{"action":"created","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/13478","labels_url":"https://api.github.com/repos/ansible/ansible/issues/13478/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/13478/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/13478/events","html_url":"https://github.com/ansible/ansible/issues/13478","id":121094816,"number":13478,"title":"KeyError 'status' when running get_url over HTTPS and ssl module is not installed on target","user":{"login":"slaunay","id":533482,"avatar_url":"https://avatars.githubusercontent.com/u/533482?v=3","gravatar_id":"","url":"https://api.github.com/users/slaunay","html_url":"https://github.com/slaunay","followers_url":"https://api.github.com/users/slaunay/followers","following_url":"https://api.github.com/users/slaunay/following{/other_user}","gists_url":"https://api.github.com/users/slaunay/gists{/gist_id}","starred_url":"https://api.github.com/users/slaunay/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/slaunay/subscriptions","organizations_url":"https://api.github.com/users/slaunay/orgs","repos_url":"https://api.github.com/users/slaunay/repos","events_url":"https://api.github.com/users/slaunay/events{/privacy}","received_events_url":"https://api.github.com/users/slaunay/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/ansible/ansible/labels/bug_report","name":"bug_report","color":"fbca04"}],"state":"open","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/ansible/ansible/milestones/7","html_url":"https://github.com/ansible/ansible/milestones/stable-1.9","labels_url":"https://api.github.com/repos/ansible/ansible/milestones/7/labels","id":1326964,"number":7,"title":"stable-1.9","description":"","creator":{"login":"jimi-c","id":26403,"avatar_url":"https://avatars.githubusercontent.com/u/26403?v=3","gravatar_id":"","url":"https://api.github.com/users/jimi-c","html_url":"https://github.com/jimi-c","followers_url":"https://api.github.com/users/jimi-c/followers","following_url":"https://api.github.com/users/jimi-c/following{/other_user}","gists_url":"https://api.github.com/users/jimi-c/gists{/gist_id}","starred_url":"https://api.github.com/users/jimi-c/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jimi-c/subscriptions","organizations_url":"https://api.github.com/users/jimi-c/orgs","repos_url":"https://api.github.com/users/jimi-c/repos","events_url":"https://api.github.com/users/jimi-c/events{/privacy}","received_events_url":"https://api.github.com/users/jimi-c/received_events","type":"User","site_admin":false},"open_issues":29,"closed_issues":5,"state":"open","created_at":"2015-09-28T14:27:40Z","updated_at":"2015-12-28T15:56:58Z","due_on":null,"closed_at":null},"comments":1,"created_at":"2015-12-08T20:41:42Z","updated_at":"2015-12-30T12:48:19Z","closed_at":null,"body":"##### Issue Type:\r\n\r\nBug Report\r\n\r\n##### Ansible Version:\r\n\r\n```\r\n$ ansible --version\r\nansible 1.9.4\r\n  configured module search path = None\r\n```\r\n\r\n##### Ansible Configuration:\r\n\r\nNo custom configuration, empty `/etc/ansible/ansible.cfg`.\r\n\r\n##### Environment:\r\n\r\nAnsible is running on Mac OS X:\r\n```\r\n$ uname -a\r\nDarwin sebastien.local 14.5.0 Darwin Kernel Version 14.5.0: Tue Sep  1 21:23:09 PDT 2015; root:xnu-2782.50.1~1/RELEASE_X86_64 x86_64\r\n$ sw_vers -productVersion\r\n10.10.5\r\n```\r\n\r\nTarget host is running Debian Lenny:\r\n```\r\n$ lsb_release  -a\r\nNo LSB modules are available.\r\nDistributor ID:\tDebian\r\nDescription:\tDebian GNU/Linux 5.0.4 (lenny)\r\nRelease:\t5.0.4\r\nCodename:\tlenny\r\n```\r\nwith Python 2.5:\r\n```\r\n$ /usr/bin/python --version\r\nPython 2.5.2\r\n```\r\n**and without the ssl module**.:\r\n```\r\n$ /usr/bin/python\r\nPython 2.5.2 (r252:60911, Jan 24 2010, 14:53:14)\r\n[GCC 4.3.2] on linux2\r\nType \"help\", \"copyright\", \"credits\" or \"license\" for more information.\r\n>>> import ssl\r\nTraceback (most recent call last):\r\n  File \"<stdin>\", line 1, in <module>\r\nImportError: No module named ssl\r\n>>>\r\n```\r\n\r\n##### Summary:\r\n\r\nWhen running the get_url task over a HTTPS URL, I get the following error in the `msg` property of the JSON output:\r\n```\r\nTraceback (most recent call last):\r\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 2703, in <module>\r\n    main()\r\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 230, in main\r\n    tmpsrc, info = url_get(module, url, dest, use_proxy, last_mod_time, force, timeout)\r\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 154, in url_get\r\n    if info['status'] == 304:\r\nKeyError: 'status'\r\nOpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011\r\ndebug1: Reading configuration data /etc/ssh_config\r\ndebug1: /etc/ssh_config line 20: Applying options for *\r\ndebug1: auto-mux: Trying existing master\r\ndebug1: mux_client_request_session: master session id: 2\r\nShared connection to ops9.sjc.opendns.com closed.\r\n```\r\n\r\nThe root cause is hidden and makes it tricky for end user to understand what is happening.\r\n\r\n##### Steps To Reproduce:\r\n\r\nRun the previous command over a machine that does not have the Python ssl module installed.\r\n\r\nThe following configuration is used for the following commands:\r\n```\r\n$ cat ansible-hosts.cfg\r\n[host]\r\nhost.domain\r\n```\r\n\r\n##### Expected Results:\r\n\r\nExpected result:\r\n```\r\n$ ansible -i ansible-hosts.cfg host -m get_url -a \"url=https://anotherhost/file.ext dest=file.ext\"\r\nhost.domain | FAILED >> {\r\n    \"failed\": true,\r\n    \"msg\": \"SSL validation is not available in your version of python. You can use validate_certs=False, however this is unsafe and not recommended\"\r\n}\r\n```\r\n\r\n##### Actual Results:\r\n\r\n```\r\n$ ansible -i ansible-hosts.cfg host -m get_url -a \"url=https://anotherhost/file.ext dest=file.ext\"\r\nhost.domain | FAILED >> {\r\n    \"failed\": true,\r\n    \"msg\": \"Traceback (most recent call last):\\r\\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 2703, in <module>\\r\\n    main()\\r\\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 230, in main\\r\\n    tmpsrc, info = url_get(module, url, dest, use_proxy, last_mod_time, force, timeout)\\r\\n  File \\\"/home/sebastien/.ansible/tmp/ansible-tmp-1449606084.82-168391876199698/get_url\\\", line 154, in url_get\\r\\n    if info['status'] == 304:\\r\\nKeyError: 'status'\\r\\nOpenSSH_6.2p2, OSSLShim 0.9.8r 8 Dec 2011\\ndebug1: Reading configuration data /etc/ssh_config\\r\\ndebug1: /etc/ssh_config line 20: Applying options for *\\r\\ndebug1: auto-mux: Trying existing master\\r\\ndebug1: mux_client_request_session: master session id: 2\\r\\nShared connection to ops9.sjc.opendns.com closed.\\r\\n\",\r\n    \"parsed\": false\r\n}\r\n```\r\n\r\n##### Fix:\r\n\r\nThis has been fixed in the 2.0 branch through the 28c933ce commit.\r\nA backport of the commit to the 1.9 branch would fix the issue, hopefully in next `1.9.5` release.\r\n\r\n##### Workaround:\r\n\r\nThe workaround is to disable SSL certificates validation with `validate_certs=false`."},"comment":{"url":"https://api.github.com/repos/ansible/ansible/issues/comments/167991411","html_url":"https://github.com/ansible/ansible/issues/13478#issuecomment-167991411","issue_url":"https://api.github.com/repos/ansible/ansible/issues/13478","id":167991411,"user":{"login":"Trane9991","id":9948629,"avatar_url":"https://avatars.githubusercontent.com/u/9948629?v=3","gravatar_id":"","url":"https://api.github.com/users/Trane9991","html_url":"https://github.com/Trane9991","followers_url":"https://api.github.com/users/Trane9991/followers","following_url":"https://api.github.com/users/Trane9991/following{/other_user}","gists_url":"https://api.github.com/users/Trane9991/gists{/gist_id}","starred_url":"https://api.github.com/users/Trane9991/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Trane9991/subscriptions","organizations_url":"https://api.github.com/users/Trane9991/orgs","repos_url":"https://api.github.com/users/Trane9991/repos","events_url":"https://api.github.com/users/Trane9991/events{/privacy}","received_events_url":"https://api.github.com/users/Trane9991/received_events","type":"User","site_admin":false},"created_at":"2015-12-30T12:48:19Z","updated_at":"2015-12-30T12:48:19Z","body":"Can't download docker binary from official website with SSL error\r\n```\r\nansible -i \"localhost,\" all -m get_url -a \"url=https://get.docker.com/builds/Linux/x86_64/docker-latest dest=/tmp/docker\" -c local\r\nlocalhost | FAILED >> {\r\n    \"failed\": true,\r\n    \"msg\": \"Failed to validate the SSL certificate for get.docker.com:443. Make sure your managed systems have a valid CA certificate installed.  If the website serving the url uses SNI you need python >= 2.7.9 on your managed machine.  You can use validate_certs=False if you do not need to confirm the server\\\\s identity but this is unsafe and not recommended Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs, /usr/share/ca-certificates/cacert.org, /etc/ansible\"\r\n}\r\n```\r\nor \r\n\r\n```\r\nansible -i \"localhost,\" all -m get_url -a \"url=https://get.docker.com/builds/Linux/x86_64/docker-latest dest=/tmp/docker validate_certs=false\" -c local\r\nlocalhost | FAILED >> {\r\n    \"dest\": \"/tmp/docker\",\r\n    \"failed\": true,\r\n    \"msg\": \"Request failed\",\r\n    \"response\": \"Request failed: <urlopen error [Errno 1] _ssl.c:510: error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure>\",\r\n    \"state\": \"absent\",\r\n    \"status_code\": -1,\r\n    \"url\": \"https://get.docker.com/builds/Linux/x86_64/docker-latest\"\r\n}\r\n```\r\nansible version:\r\n```\r\nansible --version\r\nansible 1.9.4\r\n```\r\npython version:\r\n```\r\npython -V\r\nPython 2.7.6\r\n```\r\n\r\n"}}