Snow 1747564 econnreset error should be retried (#2547)

Author: sfc-gh-pczajka

DESCRIPTION.md

@@ -10,6 +10,13 @@ Source code is also available at: https://github.com/snowflakedb/snowflake-conne
 - v3.18.0(TBD)
   - Added the `workload_identity_impersonation_path` parameter to support service account impersonation for Workload Identity Federation on GCP and AWS workloads only
   - Fixed `get_results_from_sfqid` when using `DictCursor` and executing multiple statements at once
+  - Added the `oauth_credentials_in_body` parameter supporting an option to send the oauth client credentials in the request body
+  - Fix retry behavior for `ECONNRESET` error
+
+- v3.17.4(September 22,2025)
+  - Added support for intermediate certificates as roots when they are stored in the trust store
+  - Bumped up vendored `urllib3` to `2.5.0` and `requests` to `v2.32.5`
+  - Dropped support for OpenSSL versions older than 1.1.1
 
 - v3.17.3(September 02,2025)
   - Enhanced configuration file permission warning messages.

src/snowflake/connector/aio/_network.py

@@ -67,6 +67,7 @@
 from ..network import (
     SnowflakeRestfulJsonEncoder,
     get_http_retryable_error,
+    is_econnreset_exception,
     is_login_request,
     is_retryable_http_code,
 )
@@ -790,6 +791,8 @@ async def _request_exec(
             finally:
                 raw_ret.close()  # ensure response is closed
         except (aiohttp.ClientSSLError, aiohttp.ClientConnectorSSLError) as se:
+            if is_econnreset_exception(se):
+                raise RetryRequest(se.os_error)
             msg = f"Hit non-retryable SSL error, {str(se)}.\n{_CONNECTIVITY_ERR_MSG}"
             logger.debug(msg)
             # the following code is for backward compatibility with old versions of python connector which calls

src/snowflake/connector/network.py

@@ -238,6 +238,10 @@ def is_login_request(url: str) -> bool:
     return "login-request" in parse_url(url).path
 
 
+def is_econnreset_exception(e: Exception) -> bool:
+    return "ECONNRESET" in repr(e)
+
+
 class RetryRequest(Exception):
     """Signal to retry request."""
 
@@ -965,7 +969,7 @@ def _request_exec_wrapper(
                 )
             retry_ctx.retry_reason = reason
 
-            if "Connection aborted" in repr(e) and "ECONNRESET" in repr(e):
+            if is_econnreset_exception(e):
                 # connection is reset by the server, the underlying connection is broken and can not be reused
                 # we need a new urllib3 http(s) connection in this case.
                 # We need to first close the old one so that urllib3 pool manager can create a new connection
@@ -1146,6 +1150,8 @@ def _request_exec(
             finally:
                 raw_ret.close()  # ensure response is closed
         except SSLError as se:
+            if is_econnreset_exception(se):
+                raise RetryRequest(se)
             msg = f"Hit non-retryable SSL error, {str(se)}.\n{_CONNECTIVITY_ERR_MSG}"
             logger.debug(msg)
             # the following code is for backward compatibility with old versions of python connector which calls

test/unit/aio/test_retry_network_async.py

@@ -18,6 +18,7 @@
 import aiohttp
 import OpenSSL.SSL
 import pytest
+from aiohttp import ClientSSLError
 
 import snowflake.connector.aio
 from snowflake.connector.aio._network import SnowflakeRestful
@@ -41,6 +42,7 @@
     ServiceUnavailableError,
 )
 from snowflake.connector.network import STATUS_TO_EXCEPTION, RetryRequest
+from snowflake.connector.vendored.requests.exceptions import SSLError
 
 pytestmark = pytest.mark.skipolddriver
 
@@ -454,3 +456,60 @@ async def test_retry_request_timeout(mockSessionRequest, next_action_result):
     # 13 seconds should be enough for authenticator to attempt thrice
     # however, loosen restrictions to avoid thread scheduling causing failure
     assert 1 < mockSessionRequest.call_count < 5
+
+
+async def test_sslerror_with_econnreset_retries():
+    """Test that SSLError with ECONNRESET raises RetryRequest."""
+    connection = mock_connection()
+    connection.errorhandler = Error.default_errorhandler
+    rest = SnowflakeRestful(
+        host="testaccount.snowflakecomputing.com",
+        port=443,
+        connection=connection,
+    )
+
+    default_parameters = {
+        "method": "POST",
+        "full_url": "https://testaccount.snowflakecomputing.com/",
+        "headers": {},
+        "data": '{"code": 12345}',
+        "token": None,
+    }
+
+    # Test SSLError with ECONNRESET in the message
+    econnreset_ssl_error = ClientSSLError(
+        MagicMock(), SSLError("Connection broken: ECONNRESET")
+    )
+    session = MagicMock()
+    session.request = Mock(side_effect=econnreset_ssl_error)
+
+    with pytest.raises(RetryRequest, match="Connection broken: ECONNRESET"):
+        await rest._request_exec(session=session, **default_parameters)
+
+
+async def test_sslerror_without_econnreset_does_not_retry():
+    """Test that SSLError without ECONNRESET does not retry but raises OperationalError."""
+    connection = mock_connection()
+    connection.errorhandler = Error.default_errorhandler
+    rest = SnowflakeRestful(
+        host="testaccount.snowflakecomputing.com",
+        port=443,
+        connection=connection,
+    )
+
+    default_parameters = {
+        "method": "POST",
+        "full_url": "https://testaccount.snowflakecomputing.com/",
+        "headers": {},
+        "data": '{"code": 12345}',
+        "token": None,
+    }
+
+    # Test SSLError without ECONNRESET in the message
+    regular_ssl_error = SSLError("SSL handshake failed")
+    session = MagicMock()
+    session.request = Mock(side_effect=regular_ssl_error)
+
+    # This should raise OperationalError, not RetryRequest
+    with pytest.raises(OperationalError):
+        await rest._request_exec(session=session, **default_parameters)

test/unit/test_retry_network.py

@@ -51,9 +51,11 @@
 try:
     import snowflake.connector.vendored.urllib3.contrib.pyopenssl
     from snowflake.connector.vendored import requests, urllib3
+    from snowflake.connector.vendored.requests.exceptions import SSLError
 except ImportError:  # pragma: no cover
     import requests
     import urllib3
+    from requests.exceptions import SSLError
 
 THIS_DIR = os.path.dirname(os.path.realpath(__file__))
 
@@ -477,3 +479,58 @@ def test_retry_request_timeout(mockSessionRequest, next_action_result):
     # 13 seconds should be enough for authenticator to attempt thrice
     # however, loosen restrictions to avoid thread scheduling causing failure
     assert 1 < mockSessionRequest.call_count < 5
+
+
+def test_sslerror_with_econnreset_retries():
+    """Test that SSLError with ECONNRESET raises RetryRequest."""
+    connection = mock_connection()
+    connection.errorhandler = Error.default_errorhandler
+    rest = SnowflakeRestful(
+        host="testaccount.snowflakecomputing.com",
+        port=443,
+        connection=connection,
+    )
+
+    default_parameters = {
+        "method": "POST",
+        "full_url": "https://testaccount.snowflakecomputing.com/",
+        "headers": {},
+        "data": '{"code": 12345}',
+        "token": None,
+    }
+
+    # Test SSLError with ECONNRESET in the message
+    econnreset_ssl_error = SSLError("Connection broken: ECONNRESET")
+    session = MagicMock()
+    session.request = Mock(side_effect=econnreset_ssl_error)
+
+    with pytest.raises(RetryRequest, match="Connection broken: ECONNRESET"):
+        rest._request_exec(session=session, **default_parameters)
+
+
+def test_sslerror_without_econnreset_does_not_retry():
+    """Test that SSLError without ECONNRESET does not retry but raises OperationalError."""
+    connection = mock_connection()
+    connection.errorhandler = Error.default_errorhandler
+    rest = SnowflakeRestful(
+        host="testaccount.snowflakecomputing.com",
+        port=443,
+        connection=connection,
+    )
+
+    default_parameters = {
+        "method": "POST",
+        "full_url": "https://testaccount.snowflakecomputing.com/",
+        "headers": {},
+        "data": '{"code": 12345}',
+        "token": None,
+    }
+
+    # Test SSLError without ECONNRESET in the message
+    regular_ssl_error = SSLError("SSL handshake failed")
+    session = MagicMock()
+    session.request = Mock(side_effect=regular_ssl_error)
+
+    # This should raise OperationalError, not RetryRequest
+    with pytest.raises(OperationalError):
+        rest._request_exec(session=session, **default_parameters)