[dev.icinga.com #10714] API is not working on wheezy #3705

icinga-migration · 2015-11-23T21:39:07Z

This issue has been migrated from Redmine: https://dev.icinga.com/issues/10714

Created by rjunich on 2015-11-23 21:39:07 +00:00

Assignee: jflach
Status: Resolved (closed on 2016-01-11 14:45:04 +00:00)
Target Version: 2.4.2
Last Update: 2016-02-23 09:58:20 +00:00 (in Redmine)

Icinga Version: 2.4.0-1
Backport?: Already backported
Include in Changelog: 1

The api in version 2.4.0-1~debmon70+1 of icinga2 on a freshly install debian wheezy does not answer any requests.
The api feature was enabled as described in https://github.com/Icinga/icinga2/blob/master/doc/9-icinga2-api.md however when sending a request to the API nothing comes back.

The behaviour is the same whether the apiuser is configured or not.
Tests with a second node showed, that the nodes can communicate with each other.

Attachments

non_root.txt louisgab - 2015-11-30 14:32:53 +00:00

Changesets

2015-12-18 15:03:57 +00:00 by jflach 043abc6

Test openssl base64

refs #10714

2016-01-05 17:00:21 +00:00 by jflach 90dbc5c

Test openssl base64

It works

refs #10714

2016-01-11 08:49:39 +00:00 by jflach 3abeb02

Replace boost-base64 with an openssl implementation

refs #10714

2016-01-11 14:35:20 +00:00 by jflach 957cf31

Replace boost-base64 with an openssl implementation

Also add unit tests

fixes #10714

2016-02-23 08:57:18 +00:00 by jflach 0a6f15c

Replace boost-base64 with an openssl implementation

Also add unit tests

fixes #10714

Relations:

relates #10666

The text was updated successfully, but these errors were encountered:

icinga-migration · 2015-11-23T22:09:13Z

Updated by mfriedrich on 2015-11-23 22:09:13 +00:00

Status changed from New to Feedback
Assigned to set to rjunich

Please clarify on "does not answer any requests". Run curl in verbose mode, trace the logs and attach their output here. Furthermore post your apiuser with obfuscated password.

icinga-migration · 2015-11-24T08:54:09Z

Updated by rjunich on 2015-11-24 08:54:09 +00:00

Hi dnsmichi,

the output of curl in verbose mode:

 curl -v -k -s -u root:icinga 'https://localhost:5665/v1'
* About to connect() to localhost port 5665 (#0)
*   Trying 127.0.0.1...
* connected
* Connected to localhost (127.0.0.1) port 5665 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Request CERT (13):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES256-SHA
* Server certificate:
*        subject: CN=XXXXXXXXXX
*        start date: 2015-11-20 09:25:26 GMT
*        expire date: 2030-11-16 09:25:26 GMT
*        issuer: CN=Icinga CA
*        SSL certificate verify result: self signed certificate in certificate chain (19), continuing anyway.
* Server auth using Basic with user 'root'
> GET /v1 HTTP/1.1
> Authorization: Basic cm9vdDppY2luZ2E=
> User-Agent: curl/7.26.0
> Host: localhost:5665
> Accept: */*
>

...and then it just hangs.

The apiuser config is just a copy of the documentation:

object ApiUser "root" {
  password = "icinga"
}

The icinga2.log shows the following, when trying to connect with curl:

[2015-11-24 09:50:09 +0100] information/ApiListener: New client connection (no client certificate)

icinga-migration · 2015-11-24T18:24:04Z

Updated by louisgab on 2015-11-24 18:24:04 +00:00

Issue similar to 10666 (https://dev.icinga.org/issues/10666)

icinga-migration · 2015-11-25T12:36:36Z

Updated by rjunich on 2015-11-25 12:36:36 +00:00

Further experimenting showed, that it is possible to use the API if the password for the ApiUser is a single character:

object ApiUser "root" {
  password = "i"
}

icinga-migration · 2015-11-26T06:49:26Z

Updated by gbeutner on 2015-11-26 06:49:26 +00:00

Relates set to 10666

icinga-migration · 2015-11-26T06:50:15Z

Updated by gbeutner on 2015-11-26 06:50:15 +00:00

Can you attach gdb to Icinga 2 while one of the API calls is hanging? Please attach the output of "thread apply all bt full".

icinga-migration · 2015-11-26T09:28:29Z

Updated by rjunich on 2015-11-26 09:28:29 +00:00

Hi,

not sure if the following is what you wanted. Let me know if there is anything else you need.

Thread 18 (Thread 0x7ff66eb93700 (LWP 27116)):

#0  0x00007ff673b8c344 in pthread_cond_wait@@GLIBC_2.3.2 () from /lib/x86_64-linux-gnu/libpthread.so.0