Require relative paths to avoid global namespace clashes

[JerrodCarpenter]

In lib/acirb.rb, files aren't being required relatively and this causes the restclient.rb not to be loaded if the user has the rest-client installed within the project.

[jonstacks]

+1 here. Having the same issue.

[bksteiny]

I noticed this as well. What are the chances 2 other people are having the same issue I am? 😄

[paullesiak]

Could you please provide the associated stack trace, etc? Did you install from the gem? Sourced from rubygems or downloaded?

[jonstacks]

Hi @paullesiak,

Can't speak for the rest, but here is the issue I'm having.

After installing acirb from Rubygems in my bundle, I drop into a pry session. I am able to require 'acirb' but then I get the following:

[2] pry(main)> ACIrb::RestClient
NameError: uninitialized constant ACIrb::RestClient
from (pry):2:in `__pry__'

However,

I can access RestClient from the rest-client gem, because it was required in the acirb.rb file here. When I don't have the rest-client gem installed, I am able to use the ACIrb::RestClient

The Issue:

All of the supporting files for this gem are placed in directly under the lib directory. This can cause problems for anyone trying to require a gem with the same name as one of the files or if you have a gem which supplies one of the files you are requiring. More on this can be found here under the heading: Respect the global load path

You should be able to recreate by doing a bundle install with the following Gemfile:

# A sample Gemfile
source "https://rubygems.org"

# gem "rails"
gem 'acirb'
gem 'rest-client'
gem 'pry'

and then trying to create an ACIrb::RestClient.

[paullesiak]

Thanks for all the information @jonstacks13. Can you please check out the branch https://github.com/datacenter/acirb/tree/move_lib_modules and give that a try?

[paullesiak]

Forgot to push the changes into the branch earlier. Please check now

[jonstacks]

Thanks, @paullesiak, that looks great! Any way we can get that fix "back ported" to different versions of the gem that are hosted on RubyGems? We have multiple environments each with different APIC code versions.

[JerrodCarpenter]

Thanks, @paullesiak.

[paullesiak]

@jonstacks13: please let me know which versions of APIC you are running and I'll do my best

[paullesiak]

Need to revert the change -- it got pushed in under the wrong github account

[jonstacks]

@paullesiak, running version 1.2-0.139l in a lab setting. Not sure what versions are deployed elsewhere.

[bksteiny]

@paullesiak, I believe 1.1(2h) is deployed as well.

[paullesiak]

I need to learn to git better... finally got this recommitted as the correct user.
@ChrisStein I will work on generating the gem for 1.1(2h).
@jonstacks13 I cannot find 1.2-0.139l running anywhere in the lab here. If you can email me who gave you that version, I can try to get in touch with them and generate a gem for it

[mtimm]

@paullesiak 1.2-0.139l was the original brazos EFT. It is still available in the build directories but I believe the one on the file share was updated. Technically 1.2 should be out very soon if it isn't out already. I would suggest not updating for the brazos EFT and just do the official image once it is out.

[jonstacks]

@mtimm, yeah I should have mentioned it was an EFT. Thanks!

[paullesiak]

Thanks @mtimm. @jonstacks13 let's wait for 1.2 to be shipping and I will create an official gem. In the mean time, if you need one immediately, please use the build instructions here https://github.com/datacenter/acirb#building.

I have merged #8, so the fix for this issue will be included if you build your own gem.

Appreciate all of your help and input, and if you have any other issues, I welcome your PRs

[paullesiak]

Updated gem for 1.1.2h and 1.2.1i have been uploaded here and on rubygems.org. Please confirm if its working for you.

[jonstacks]

@paullesiak ,

Sorry for not getting back to you sooner on this. I have downloaded acirb version 1.2.1.0 and can confirm I the global namespace issue is fixed. However, I am now getting the following issue:

/vendor/bundle/gems/httpclient-2.7.0.1/lib/httpclient/ssl_socket.rb:46:in `connect': Connection reset by peer - SSL_connect (Errno::ECONNRESET)

We disabled the http endpoint on the apic and are trying to connect with https. I have also noticed that I cannot access the apic though https on safari as well. I will try to see if I can make progress on this. If you want, I can open a new issue for this so other users that may be having this problem can easily find it.

[mtimm]

@jonstacks13 the issue you are experiencing has to do with the version of openssl installed on your system, it does not support the tls versions or the ciphers that the APIC does. You might be able to get around it by enabling TLSv1 on the APIC if your openssl version supports TLSv1. If it is a cipher issue there is currently no way to enable additional ciphers (at your own risk) on the APIC and you will need to upgrade ruby and openssl to address this.

TLS/SSL issues have been rather significant on this platform as the security powers that be within Cisco have required the product to be up to date on the latest openssl issues which have removed SSLv3 and many ciphers that are now either known to be insecure or even "theoretically" insecure.

The most common platform that we have seen to have issues with communicating with the APIC via https is MacOSX which ships with old openssl versions. If this is the case here, the most common way to get around it is to use homebrew to install an updated openssl version and then link a ruby install to that updated openssl version.

[jonstacks]

@mtimm,

Thanks so much! brew install openssl and then re-building ruby against the new openssl install fixed my issue. I'm assuming the safari issue is because they are using a different implementation of TLS/SSL than what firefox & chrome are using?

[jonstacks]

Also, I'm good with closing this out, since all my issues have been solved. Thanks @paullesiak and @mtimm for all the help.

[mtimm]

@jonstacks13 safari should work but there is a known issue with self signed certs and safari. Please see the Caution note here:

http://www.cisco.com/c/en/us/td/docs/switches/datacenter/aci/apic/sw/1-x/release/notes/apic_rn_103.html#pgfId-153335

[jonstacks]

@mtimm 👍 That worked for fixing safari connectivity.