Close the QUIC datagram transports on shutdown

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")

[CoryLowe5]

worker_serve keeps its TCP servers in servers and closes them in
its finally, but the transport returned by create_datagram_endpoint
is discarded, so shutdown cannot close what it never kept. Each
QUIC-serving worker leaks its datagram transport, visible as a
GC-time unclosed transport ResourceWarning under python -W always
(we found it via tracemalloc pointing into hypercorn/asyncio/run.py
from a test suite that serves QUIC in-process many times per run).

The fix keeps the datagram transports and closes them after the
graceful drain, alongside the existing server close. After the drain
rather than before it, deliberately: unlike a TCP Server — where
close() only stops new connections — the datagram transport is both
the listener and the data path for established QUIC connections, so
closing it earlier would break in-flight traffic during
graceful_timeout.

Includes a test (tests/asyncio/test_run.py) that serves one QUIC
socket through the real worker_serve and asserts every transport
created by create_datagram_endpoint is closing after it returns; it
skips when aioquic is not installed, matching the h3 extra. A
self-contained reproduction script is attached below in a comment for
convenience.

(The trio worker was inspected and left alone: it hands its socket to
trio.socket.from_stdlib_socket inside the UDPServer under the
nursery — different ownership shape, not measured, not touched.)

[CoryLowe5]

Reproduction (self-contained — generates a throwaway self-signed certificate; run with python -W always repro_datagram_leak.py). On 0.18.0 it prints LEAK: 1 'unclosed transport' ResourceWarning(s); with this branch it prints CLEAN.

"""Reproduce: hypercorn's asyncio worker leaks its QUIC datagram transport.`worker_serve` keeps its TCP servers in `servers` and closes them in itsfinally, but the transport returned by `create_datagram_endpoint` isdiscarded into `_`, so shutdown cannot close what it never kept. Theleaked transport surfaces as a GC-time ResourceWarning.Run against hypercorn 0.18.0 with the h3 extra: python -W always repro_datagram_leak.pyExpected output on 0.18.0: LEAK: 1 'unclosed transport' ResourceWarning(s)With the fix: CLEAN: no unclosed-transport ResourceWarningSelf-contained: generates a throwaway self-signed certificate."""importasyncioimportdatetimeimportgcimporttempfileimportwarningsfrompathlibimportPathfromcryptographyimportx509fromcryptography.hazmat.primitivesimporthashes, serializationfromcryptography.hazmat.primitives.asymmetricimportecfromcryptography.x509.oidimportNameOIDfromhypercorn.app_wrappersimportASGIWrapperfromhypercorn.asyncio.runimportworker_servefromhypercorn.configimportConfigasyncdefapp(scope, receive, send):
ifscope["type"] =="lifespan":
whileTrue:
message=awaitreceive()
ifmessage["type"] =="lifespan.startup":
awaitsend({"type": "lifespan.startup.complete"})
elifmessage["type"] =="lifespan.shutdown":
awaitsend({"type": "lifespan.shutdown.complete"})
returndefwrite_self_signed(directory: Path) ->tuple[Path, Path]:
key=ec.generate_private_key(ec.SECP256R1())
name=x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "localhost")])
now=datetime.datetime.now(datetime.timezone.utc)
cert= (
x509.CertificateBuilder()
.subject_name(name)
.issuer_name(name)
.public_key(key.public_key())
.serial_number(x509.random_serial_number())
.not_valid_before(now)
.not_valid_after(now+datetime.timedelta(days=1))
.sign(key, hashes.SHA256())
)
cert_path=directory/"cert.pem"key_path=directory/"key.pem"cert_path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
key_path.write_bytes(
key.private_bytes(
serialization.Encoding.PEM,
serialization.PrivateFormat.TraditionalOpenSSL,
serialization.NoEncryption(),
)
)
returncert_path, key_pathasyncdefmain() ->None:
withtempfile.TemporaryDirectory() astmp:
cert, key=write_self_signed(Path(tmp))
config=Config()
config.bind= []
config.quic_bind= ["127.0.0.1:0"]
config.certfile=str(cert)
config.keyfile=str(key)
config.graceful_timeout=0.1asyncdefshutdown_now() ->None:
returnNoneawaitworker_serve(
ASGIWrapper(app), config, shutdown_trigger=shutdown_now
)
withwarnings.catch_warnings(record=True) ascaught:
warnings.simplefilter("always")
asyncio.run(main())
gc.collect()
leaks= [wforwincaughtifissubclass(w.category, ResourceWarning)
and"unclosed transport"instr(w.message)]
ifleaks:
print(f"LEAK: {len(leaks)} 'unclosed transport' ResourceWarning(s)")
forwinleaks:
print(f" {w.message}")
else:
print("CLEAN: no unclosed-transport ResourceWarning")