Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tls certificate handling defect in 2.2.4 #1199

Closed
salami738 opened this issue Sep 27, 2023 · 9 comments
Closed

tls certificate handling defect in 2.2.4 #1199

salami738 opened this issue Sep 27, 2023 · 9 comments
Assignees
@jmakar-s1

Comments

@salami738
Copy link

I found a bug in Version 2.2.4. TLS handling is not working properly
This is a problem for url monitors and alerts.

$ kubectl set image ds/scalyr-agent-2 scalyr-agent=scalyr/scalyr-k8s-agent:2.2.4
$ kubectl exec -it scalyr-agent-2-12345 -- /bin/python3.10
>>> import urllib.request
>>> contents = urllib.request.urlopen("https://google.de").read()
...
Traceback (most recent call last):
  File "/usr/lib/python3.10/urllib/request.py", line 1348, in do_open
    h.request(req.get_method(), req.selector, req.data, headers,
  File "/usr/lib/python3.10/http/client.py", line 1283, in request
    self._send_request(method, url, body, headers, encode_chunked)
  File "/usr/lib/python3.10/http/client.py", line 1329, in _send_request
    self.endheaders(body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.10/http/client.py", line 1278, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/lib/python3.10/http/client.py", line 1038, in _send_output
    self.send(msg)
  File "/usr/lib/python3.10/http/client.py", line 976, in send
    self.connect()
  File "/usr/lib/python3.10/http/client.py", line 1455, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/usr/lib/python3.10/ssl.py", line 513, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/lib/python3.10/ssl.py", line 1071, in _create
    self.do_handshake()
  File "/usr/lib/python3.10/ssl.py", line 1342, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1007)

In comparision v2.2.3

$ kubectl set image ds/scalyr-agent-2 scalyr-agent=scalyr/scalyr-k8s-agent:2.2.3
$ kubectl exec -it scalyr-agent-2-12345 -- /usr/local/bin/python

>>> import urllib.request
>>> contents = urllib.request.urlopen("https://google.de").read()
>>> print(contents)
...
<!doctype html><html itemscope=
...
@weilliu
Copy link

weilliu commented Sep 27, 2023

Thanks for reporting the issue. Engineering will review it and implement a fix for it.

@salami738
Copy link
Author

Have you had a chance to look at this yet?

@salami738
Copy link
Author

?

@weilliu
Copy link

weilliu commented Oct 26, 2023

@salami738 Sorry for the delayed response. I will check for the update with engineering. Is the issue reproducible with the latest agent version?

@jmakar-s1 jmakar-s1 self-assigned this Nov 3, 2023
@jmakar-s1
Copy link
Contributor

Turns out this is a problem with the build process changes made starting with 2.2.4. The /etc/ssl directory and the corresponding certs are missing, will work on a fix.

@jmakar-s1 jmakar-s1 mentioned this issue Nov 7, 2023
Merged
@jmakar-s1
Copy link
Contributor

jmakar-s1 commented Nov 7, 2023 •
edited
Loading

The fix has been merged, thank you for reporting this!

It will be included in the next release but if this is an immediate issue you're welcome to use the intermediate build tagged 882e3cf815242a000b0ece45ab5b7761eccac69b

$ docker run -it scalyr/scalyr-k8s-agent:882e3cf815242a000b0ece45ab5b7761eccac69b ls /etc/ssl/certs/*.pem | wc -l
141

@salami738
Copy link
Author

thanks for the fix. Will test it soon.

@salami738
Copy link
Author

According to scalyr developers, this is fixed in version: https://github.com/scalyr/scalyr-agent-2/releases/tag/v2.2.8. We did not test it yet.

@salami738
Copy link
Author

I tested the v2.2.4 as defective and v2.2.8 as fixed. Thanks.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jmakar-s1 jmakar-s1

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@weilliu @salami738 @jmakar-s1