BUG: Nutanix Prism Special Agent crashing on 2.3.0

andreas-doehler · May 17, 2024, 5:46pm

In this case the internal API that i should use for the special agent is broken.
The funny thing is my special agent is currently the only special agent who has used the API functions

andreas-doehler · May 18, 2024, 4:03pm

Now also a PR for my own code is submitted.

github.com/Checkmk/checkmk

Fix for broken request_helper from v0_unstable API

Checkmk:master ← Yogibaer75:master

opened 03:56PM - 18 May 24 UTC

Yogibaer75

+60 -65

Thank you for your interest in contributing to Checkmk! Consider looking into […Readme](https://github.com/Checkmk/checkmk#want-to-contribute) regarding process details. ## General information With 2.3.0 the v0_unstable API request_helper looks broken. As the Nutanix special agent is the only special agent using this API, the problem was not discovered before release. I used this API as it was requested at the end of 22 as the Nutanix rework was submitted. Now i reworked my code to use the normal Python requests lib and it works. The PR must also be applied to the 2.3.0 branch as the bug is originally from there. ## Bug reports CMK version 2.3.0p2 To repoduce - use the Nutanix special agent and it will not work :)

martin.hirschvogel · May 21, 2024, 6:45am

Lol, thanks Andreas for the workaround.
We have a support ticket and a developer is also looking into it (so that we can fix the root-cause, the API).

andreas-doehler · May 21, 2024, 6:46am

Or remove it as i was the only one using it

martin.hirschvogel · May 21, 2024, 6:57am

Fortunately I am not a developer, so I can pretend to know nothing

k.fritsch · June 7, 2024, 9:21am

With p5 the check should have been fixed, at least according to the changes. If I run the Check in CheckMK or manually using the python agent file, I can specify --no-cert-check but it still fails with SSL: CERTIFICATE_VERIFY_FAILED: self-signed certificate

Am I missing something?

andreas-doehler · June 7, 2024, 9:45am

Can you pls post the command line like it is used on your system now?

k.fritsch · June 7, 2024, 9:53am

I run the following:

/omd/sites/spcm/share/check_mk/agents/special/agent_prism --server <prism-ip> --no-cert-check --username username --password 'XXXX' --port 9440 --debug

andreas-doehler · June 7, 2024, 1:16pm

Ok if i have my bugfix mkp installed - my version of the special agent is working.
It is ignoring all certificates

I found the error - you cannot set requests.session.verify to false if REQUEST_CA_BUNDLE environment is set.
Github Discussion → Session.verify=False ignored when REQUESTS_CA_BUNDLE environment variable is set · Issue #3829 · psf/requests · GitHub

Now i submit one more PR that fixes this issues that was not present in my first fix
Some nice things for @martin.hirschvogel

martin.hirschvogel · June 7, 2024, 1:54pm

For fairness: you as the original author hard-coded skipping the verification - a freedom you can have in your extensions, but which nowadays doesn’t pass our security team.

andreas-doehler · June 7, 2024, 1:56pm

Ok - that’s fine - but now it crashes every time you try to switch of the validation.
PR is made^^

martin.hirschvogel · June 7, 2024, 1:59pm

Yeah, just looked at the PR… (Second fix for Nutanix agent ssl verify problems by Yogibaer75 · Pull Request #703 · Checkmk/checkmk · GitHub)

What a stupid bug…
@gulaschcowboy Is that you in the GitHub Issue discussion on the requests package?

andreas-doehler · June 7, 2024, 1:59pm

I was thinking the same

aeckstein · June 7, 2024, 2:28pm

---------___---------

gulaschcowboy · June 10, 2024, 5:17am

Someone stole my name

martin.hirschvogel · June 10, 2024, 9:59am

And here is the fix Nutanix agent: resolve verify error when environment REQUEST_CA_BUNDLE is set
Release is planned for today when the real gulasch guy has approved it

martin.hirschvogel · June 10, 2024, 2:25pm

And p6 is available for download.

k.fritsch · June 13, 2024, 12:25pm

Problem is fixed and the new nutanix agent is great!