests for https://github.com/dpkp/kafka-python/issues/3113:
+    TLS SNI (server_hostname) must be sent regardless of ssl_check_hostname so
+    that SNI-routed clusters (nginx/Istio/Strimzi ingress) remain reachable when
+    hostname verification is disabled.
+    """
+
+    def _make_ssl_sock(self):
+        # wrap_socket returns a wrapped socket; give it the peer/name accessors
+        # that KafkaTCPTransport.__init__ pokes at via str()/repr helpers.
+        wrapped = _make_mock_sock()
+        sock = _make_mock_sock()
+        ctx = MagicMock()
+        ctx.wrap_socket.return_value = wrapped
+        return sock, ctx, wrapped
+
+    def test_sni_sent_when_check_hostname_true(self, net):
+        sock, ctx, _ = self._make_ssl_sock()
+        KafkaSSLTransport(net, sock, host='broker.example.com',
+                          ssl_context=ctx, ssl_check_hostname=True)
+        _, kwargs = ctx.wrap_socket.call_args
+        assert kwargs['server_hostname'] == 'broker.example.com'
+
+    def test_sni_sent_when_check_hostname_false(self, net):
+        # The bug: SNI used to be suppressed when verification was disabled.
+        sock, ctx, _ = self._make_ssl_sock()
+        KafkaSSLTransport(net, sock, host='broker.example.com',
+                          ssl_context=ctx, ssl_check_hostname=False)
+        _, kwargs = ctx.wrap_socket.call_args
+        assert kwargs['server_hostname'] == 'broker.example.com'
+
+    def test_sni_strips_trailing_dot(self, net):
+        # A trailing dot is a valid FQDN but illegal in the SNI extension.
+        sock, ctx, _ = self._make_ssl_sock()
+        KafkaSSLTransport(net, sock, host='broker.example.com.',
+                          ssl_context=ctx, ssl_check_hostname=False)
+        _, kwargs = ctx.wrap_socket.call_args
+        assert kwargs['server_hostname'] == 'broker.example.com'
+
+    def test_sni_none_when_host_missing(self, net):
+        sock, ctx, _ = self._make_ssl_sock()
+        KafkaSSLTransport(net, sock, host=None, ssl_context=ctx)
+        _, kwargs = ctx.wrap_socket.call_args
+        assert kwargs['server_hostname'] is None
+
+    def test_handshake_not_done_on_connect(self, net):
+        sock, ctx, _ = self._make_ssl_sock()
+        KafkaSSLTransport(net, sock, host='broker.example.com', ssl_context=ctx)
+        _, kwargs = ctx.wrap_socket.call_args
+        assert kwargs['do_handshake_on_connect'] is False
+
+    def test_provided_ssl_context_is_used(self, net):
+        sock, ctx, wrapped = self._make_ssl_sock()
+        t = KafkaSSLTransport(net, sock, host='broker.example.com',
+                              ssl_context=ctx)
+        assert t._ssl_context is ctx
+        assert t._sock is wrapped
+
+    def test_config_defaults_and_overrides(self, net):
+        sock, ctx, _ = self._make_ssl_sock()
+        t = KafkaSSLTransport(net, sock, host='h', ssl_context=ctx,
+                              ssl_check_hostname=False)
+        # Explicitly-passed ssl_* keys land in ssl_config...
+        assert t.ssl_config['ssl_check_hostname'] is False
+        assert t.ssl_config['ssl_context'] is ctx
+        # ...unspecified keys keep their defaults.
+        assert t.ssl_config['ssl_cafile'] is None
+        assert t.ssl_config['ssl_check_hostname'] is not None
+
+
+class TestBuildSSLContext:
+    def test_returns_provided_context(self):
+        ctx = MagicMock()
+        config = dict(KafkaSSLTransport.DEFAULT_CONFIG, ssl_context=ctx)
+        assert KafkaSSLTransport._build_ssl_context(config) is ctx
+
+    def test_check_hostname_propagates_to_context(self):
+        config = dict(KafkaSSLTransport.DEFAULT_CONFIG, ssl_check_hostname=False)
+        ctx = KafkaSSLTransport._build_ssl_context(config)
+        assert ctx.check_hostname is False
+
+    def test_check_hostname_true_requires_verification(self):
+        config = dict(KafkaSSLTransport.DEFAULT_CONFIG, ssl_check_hostname=True)
+        ctx = KafkaSSLTransport._build_ssl_context(config)
+        assert ctx.check_hostname is True
+
+
+class TestTransportWaiterCleanup:
+    """Regression: a locally-initiated close()/abort() must reclaim the socket
+    read/write coroutine tasks parked in the event loop.
+
+    These tests fail until ``KafkaTCPTransport._close`` cancels its read/write
+    waiter tasks (``net.cancel(task)``); the selector's existing WAIT_IO branch
+    in ``cancel()`` then drives the io_guard finalizer and discards the task.
+    """
+
+    def test_local_close_reclaims_parked_reader(self, net, socketpair):
+        rsock, wsock = socketpair
+        t = KafkaTCPTransport(net, wsock)
+        t.set_protocol(MagicMock())
+        baseline = len(net._pending_tasks)
+
+        t.resume_reading()
+        net.drain()  # reader runs and parks in WAIT_IO on wait_read(wsock)
+        parked = [task for task in net._pending_tasks if task.state is TaskState.WAIT_IO]
+        assert len(parked) == 1, 'reader did not park as expected'
+        assert len(net._pending_tasks) == baseline + 1
+
+        # Empty write buffer -> close() tears the socket down synchronously. The
+        # peer (rsock) never sent anything, so there is no I/O event to wake the
+        # parked reader; close() itself must reclaim it.
+        t.close()
+        net.drain()  # running the loop must not be needed -- and must not help either
+
+        assert t._sock is None
+        assert len(net._pending_tasks) == baseline, (
+            'parked reader leaked into _pending_tasks after local close')
+        assert not any(task.state is TaskState.WAIT_IO for task in net._pending_tasks)
+
+    def test_local_close_reclaims_parked_writer(self, net, socketpair):
+        rsock, wsock = socketpair
+        t = KafkaTCPTransport(net, wsock)
+        t.set_protocol(MagicMock())
+        baseline = len(net._pending_tasks)
+
+        # write() schedules _write_to_sock, whose loop parks on the first
+        # wait_write before the bytes leave the buffer. drain() steps it once
+        # to the park and returns (no _ready left), leaving it suspended.
+        t.write(b'data')
+        net.drain()
+        parked = [task for task in net._pending_tasks if task.state is TaskState.WAIT_IO]
+        assert len(parked) == 1, 'writer did not park as expected'
+
+        t.abort(error=Errors.KafkaConnectionError('boom'))
+        net.drain()
+
+        assert t._sock is None
+        assert len(net._pending_tasks) == baseline, (
+            'parked writer leaked into _pending_tasks after abort')
+        assert not any(task.state is TaskState.WAIT_IO for task in net._pending_tasks)

kafka_python-3.0.6/kafka/version.py

@@ -1 +0,0 @@
-__version__ = '3.0.6'