Running test_create_object_with_expect_continue got ssh error

[zhufl]

1.Problem
Running test_create_object_with_expect_continue got ssl error:
 File "/tempest/lib/services/object_storage/object_client.py", line 144, in create_object_continue
    conn.endheaders()
  File "/usr/local/python3/lib/python3.8/http/client.py", line 1225, in endheaders
    self._send_output(message_body, encode_chunked=encode_chunked)
  File "/usr/local/python3/lib/python3.8/http/client.py", line 1004, in _send_output
    self.send(msg)
  File "/usr/local/python3/lib/python3.8/http/client.py", line 944, in send
    self.connect()
  File "/usr/local/python3/lib/python3.8/http/client.py", line 1399, in connect
    self.sock = self._context.wrap_socket(self.sock,
  File "/usr/local/python3/lib/python3.8/ssl.py", line 500, in wrap_socket
    return self.sslsocket_class._create(
  File "/usr/local/python3/lib/python3.8/ssl.py", line 1040, in _create
    self.do_handshake()
  File "/usr/local/python3/lib/python3.8/ssl.py", line 1309, in do_handshake
    self._sslobj.do_handshake()
ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: unable to get local issuer certificate (_ssl.c:1108)

Setting tempest.conf -> identity.disable_ssl_certificate_validation = True has no effect

2.Analysis
create_object_continue interface uses its own httplib.HTTPSConnection, and when creating httplib.HTTPSConnection, it doesn't have a look at CONF.identity.disable_ssl_certificate_validation.

3.Solution
When creating httplib.HTTPSConnection, CONF.identity.disable_ssl_certificate_validation should be taken into account.

[Martin Kopec (mkopec)]

https://review.opendev.org/c/openstack/tempest/+/766658

[Martin Kopec (mkopec)]

Hi zhufl do you think https://bugs.launchpad.net/tempest/+bug/1542278 is related to this bug? Or maybe that https://bugs.launchpad.net/tempest/+bug/1542278 is addressed by https://review.opendev.org/c/openstack/tempest/+/766658 as well?

[zhufl (zhu-fanglei)]

I don't know what does "Tempest should fail with a nice SSL message" mean.

If this bug is fixed, then the behaviour is:
"if disable_ssl_certificate_validation = true, whether a ca_certificates_file is given or not, Tempest should pass".

So is that ok?

[Martin Kopec (mkopec)]

The 1542278 is not related to this and based on my testing is not relevant anymore.

Speaking about this bug, the fix looks ok to me, I already gave +2.

[Ghanshyam Mann (ghanshyammann)]

yeah we need to disable the ssl verifixcation for disable_ssl_certificate_validation = true

[Martin Kopec (mkopec)]

https://review.opendev.org/c/openstack/tempest/+/766658 got merged

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/tempest 26.1.0 release.