Connection refused when using zeep SSL

Question

I am trying to access a SOAP server using zeep. My server uses SSL with a custom certificate, and connection to that server works, with my cert, or ignoring it:

python -mzeep "https://<server-ip>/servicemanager/1?wsdl" --no-verify

I get a long list of Prefixes, Global elements, Global types, Bindings and Service. The latter one says:

Service: ServiceManager
     Port: servicemanager_1 (Soap11Binding: {http://soap.client.<snipped>.at}servicemanager_1Binding)
         Operations:
            getServices() -> return: ns0:service[]

So, from what I can say by now, I can create a client object and call it's service named getServices().

from zeep import CachingClient as Client
from zeep.wsse.signature import Signature
from zeep.transports import Transport
from requests import Session, Request

session = Session()
session.verify = False
transport = Transport(session=session)

c = Client('https://<server-ip>/servicemanager/1?wsdl', transport=transport)
c.service.getServices()

But that leads to an error in urllib3 (~/.virtualenvs/soap/lib/python3.5/site-packages/urllib3/util/connection.py):

ConnectionRefusedError: [Errno 111] Connection refused

During handling of the above exception, another exception occurred:
[...]
requests.exceptions.ConnectionError: HTTPSConnectionPool(host='localhost',
port=443): Max retries exceeded with url: /servicemanager/1 (Caused by
NewConnectionError('<urllib3.connection.VerifiedHTTPSConnection object
at 0x7f4e2a6f7d30>: Failed to establish a new connection: [Errno 111]
Connection refused',))

It does not matter if I ignore the SSL verification, or provide a CA_BUNDLE. both are accepted, the client is created, but I can't call the getServices() method.

What did I forget here? I don't think this is a zeep problem, as the underlying urllib3 throws the exception. But I tried for hours and searched the internet for a solution, without success.

Apart of the XML I get from the endpoint is:

<service name="ServiceManager">
  <port name="servicemanager_1" binding="tns:servicemanager_1Binding">
    <soap:address location="http://localhost/servicemanager/1"/>
  </port>
</service>

And I don't know why it returns a "localhost" there - is zeep using that for its call? Then I would understand why permanent errors occur.

Any hints?

e.g. why is there "localhost" in the `HTTPSConnectionPool`? This should be the server IP, right? — nerdoc, Jul 23 '17 at 13:14
This seems to be the problem. If I make a SSH tunnel from my local machine to the server where the ports 80/443 are forwarded, so I can access localhost:80 - and reach the soap server with it - it works perfectly. But this is weird - is there a problem with the SOAP server? — nerdoc, Jul 23 '17 at 15:51

score 2 · Answer 1 · answered Oct 07 '17 at 20:40

2

To change the endpoint address I use it this way:

client.service._binding_options['address'] = 'https://mynewaddress.com/service.wsdl'

answered Oct 07 '17 at 20:40

baldr

2,891
11
43
61

score 1 · Answer 2 · answered Jul 24 '17 at 07:26

As always, after days of searching, in the moment I ask at Stackoverflow, the answer came up through other channels.

If anyone has the same problems, here is the solution. My server provides me with the WSDL file, like said above:

<service name="ServiceManager">
  <port name="servicemanager_1" binding="tns:servicemanager_1Binding">
    <soap:address location="http://localhost/servicemanager/1"/>
  </port>
</service>

And there it stands: localhost. Zeep (IMHO correctly) uses that service endpoint to communicate then with the server. What I did for testing: I SSH-tunnelled the ports 80/443 to localhost, so zeep thought it talked to localhost. And Shazaam, it worked.

So my server was the culprit - too bad I can't change that, as I have no control over it. But now a workaround is possible.

Connection refused when using zeep SSL

2 Answers2