Access to https:// branch with pycurl without SSL support fails horribly

[Alexander Belchenko]

cURL library and PyCurl could be built in 2 forms: with SSL or without
such support. Old version (<0.14) of standalone bzr.exe bundle inside
pycurl library without SSL support and therefore access to https://
branch fails with ugly traceback:

Traceback (most recent call last):
  File "bzrlib\commands.pyc", line 623, in run_bzr_catch_errors
  File "bzrlib\commands.pyc", line 585, in run_bzr
  File "bzrlib\commands.pyc", line 291, in run_argv_aliases
  File "bzrlib\commands.pyc", line 595, in ignore_pipe
  File "bzrlib\builtins.pyc", line 1373, in run
  File "bzrlib\bzrdir.pyc", line 525, in open_containing
  File "bzrlib\bzrdir.pyc", line 546, in open_containing_from_transport
  File "bzrlib\bzrdir.pyc", line 504, in open_from_transport
  File "bzrlib\bzrdir.pyc", line 1054, in find_format
  File "bzrlib\bzrdir.pyc", line 1064, in probe_transport
  File "bzrlib\transport\http\__init__.pyc", line 230, in get
  File "bzrlib\transport\http\_pycurl.pyc", line 116, in _get
  File "bzrlib\transport\http\_pycurl.pyc", line 151, in _get_full
  File "bzrlib\transport\http\_pycurl.pyc", line 233, in _curl_perform
error: (1, 'libcurl was built with SSL disabled, https: not supported!')

bzr 0.12.0 on python 2.4.4.final.0 (win32)
arguments: ['D:\\Bazaar\\releases\\bzr-0.12\\win32_bzr.exe\\bzr.exe', 'log', 'https://launchpad.net/bzr-config']

Because user could has any version of pycurl, bzr should explicitly check
for presence of SSL support. This check could be done via version string
of pycurl. String version (pycurl.version) has full info about built-in
libraries. E.g.:

PyCurl: libcurl/7.13.2
vs.
PyCurl: libcurl/7.15.5 OpenSSL/0.9.8c zlib/1.2.3 c-ares/1.3.1

So bzr should use check as following:

import pycurl
version = pycurl.version
if 'SSL' in version:
 register_transport('https+pycurl://', ...)

[James Westby (james-w)]

On (15/02/07 10:32), Alexander Belchenko wrote:
> Public bug reported:
>
> cURL library and PyCurl could be built in 2 forms: with SSL or without
> such support. Old version (<0.14) of standalone bzr.exe bundle inside
> pycurl library without SSL support and therefore access to https://
> branch fails with ugly traceback:
>
>
> Because user could has any version of pycurl, bzr should explicitly check
> for presence of SSL support. This check could be done via version string
> of pycurl. String version (pycurl.version) has full info about built-in
> libraries. E.g.:
>
> PyCurl: libcurl/7.13.2
> vs.
> PyCurl: libcurl/7.15.5 OpenSSL/0.9.8c zlib/1.2.3 c-ares/1.3.1
>
> So bzr should use check as following:
>
> import pycurl
> version = pycurl.version
> if 'SSL' in version:
> register_transport('https+pycurl://', ...)
>

I like the idea, but the fix isn't quite general enough.

  >>> print pycurl.version
  libcurl/7.15.5 GnuTLS/1.4.4 zlib/1.2.3 libidn/0.6.5

so "'SSL' in version or 'TLS'" should be sufficient I think.

I have no idea how to write a test for this though.

Thanks,

James

--
  James Westby -- GPG Key ID: B577FE13 -- http://jameswestby.net/
  seccure key - (3+)k7|M*edCX/.A:n*N!>|&7U.L#9E)Tu)T0>AM - secp256r1/nistp256

[Vincent Ladeuil (vila)]

vila:~/src :( $ python
Python 2.4.4c1 (#2, Oct 11 2006, 21:51:02)
[GCC 4.1.2 20060928 (prerelease) (Ubuntu 4.1.1-13ubuntu5)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import pycurl
>>> print pycurl.version_info()
(2, '7.15.4', 462596, 'i486-pc-linux-gnu', 1581, 'GnuTLS/1.4.0', 0, '1.2.3', ('tftp', 'ftp', 'telnet', 'dict', 'ldap', 'http', 'file', 'https', 'ftps'), None, 0, '0.6.3')
>>> print pycurl.version_info()[7]
1.2.3
>>> print pycurl.version_info()[8]
('tftp', 'ftp', 'telnet', 'dict', 'ldap', 'http', 'file', 'https', 'ftps')

info(7) is ssl_version_num, 0 if not available (documented).

info(8) should not contain https if ssl not available (my guess).

I can't test that on windows right now, but that seems more reliable that guessing from the human-readable pycurl.version

Hth

[Alexander Belchenko (bialix)]

pycurl.version_info() make sense for me.
Here on my windows box:

In [22]: pycurl.version_info()
Out[22]:
(2,
 '7.15.5',
 462597,
 'i386-pc-win32',
 668,
 'OpenSSL/0.9.8c',
 0,
 '1.2.3',
 ('tftp', 'ftp', 'telnet', 'dict', 'ldap', 'http', 'file', 'https', 'ftps'),
 '1.3.1',
 66305,
 None)

Tomorow I'll check with old pycurl library without SSL.

[Vincent Ladeuil (vila)]

version_info()[4] may provide some finer-grained info too as documented at http://curl.haxx.se/libcurl/c/curl_version_info.html

[Alexander Belchenko (bialix)]

version_info()[8] from the URL is the list of supported protocols. So probably check:
'https' in pycurl.version_info()[8]
should be enough.

[Alexander Belchenko (bialix)]

Here version_info for pycurl without SSL.

In [2]: pycurl.version_info()
Out[2]:
(2,
 '7.13.2',
 462082,
 'i386-pc-win32',
 2576,
 None,
 0,
 None,
 ('ftp', 'gopher', 'telnet', 'dict', 'ldap', 'http', 'file'),
 None,
 0,
 None)

[Vincent Ladeuil (vila)]

Sweet ;)

Using this to install or not the https protocol would as be clean as one can dream !

Let me know if you want help on that .

[Alexander Belchenko (bialix)]

vila пишет:
> Sweet ;)
>
> Using this to install or not the https protocol would as be clean as one
> can dream !
>
> Let me know if you want help on that .

In current version bzr this transport is registered lazily without any check
of PyCurl presence at all. So I really don't know how to register https+pycurl://
conditionally.

--
Alexander

[Vincent Ladeuil (vila)]

That should do it.

Can you test it Alexander ?

[Alexander Belchenko (bialix)]

vila пишет:
> That should do it.
>
> Can you test it Alexander ?
>
> ** Attachment added: "Fix by issuing a DependencyNotPresent exception"
> http://librarian.launchpad.net/6462292/bzr.85305.patch

Tested on my Win2K + Python2.4 + Pycurl 7.13.2 without SSL support.
With your patch bzr effectively switch to urllib implementation
without any warning or traceback.

Your patch is OK for me. +1.

--
Alexander