Error during adding Repository to SSL enabled perforce.

[chuck j]

Dear All,

This is very critical, I am still not able to add SSL enabled perforce repository to reviewboard, Please help me.

Since my machine was not having openssl 1.0.1, i need to build and install this version of openssl.

I followed the instruction from document, downloaded openssl 1.0.1e

./config --prefix=/usr/local --openssldir=/usr/local/openssl zlib zlib-dynamic shared
make
make test
make install

Then i did following step

Edit /etc/ld.so.conf

add to paths...
/usr/local/lib64

Update the run-time linker...
# ldconfig

verified with below command:

ldd /usr/local/bin/openssl
        libssl.so.1.0.0 => /usr/local/lib64/libssl.so.1.0.0 (0x00002b08a088c000)
        libcrypto.so.1.0.0 => /usr/local/lib64/libcrypto.so.1.0.0 (0x00002b08a0af1000)
        libdl.so.2 => /lib64/libdl.so.2 (0x0000003b2ac00000)
        libc.so.6 => /lib64/libc.so.6 (0x0000003b2a400000)
        /lib64/ld-linux-x86-64.so.2 (0x0000003b2a000000)


/usr/local/bin/openssl version

OpenSSL 1.0.1e 11 Feb 2013


Then I build p4python with --ssl swtich.

python setup.py build --apidir /root/work/src/p4api-2012.2.585708 --ssl /usr/local/lib64

API Release 2012.2
running build
running build_py
creating build
creating build/lib.linux-x86_64-2.7
copying P4.py -> build/lib.linux-x86_64-2.7
running build_ext
building 'P4API' extension
creating build/temp.linux-x86_64-2.7
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c P4API.cpp -o build/temp.linux-x86_64-2.7/P4API.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonClientAPI.cpp -o build/temp.linux-x86_64-2.7/PythonClientAPI.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonClientUser.cpp -o build/temp.linux-x86_64-2.7/PythonClientUser.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c SpecMgr.cpp -o build/temp.linux-x86_64-2.7/SpecMgr.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c P4Result.cpp -o build/temp.linux-x86_64-2.7/P4Result.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonMergeData.cpp -o build/temp.linux-x86_64-2.7/PythonMergeData.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c P4MapMaker.cpp -o build/temp.linux-x86_64-2.7/P4MapMaker.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonSpecData.cpp -o build/temp.linux-x86_64-2.7/PythonSpecData.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonMessage.cpp -o build/temp.linux-x86_64-2.7/PythonMessage.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonActionMergeData.cpp -o build/temp.linux-x86_64-2.7/PythonActionMergeData.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
gcc -pthread -fno-strict-aliasing -g -O2 -DNDEBUG -g -fwrapv -O3 -Wall -Wstrict-prototypes -fPIC -DID_OS="LINUX26X86_64" -DID_REL="2012.2" -DID_PATCH="549493" -DID_API="2012.2/585708" -DID_Y="2012" -DID_M="11" -DID_D="05" -I/root/work/src/p4api-2012.2.585708 -I/root/work/src/p4api-2012.2.585708/include/p4 -I/usr/local/include/python2.7 -c PythonClientProgress.cpp -o build/temp.linux-x86_64-2.7/PythonClientProgress.o -DOS_LINUX -DOS_LINUX26 -DOS_LINUXX86_64 -DOS_LINUX26X86_64
cc1plus: warning: command line option "-Wstrict-prototypes" is valid for Ada/C/ObjC but not for C++
g++ -pthread -shared build/temp.linux-x86_64-2.7/P4API.o build/temp.linux-x86_64-2.7/PythonClientAPI.o build/temp.linux-x86_64-2.7/PythonClientUser.o build/temp.linux-x86_64-2.7/SpecMgr.o build/temp.linux-x86_64-2.7/P4Result.o build/temp.linux-x86_64-2.7/PythonMergeData.o build/temp.linux-x86_64-2.7/P4MapMaker.o build/temp.linux-x86_64-2.7/PythonSpecData.o build/temp.linux-x86_64-2.7/PythonMessage.o build/temp.linux-x86_64-2.7/PythonActionMergeData.o build/temp.linux-x86_64-2.7/PythonClientProgress.o -L/root/work/src/p4api-2012.2.585708 -L/root/work/src/p4api-2012.2.585708/lib -L/usr/local/lib64 -L/usr/local/lib -lclient -lrpc -lsupp -lssl -lcrypto -lrt -lpython2.7 -o build/lib.linux-x86_64-2.7/P4API.so


-----

python setup.py install --apidir /root/work/src/p4api-2012.2.585708 --ssl /usr/local/lib64
API Release 2012.2
running install
running build
running build_py
running build_ext
running install_lib
copying build/lib.linux-x86_64-2.7/P4API.so -> /usr/local/lib/python2.7/site-packages
running install_egg_info
Removing /usr/local/lib/python2.7/site-packages/p4python-2012.2.549493-py2.7.egg-info
Writing /usr/local/lib/python2.7/site-packages/p4python-2012.2.549493-py2.7.egg-info

-----

I tested with by connecting to ssl enabled perforce server. here are the steps.

[GCC 4.1.2 20080704 (Red Hat 4.1.2-46)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import P4
>>> p4=P4.P4(client="myclient", port="ssl:p4-server:19773")
>>> print p4
P4 [root@myclient ssl:p4-perforce:19773] disconnected
>>> p4.connect()
P4 [root@myclient ssl:p4-perforce:19773] connected

Then i try to add this repository through reviewboard admin panel, i am getting this error message

 Please correct the error below.

    The specified Perforce port includes ssl:, but the p4python library was built without SSL support or the system library path is incorrect.

Do you still see any issue with p4python build and install.

If i am able to connect ssl enabled perforce server through python using P4 then, I guess reviewboard API should also be working accordingly, please advice me what should be the issue here. This SSL feature is holding my whole setup to complete.

Please help to resolve this issue.

let me know if you need any other log.

-Chuck.

[Christian Hammond]

Is Review Board using the same version of Python? Any chance there are now two copies of p4python installed?

Christian

--
Want to help the Review Board project? Donate today at http://www.reviewboard.org/donate/
Happy user? Let us know at http://www.reviewboard.org/users/
-~----------~----~----~----~------~----~------~--~---
To unsubscribe from this group, send email to reviewboard...@googlegroups.com
For more options, visit this group at http://groups.google.com/group/reviewboard?hl=en
---
You received this message because you are subscribed to the Google Groups "reviewboard" group.
To unsubscribe from this group and stop receiving emails from it, send an email to reviewboard...@googlegroups.com.
For more options, visit https://groups.google.com/groups/opt_out.
 
 

[chuck j]

Hi Chris,

Reviewboard is using the same version of python for which i have provided example as below

[GCC 4.1.2 20080704 (Red Hat 4.1.2-46)] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import P4

There are no Two version of p4python installed, how do i figure it out. i can see my site-packages contains following files after p4python build and install i.e P4.py, P4.pyc, P4.pyo, P4API.so

[chuck j]

Here are some more information:

I can see there was old P4Python-2008.2-py2.7.egg-info file present at site-packages folder, But i had make sure this version's P4.py, P4.pyc, P4.pyo, P4API.so are moved to some safe place. Will this file make any difference.

cat easy-install.pth

import sys; sys.__plen = len(sys.path)
./setuptools-0.6c11-py2.7.egg
./python_memcached-1.47-py2.7.egg
./recaptcha_client-1.0.6-py2.7.egg
./python_dateutil-1.5-py2.7.egg
./flup-1.0.3.dev_20110405-py2.7.egg
./PIL-1.1.6-py2.7-linux-x86_64.egg
./python_ldap-2.3.13-py2.7-linux-x86_64.egg
./MySQL_python-1.2.3-py2.7-linux-x86_64.egg
./ReviewBoard-1.7.6-py2.7.egg
./pytz-2013b-py2.7.egg
./Pygments-1.6-py2.7.egg
./paramiko-1.10.0-py2.7.egg
./mimeparse-0.1.3-py2.7.egg
./Markdown-2.3.1-py2.7.egg
./docutils-0.10-py2.7.egg
./django_pipeline-1.2.24-py2.7.egg
./Djblets-0.7.11-py2.7.egg
./django_evolution-0.6.9-py2.7.egg
./Django-1.4.5-py2.7.egg
./pycrypto-2.6-py2.7-linux-x86_64.egg
./feedparser-5.1.3-py2.7.egg
import sys; new=sys.path[sys.__plen:]; del sys.path[sys.__plen:]; p=getattr(sys,'__egginsert',0); sys.path[p:p]=new; sys.__egginsert = p+len(new)

[Christian Hammond]

Yeah, it's possible it's grabbing that one instead.

If p4python is successfully built using OpenSSL, the only thing I can think of to cause that error would be Review Board using an older copy somehow.

Where's the new P4.* files?

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

All the P4 files present at /usr/local/lib/python2.7/site-packages

[chuck j]

Sorry for multiple mails but i have no option to fetch help from you expect.

How to make review board point to new P4API.so

I have noticed that after p4python build it generates library libssl.so.1.0.0, I googled it and could not found any relevant answer but i guess that's the expected behavior.

Its seems review board reporting the below message.
P4.connect()] Connect to server failed; check $P4PORT. SSL library must be at least version 1.0.1.

now that i have deleted the older version P4.* files, still i no success.

-Chuck

[Christian Hammond]

These e-mails keep ending up directed to me. Let's be sure they're all on the mailing list.

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

On Apr 9, 2013, at 12:05 AM, Christian Hammond <chi...@chipx86.com> wrote:

Sorry, but what generates libssl.so?

Just to be sure, did you restart Apache before adding a repository?

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

On Apr 8, 2013, at 11:09 PM, chuck j <cjerr...@gmail.com> wrote:

Ok All the P4.* files are present in

/usr/local/lib/python2.7/site-packages

The libssl.so placed at /usr/local/lib64/libcrypto.so /usr/local/lib64/libssl.so

Do i need to do some manually changes in reviewboard setting which should pick correct P4API.so

[chuck j]

As i said since my machine was not having openssl1.0.1 installed, hence we need to build openssl first from source which gets installed at /usr/local/ where these libssl.so gets placed at /usr/local/lib64 and its link also gets created with the name libcrypto.so.1.0.0,  libssl.so.1.0.0

I restarted my Apache before adding the repository, its seems review board when try to perform p4.connect and it couldn't per that steps and reports errors.

If am able to perform p4.connect from outside, which P4API.so does review board referring to.

[Christian Hammond]

In that case, do you then have both OpenSSL 1.0.0 and 1.0.1 on the same system? It could be that, when run from Apache, the version in /usr/local isn't being used. You should try backing up the one in /usr/lib and /usr/lib/64, then symlinking to the new ones.

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

In my linux box i am having below /usr/lib and /usr/lib64

libssl.so.0.9.7a
libssl.so.0.9.8e

but after my openssl build i only got libssl.so.1.0.0 and it got placed in /usr/local/lib64/ i do not see any libssl.so in /usr/local/lib so I am not sure which one Apache is referring

Are there any tweak in Apache side.

After manipulating with libssl symlink restarted apache but the results is not different.

[Christian Hammond]

Hi,

If libssl.so.1.0.0 is in your /usr and not /usr/local, and p4python is compiled against it, I'd expect it to work. At this point, I don't know what's wrong and, without having access to the system, couldn't diagnose it well enough. I'll think about it more, but unfortunately you're in the best position to solve it at this point. Something is clearly wrong.

The error you saw us display is keyed off from an error p4python gives us, which directly tell us that an invalid version of OpenSSL is being used with p4python. So something is wrong there, it seems.

Something you can try, in order to see if it's related to Apache or not, is to run the development server by doing:

    $ rb-site manage /path/to/site runserver 0.0.0.0:8080

And then connect to servername:8080 and try to add the repository. If you get the same error, it's not specific to the version being run in Apache.

It's past 3AM here, so I have to call it a night. Sorry I don't have a solution for you.

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

Thank you for the response.

I followed your advise and here is the output,

During start of development server:

Validating models...

/usr/local/lib/python2.7/site-packages/pycrypto-2.6-py2.7-linux-x86_64.egg/Crypto/Util/number.py:57: PowmInsecureWarning: Not using mpz_powm_sec.  You should rebuild using libgmp >= 5 to avoid timing attack vulnerability.
0 errors found

Output of development server console log. I got this message when i click add button only once and subsequent attempt to add the repository, i have not seen this message.

[09/Apr/2013 11:07:48] "GET /svrrb/static/rb/js/base.min.655a933ac4b2.js HTTP/1.1" 404 1970
/usr/local/lib/python2.7/site-packages/P4.py:642: UserWarning: P4.connect() - Perforce client already connected!
  P4API.P4Adapter.connect( self )
[09/Apr/2013 11:08:35] "POST /svrrb/admin/db/scmtools/repository/add/ HTTP/1.1" 200 9760
[09/Apr/2013 11:08:36] "GET /svrrb/admin/db/jsi18n/ HTTP/1.1" 200 626


but In the web console i saw this message

 Please correct the error below.

    [P4.run()] not connected.

Also i do not see any other message in server console which i can share. Do you see expected behavior.

Thanks again.

- Chuck

You received this message because you are subscribed to a topic in the Google Groups "reviewboard" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/reviewboard/PIyF753iuKI/unsubscribe?hl=en.
To unsubscribe from this group and all its topics, send an email to reviewboard...@googlegroups.com.

[chuck j]

I added few debug statements in before and after self.p4.connect() calls in scmtools/perforce.py, surprising to see when we run the development server we can see a message which i added but those message are getting displayed in normal execution of reviewboard.log, but thats not the issue here.

Its seems while running development server we got some more information as below.

self.connect() succeed. But as self.use_ticket_auth flag is False, even after selecting checkbox "ticket based auth" don't know how to make it enable, 

hence its not executing self.p4.run_login(), I tried commented self.use_ticket_auth if statement 
so that it should get execute self.p4.run_login statement but it still not working as expected.

Since my user to connect to perforce repository is LDAP does reviewboard server takes care of the users.?

14:46:49	INFO	Port is ssl:p4-perforce:19773
14:46:49	DEBUG	Trying to connect
14:46:49	DEBUG	The connection is P4 [user@svrrb1 ssl:p4-perforce:19773] connected
14:46:49	DEBUG	Auth value: False

               INFO MyException: [P4.run()] not connected.

So its connecting, but somehow exception part of the code gets executed, what i was expecting it should show me same message "SSL library must be at least version" but it says P4.run() not connected.

The code marked in red are not getting executed. As its caught exception and runs except part of the code. Don't whether its ssl issue sue apache which uses p4python issue.

    def _run_worker(self, worker):
        result = None

        # TODO: Move to using with: when we require a minimum of Python 2.5.
        #       We should make it auto-disconnect.
        try:
            logging.debug("I am in try statement")
            self._connect()
            result = worker()
            logging.info("My results: %s" % result)
            self._disconnect()
        except P4Exception, e:
            self._disconnect()
            logging.info("Exception: %s" % e)
            self._convert_p4exception_to_scmexception(e)
        except:
            self._disconnect();
            raise

        return result

Outside review board in python shell p4python module works fine.

help needed ...:(

[chuck j]

Dear All,

Do you see any issue?

-Chuck.

[Christian Hammond]

Hi Chuck,

I see the e-mail, but I can't give you a solution. I can't diagnose it over e-mail, and it's clear that something is busted with the p4python setup or some configuration.

Can you write a command-line script that connects to your server with SSL and performs some operation using p4.run? The first step now is making sure that works.

Since that didn't give you the SSL version error when using runserver, I think you have two versions of openssl being used on the system. You might have to add debugging to p4python's code to see what version it's finding.

Christian

--
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

here are the script output.

>>> import P4
>>> p4 = P4.P4()
>>> p4.port = "ssl:p4-perforce:19773"
>>> p4.user="user"
>>> p4.password="password"
>>> p4.connect()
P4 [user@scrrb1 ssl:p4- perforce:19773] connected
>>> info = p4.run("info")
>>> print info

[{'userName': 'user', 'serverUptime': '146:10:11', 'caseHandling': 'sensitive', 'clientCwd': '/usr/lib64', 'monitor': 'enabled', 'integEngine': '2', 'peerAddress': '##########:57175', 'serverVersion': 'P4D/LINUX26X86_64/2012.2/585708 (2013/02/01)', 'serverRoot': '/PFMETA/p4root', 'serverCertExpires': 'Apr  2 01:37:10 2015 GMT', 'serverEncryption': 'encrypted', 'serverDate': '2013/04/09 23:36:23 -0700 PDT', 'changeServer': '######:1666', 'serverLicense-ip': '#######:19773', 'clientAddress': '######', 'serverLicense': SVR Software Corporation 1 users (support ends 2014/02/06) ', 'serverAddress': 'p4-perforce:19773', 'externalAuth': 'enabled', 'clientHost': 'svrrb1.na.software.com', 'security': 'enabled', 'clientName': '*unknown*'}]

I also added print statement in P4.py in run() function it also return me the same output.

[chuck j]

As you also mentioned that if we install openssl in /usr it should work. Which i installed but the results are not different. :(.

Could you please help me with steps, if we want to migrate reviewboard database and application to new server CentOS. Does migration of database is supported?

is it possible if we install reviewbaord application on new server and migrate the database to new server to avoid data loss.

[Christian Hammond]

Assuming the version of Review Board is the same, you should be able to just copy the database over (generally doing a database dump to SQL, via mysqldump or something, and then an import into the new database), and copy over the site directory, after you install Review Board on the new server.

Christian

--
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

Thanks Chris,

I want to keep migration of RB to new server as an alternate option, But do you see any issue from script output i provided?

As my review board is version 1.7.6 and i want to downgrade it to 1.7.5 how to this?

[Christian Hammond]

There's nothing in any of the script output that can tell me enough to tell you what's wrong. Again, without access to the server, all I can do is guess, and I'm out of guesses.

I wouldn't recommend downgrading, as we don't really support that. Why do you want to downgrade?

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

if you noticed, I mentioned about "Use ticket-based authentication" Earlier this option was not there so we used to enter ticket in the password field instead of actual password, and thing working for us, Now i don't know the purpose of this option. Also even if i select the check box, but in the log i can this flag is always set to False, why?

Please correct me, if i select this checkbox the flag should be true, right?

[Christian Hammond]

Since a ticket may change from time to time, not everyone was happy having to enter the ticket themselves. That checkbox will do it automatically. However, if you feel more comfortable doing what you've been doing, simply don't check it.

I'm not sure what you were saying with "Even if I select the check box.."

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

I meant in 1.7.6 i have seen check box "Use ticket-based authentication" so after entering my username and password i was to select that box, So i tried to print those flag value in log but every time variable self.use_ticket_auth prints me False.

[chuck j]

Hi Chris,

Sorry to bother you again, but I feel you can help me better.

Just curious to ask this question.

We have paramiko package installed with reviewboard, Is it possible that this paramiko using ssh which is still referring to old version of ssl library and not the new openssl and due to this its reporting  Do i also need to upgrade ssh lib and binaries.

[P4.run()] not connected

-Chuck

[Christian Hammond]

Hi Chuck,

We use Paramiko for general SSH (not SSL)-based repository checks for Subversion, Git, and a couple others. However, it's not used at all for Perforce.

Christian

-- 
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

Thanks appreciated, At least now i should not worried about build openssh now.

[chuck j]

Hi Chris,

I just noticed that self.p4.connect() works well when i remove the "ssl" prefix while adding repository of my ssl enable perforce server, but later when it tries to perform worker() i.e self.p4.info it fails with message

[P4.run()] not connected.

But if we add ssl prefix it didn't even connect and reports.

[P4.connect()] Connect to server failed; check $P4PORT. SSL library must be at least version 1.0.1.

To confirm if the reviewboard refering correct version of P4 module i added a line after "import P4"

module=__import__("P4") it gave <module 'P4' from '/usr/local/lib/python2.7/site-packages/P4.pyc'> which is correct module reference.

Do you see any security issues on the reviewboard server which restricting reviewboard server to connect and communicate with ssl enabled perforce server.

here is the ldd output

ldd /usr/local/lib/python2.7/site-packages/P4API.so
        libssl.so.1.0.0 => /usr/local/lib64/libssl.so.1.0.0 (0x00002b66e1734000)
        libcrypto.so.1.0.0 => /usr/local/lib64/libcrypto.so.1.0.0 (0x00002b66e1999000)
        librt.so.1 => /lib64/librt.so.1 (0x00002b66e1d5e000)
        libpython2.7.so.1.0 => /usr/local/lib/libpython2.7.so.1.0 (0x00002b66e1f68000)
        libstdc++.so.6 => /usr/lib64/libstdc++.so.6 (0x00002b66e2332000)
        libm.so.6 => /lib64/libm.so.6 (0x00002b66e2632000)
        libgcc_s.so.1 => /lib64/libgcc_s.so.1 (0x00002b66e28b6000)
        libpthread.so.0 => /lib64/libpthread.so.0 (0x00002b66e2ac4000)
        libc.so.6 => /lib64/libc.so.6 (0x00002b66e2cdf000)
        libdl.so.2 => /lib64/libdl.so.2 (0x00002b66e3037000)
        /lib64/ld-linux-x86-64.so.2 (0x0000003b2a000000)
        libutil.so.1 => /lib64/libutil.so.1 (0x00002b66e323b000)

just to let you know my selinux flag is disable.

-Chuck

[chuck j]

its looks like older version of libssl installed on the machine for which apache is configure, when Apache is started it loaded the older version libssl, So even though newer version libssl1.0.1 is installed its still looks for older version of libssl which, i think causing reviewboard application not allowing to work as expected. even though we see its referring our newer version of P4.py still not working and reports perforce server not connected.

We have verified the machine and we haven't saw any other version of p4python installed apart from the newer build and install.

We taken a backup and older libssl.so and tried to symlink to newer and during starting the apache it reports "Segmentation fault"


Do you see Apache using older version of libssl.so would causing this issue.?

[chuck j]

Hi Chris,

I think i am coming close to adding ssl enabled repository.

As you suggested i started the development server, and try to add repository.

Its seems review board passes following steps.

All the steps in self._connect() which was missing till now, atleast i am not getting error message as below, i hope this will not show on normal server running.

The specified Perforce port includes ssl:, but the p4python library was built without SSL support or the system library path is incorrect.

But while running result = worker() i.e p4 info its reporting

Exception string shows: [P4.run()] not connected

Could you please provide your valuable input why its not executing "p4 info" and reporting not connected, but actually it reports as connected.

P4 [user@svrrb1 ssl:perforce:19773] connected

Appreciate your response.

-Chuck

[Christian Hammond]

It sounds like it's connecting in some form but not staying connected. You mentioned you're using tickets before. Are you able to test this without ticket support (a standard user/password) to see if the problem continues?

Christian

[chuck j]

With the development server running, it is connecting with/without ticket based password but its not staying connect as you rightly said. But normally when we execute and try to attach the server it again reports with SSL library version not build with openssl 1.0.1. at this time it didn't even connect.

Do you see any issue with Apache/httpd which uses libssl.so.0.9.8e version of library. which does allow to load new libssl.so.1.0.0 version of library or taking precedence over the new ssl library.

Do you have any magical idea, which i can try and will remove this elephant tail from the hole without the SSL library error message.

[Christian Hammond]

It could be due to the version Apache uses.

You may also want to try setting LD_LIBRARY_PATH to point to the directory where libssl.so.1.0.1 is.

Another solution is to just find a more modern distro that ships 1.0.1 as the default.

Christian

--
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

I did that but at very beginning but it does not help, you were always saying in your email libssl.so.1.0.1, but i couldnt not see this version i always see libssl.so.1.0.0. Also in my machine its having libssl.so.0.9.8e version of libssl.so which is having link libssl.so.6. Does this libssl.so.6 link taking precedence over libssl.so.1.0.0.

[Christian Hammond]

I don't know if libssl.so.1.0.1 is the name or not. The .so library versions do not necessarily match the stated version of the library. One is used for ABI versioning of a library, and the other is what the project designates the public version. You can have several versions of a library released without the .so version changing.

I wouldn't be able to say what takes precedence. It depends on the application or library linking it in, and how it links it in, and, in this case, whether it can even find the right file.

Did you ever set LD_LIBRARY_PATH in the Apache config (using SetEnv) to point to the directory containing the proper libssl file?

Christian

[chuck j]

I tried adding SetEnv as below

<Directory "/var/www/html">
SetEnv LD_LIBRARY_PATH "/usr/local/lib64"
</Directory>

But while starting apache it produces below results.

/usr/sbin/apachectl: line 103: 22747 Segmentation fault      $HTTPD $OPTIONS -k $ARGV

[Christian Hammond]

Well... I don't know. That's not the right place for it though. It'd have to be in your Review Board Apache config.

I really think you need to install a distro that ships OpenSSL 1.0.1.

Christian

[chuck j]

Hi Chris,

Apologies for all these email and really appreciate your support extended all these days to me.

We have installed RB on new test server having openssl1.0.1 on opensuse and we were able to add the ssl enabled perforce repository.

Also we have learned that existing setup which was running two version of openssl 0.9.8e and newly installed openssl1.0.1, Even though p4python was build correctly since we knew it was working fine outside review board.

The Apache running was referring old version of openssl shared library hence during run time it could not load the newly build openssl library as there old version of openssl dependent library was getting  loaded which was refers old version of openssl at run time, hence we were getting all those messages.

We could not remove old version openssl library from our existing setup, which requires lots library up graduation which might broke many other packages.

Hence we decided to go with new server having openssl installed. since new server is RHEL6.4 having openssl 1.0.27, i guess this should work fine with SSL support.

I build p4python and its worked outside reviewbaord.  I will installed review board and then need to migrate database of old server. Do you have predefined steps to  migrate database.

Note: Our production server running review board on python2.7 and new server is using python2.6, i guess this should not impact/break the while migrating the database, please correct me if am wrong.

-Chuck

 

[Christian Hammond]

Hi Chuck,

Glad to hear you're making good progress with the new server.

Migrating the database should be easy. Assuming both servers are running the same version of Review Board, it should just be a matter of doing an SQL dump on the first server and importing it on the second.

You should then copy over the old site directory and update your conf/settings_local.py to point to the new database (if it's changed).

Alternatively, you can create a new site directory, but you'll want to at least migrate the SECRET_KEY value from the old conf/settings_local.py file to the new one.

You shouldn't have a problem with Python 2.6 vs. 2.7.

Christian

--
Christian Hammond - chi...@chipx86.com
Review Board - http://www.reviewboard.org

Beanbag, Inc. - http://www.beanbaginc.com

[chuck j]

Hi Chris,

Following steps i have followed for database migration. Please validate.

Production Server

• Stop mysql server
• Stop Apache.
  
• Create tar.gz of datadir i.e /var/lib/mysql to /var/lib/mysql.tar.gz
• Start mysql server again (downtime was 10-15 minutes)
• copy the compressed file to new server

New Server

• OpenSuse having apache2 installed at /srv/www path.
• We have installed Reviewboard of same version as production server, /srv/www/svrb
• Stopped the mysql server.
• Move the existing datadir /var/lib/mysql to /var/lib/mysql.bk
  
• unzip compressed file (tar -xzvf mysql.tar.gz) at /var/lib
  
• Make sure your log_file_size is same on new server.
• update the SECRET_KEY from old server to new server.
  
• Start mysql
• Start the apache.

We found that it reports.

Your Review Board installation does not have a /var/www/svrb/htdocs/media/uploaded/images directory.

If this is a new installation...

Create both /var/www/svrb/htdocs/media/uploaded and /var/www/svrb/htdocs/media/uploaded/images on the server and make both directories writable by the web server. You can do so with the following commands:

  $ cd /var/www/svrb/htdocs/media
  $ mkdir -p uploaded/images
  $ sudo chown -R www-data.www-data uploaded
 

But my site path now has changed to /srv/www/svrb.

What is missing.

-Chuck.

[chuck j]

I just got this resolved.