Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

httplib.HTTPSConnection used even when HAS_SSL False #11918

Closed
jedsmith opened this issue Aug 10, 2015 · 7 comments
Closed

httplib.HTTPSConnection used even when HAS_SSL False #11918

jedsmith opened this issue Aug 10, 2015 · 7 comments
Labels
bug This issue/PR relates to a bug.

Comments

@jedsmith
Copy link

Issue Type:
  • Bug Report
Ansible Version:
[jed@jed ~]$ ansible --version
ansible 1.9.2
  configured module search path = None
Ansible Configuration:
  • Stock.
Environment:
  • Any host OS.
  • Managed OS: CoreOS on GCE.
Summary:

When Google vendors CoreOS for their platform, they include a Python interpreter for daemons owned by them since we do not ship one in the OS. Conveniently for me, I can then use this interpreter to manage Ansible, and this works fine for a pretty significant deployment at present.

The one roadblock is that this subclass blindly uses httplib.HTTPSConnection, even though import ssl was guarded further up. Google hasn't included OpenSSL in its build of Python, so import ssl fails (which sets HAS_SSL to False), which then implies that httplib.HTTPSConnection is nonexistent. There are obviously a couple solutions here, including Google recompiling Python with OpenSSL, but it seems like since work was put in to do the HAS_SSL guard it should apply to the whole file.

I'm trying to get_url a cleartext URL, so I don't need the extra TLS-centric functionality. I began writing a patch to guard this extra functionality under HAS_SSL but I quickly lost the plot and broke Ansible inexplicably, so I'm just filing an issue instead.

Steps To Reproduce:
  1. Launch CoreOS on Google Compute Engine.
  2. Attempt to manage it with ansible_python_interpreter=/usr/share/oem/python/bin/python2.7.
  3. Use a get_url play.
Expected Results:
  • Successful file download.
Actual Results:
TASK: [kubelet | Install Kubelet] *********************************************
failed: [core1.coreos.systems] => {"failed": true, "parsed": false}
BECOME-SUCCESS-xugzhlvqovsgnxebwkpyiptibpqnkrhn
OpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011
debug1: Reading configuration data /Users/jed/.ssh/config
debug1: /Users/jed/.ssh/config line 6: Applying options for *.coreos.systems
debug1: Reading configuration data /etc/ssh_config
debug1: /etc/ssh_config line 20: Applying options for *
debug1: auto-mux: Trying existing master
debug1: mux_client_request_session: master session id: 2
Traceback (most recent call last):
  File "<stdin>", line 2201, in <module>
AttributeError: 'module' object has no attribute 'HTTPSConnection'
@jedsmith
Copy link
Author

Just realized you don't need GCE to confirm, probably, if you can just make import ssl fail. So:

Steps to Reproduce
  1. Force import ssl to fail by hiding the module temporarily or building without OpenSSL.
  2. As above.

@albertux
Copy link

hi @jedsmith I have the same problem fetching a tar.gz via https using get_url module (ansible 1.9.2)

I can see this error:

"Request failed: <urlopen error [Errno 8] _ssl.c:492: EOF occurred in violation of protocol>"

part of the playbook:

get_url: url=https://somehost/somefile.tar.gz dest=/tmp

@abadger
Copy link
Contributor

abadger commented Nov 3, 2015

IIRC, the public module ssl wa added after the support for httpsconnection in httplib. So we're not actually checking for whether python was built against openssl. We're checking if the installed python is either recent enough to have the ssl module or has an addon package which provides the ssl module (See the python-2.4 documentation which has httpsconnection https://docs.python.org/release/2.4.4/lib/module-httplib.html but not an ssl module).

I'm not sure if we want to have a separate guard for HTTPSConnection or if we would want to tell people to use the command module with curl or wget instead. Looking into how hard it would be to code a separate guard now....

@abadger
Copy link
Contributor

abadger commented Nov 3, 2015

I think it will be moderate to hard to implement this. I have a few other things to look into in urls.py so I'll try to squeeze this in as well but I can't absolutely promise it will get fixed in this round. As you saw when you tried to add it to the HAS_SSL guard, the code is not all straightforward.

Most people on CoreOS install their own python. command module with curl and wget is another workaround.

@jimi-c jimi-c removed the P3 label Dec 7, 2015
@abadger
Copy link
Contributor

abadger commented Dec 16, 2015

@albertux Note -- for your issue, you'll definitely need to get a different version of python or use the workaround of using curl and wget. You are trying to retrieve an https url. If python doesn't have support compiled in for using https then you won't be able to use get_url to retrieve the url. @jedsmith's problem is different as he's trying to retrieve a http url which theoretically shouldn't need support for the https protocol.

abadger added a commit that referenced this issue Dec 16, 2015
@abadger
Conditionally create the CustomHTTPSConnection class only if we have …
897569c 
…the required baseclasses.

Fixes #11918
@albertux
Copy link

Thanks @abadger I ended using http instead of https

@abadger
Copy link
Contributor

abadger commented Dec 17, 2015

Note - changes to fix this pushed to both stable-2.0 and devel. So the fix should be present in the 2.0 final release.

@ansibot ansibot added bug This issue/PR relates to a bug. and removed bug_report labels Mar 6, 2018
@ansible ansible locked and limited conversation to collaborators Apr 25, 2019
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
bug This issue/PR relates to a bug.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@albertux @jimi-c @jedsmith @abadger @bcoca @ansibot