3705: Unable to use 'rbt post' with https and Python 2.7.9

ras****@gmai***** (Google Code) (Is this you? Claim this profile.)
david
david
May 1, 2015
3823
What version are you running?
RB 2.0.11 and RBTools 0.6.3

What's the URL of the page containing the problem?
N/A

What steps will reproduce the problem?
1. Install Python 2.7.9 and RBTools 0.6.3
2. Set up RB to run on HTTPS listener
3. rbt post --server https://server:8081 --debug

What is the expected output? What do you see instead?
Expected (based on Python 2.7.8):
>>> RBTools 0.6.3
>>> Python 2.7.8 (default, Jul  4 2014, 11:28:55)
[GCC 4.1.2 20080704 (Red Hat 4.1.2-50)]
>>> Running on Linux-2.6.32-358.6.2.el6.x86_64-x86_64-with-redhat-6.4-Santiago
>>> Home = /home/user
>>> Current directory = /vob/vob1
>>> Checking for a Subversion repository...
>>> Unable to execute "svn help": skipping SVN
>>> Checking for a Git repository...
>>> Unable to execute "git --help" or "git.cmd --help": skipping Git
>>> Checking for a Mercurial repository...
>>> Unable to execute "hg --help": skipping Mercurial
>>> Checking for a CVS repository...
>>> Checking for a Perforce repository...
>>> Unable to execute "p4 help": skipping Perforce
>>> Checking for a Plastic repository...
>>> Unable to execute "cm version": skipping Plastic
>>> Checking for a ClearCase repository...
>>> Running: cleartool pwv -short
>>> Running: diff --version
>>> Running: cleartool lsview -full -properties -cview
>>> Running: cleartool describe -short vob:.
>>> Running: cleartool pwv -root
>>> repository info: Path: /vob/vob1, Base path: /vob/vob1, Supports changesets: False
>>> Making HTTP GET request to https://server:8081/api/
>>> Running: cleartool lsvob -long /vob/vob1
>>> Repository's /vob/vob1 uuid is '60cd8109.c76411d4.b73f.00:10:83:fa:65:79'
...

Actual:
>>> RBTools 0.6.3
>>> Python 2.7.9 (default, Dec 29 2014, 12:30:20)
[GCC 4.1.2 20080704 (Red Hat 4.1.2-54)]
>>> Running on Linux-2.6.32-358.6.2.el6.x86_64-x86_64-with-redhat-6.4-Santiago
>>> Home = /home/user
>>> Current directory = /vob/vob1
>>> Checking for a Subversion repository...
>>> Unable to execute "svn help": skipping SVN
>>> Checking for a Git repository...
>>> Unable to execute "git --help" or "git.cmd --help": skipping Git
>>> Checking for a Mercurial repository...
>>> Unable to execute "hg --help": skipping Mercurial
>>> Checking for a CVS repository...
>>> Checking for a Perforce repository...
>>> Unable to execute "p4 help": skipping Perforce
>>> Checking for a Plastic repository...
>>> Unable to execute "cm version": skipping Plastic
>>> Checking for a ClearCase repository...
>>> Running: cleartool pwv -short
>>> Running: diff --version
>>> Running: cleartool lsview -full -properties -cview
>>> Running: cleartool describe -short vob:.
>>> Running: cleartool pwv -root
>>> repository info: Path: /vob/vob1, Base path: /vob/vob1, Supports changesets: False
>>> Making HTTP GET request to https://server:8081/api/
Traceback (most recent call last):
  File "/proj/subcm/tools/linux/python-2.7.9/bin/rbt", line 9, in <module>
    load_entry_point('RBTools==0.6.3', 'console_scripts', 'rbt')()
  File "/proj/subcm/tools/linux/python-2.7.9/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/main.py", line 134, in main
    command.run_from_argv([RB_MAIN, command_name] + args)
  File "/proj/subcm/tools/linux/python-2.7.9/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py", line 416, in run_from_argv
    exit_code = self.main(*args) or 0
  File "/proj/subcm/tools/linux/python-2.7.9/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/post.py", line 710, in main
    api_client, api_root = self.get_api(server_url)
  File "/proj/subcm/tools/linux/python-2.7.9/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py", line 561, in get_api
    "server at %s" % server_url)
rbtools.commands.CommandError: Could not reach the Review Board server at https://server:8081


What operating system are you using? What browser?
RedHat Enterprise Linux 6.4 x86_64

Please provide any additional information below.
I have verified that both RBTools 0.6.2 and 0.6.3 work on Python 2.7.8 and they both don't work with Python 2.7.9. I guess this may have something to do with the ssl module changes in 2.7.9.

It could also matter that this server uses a certificate which is issued by internal corporate CA, which may not be added to standard trusted certificates.
#1 julian*******@gmai***** (Google Code) (Is this you? Claim this profile.)
I'm seeing the same problem. Applying this change:

--- /opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py.orig	2015-01-02 17:53:41.000000000 +0000
+++ /opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py	2015-01-02 17:46:25.000000000 +0000
@@ -558,7 +558,7 @@
             api_root = api_client.get_root()
         except ServerInterfaceError, e:
             raise CommandError("Could not reach the Review Board "
-                               "server at %s" % server_url)
+                               "server at %s due to %s" % (server_url, e))
         except APIError, e:
             raise CommandError("Unexpected API Error: %s" % e)


`rbt post --debug` gives me this error:

>>> Checking for a Git repository...
>>> Running: git rev-parse --git-dir
>>> Running: git config core.bare
>>> Running: git rev-parse --show-toplevel
>>> Running: git symbolic-ref -q HEAD
>>> Running: git config --get branch.develop.merge
>>> Running: git config --get branch.develop.remote
>>> Running: git config --get remote.origin.url
>>> repository info: Path: git@github.com:agaridata/fbr-import-milter.git, Base path: , Supports changesets: False
>>> Making HTTP GET request to https://reviewboard.agari.com/api/
Traceback (most recent call last):
  File "/usr/local/bin/rbt", line 9, in <module>
    load_entry_point('RBTools==0.6.3', 'console_scripts', 'rbt')()
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/main.py", line 134, in main
    command.run_from_argv([RB_MAIN, command_name] + args)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py", line 416, in run_from_argv
    exit_code = self.main(*args) or 0
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/post.py", line 710, in main
    api_client, api_root = self.get_api(server_url)
  File "/opt/local/Library/Frameworks/Python.framework/Versions/2.7/lib/python2.7/site-packages/RBTools-0.6.3-py2.7.egg/rbtools/commands/__init__.py", line 561, in get_api
    "server at %s due to %s" % (server_url, e))
rbtools.commands.CommandError: Could not reach the Review Board server at https://reviewboard.agari.com due to [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:581)

I think this might be related to the HTTPS server having SSL disabled (allowing only TLS due to the recent SSL protocol vulnerabilities discovered), and urllib2 not bothering to try TLS.
#2 abhishek*********@gmai***** (Google Code) (Is this you? Claim this profile.)
I'm seeing the same problem as well, I hacked together something so I can get my personal tool running: https://github.com/reviewboard/rbtools/pull/44
#3 dirkmo******@gmai***** (Google Code) (Is this you? Claim this profile.)
I had the same problem due to a self signed certificate.

Adding to the beginning rbtools/api/request.py the lines:

===
import ssl
if hasattr(ssl, '_create_unverified_context'):
    ssl._create_default_https_context = ssl._create_unverified_context
===

works around the problem for me.
david
#5 david
  • +PendingReview
  • +Component-RBTools
  • +david
david
#6 david
Fixed in rbtools release-0.7.x (295d9c7). This will ship in 0.7.3

The fix adds a --disable-ssl-verification command-line flag and DISABLE_SSL_VERIFICATION config variable.
  • -PendingReview
    +Fixed