2

Using: Flower 0.9.5 (installed Tornado 6.0.4), Celery 4.4.6, Python 3.7

When starting Flower with

celery -A myProj flower

everything works as expected. Flower serves at http://localhost:5555.

When starting Flower with

celery -A myProj flower --keyfile=/home/me/cert/key.pem --certfile=/home/me/cert/cert.pem

it serves at https://localhost:5555 but when trying to access it, Chrome states ERR_CONNECTION_RESET and Flower logs

2020-09-16 17:19:37,421 - tornado.general - ERROR - Uncaught exception, closing connection.
Traceback (most recent call last):
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 711, in _handle_events
      self._handle_read()
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1498, in _handle_read
      self._do_ssl_handshake()
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1458, in _do_ssl_handshake
        if not self._verify_cert(self.socket.getpeercert()):
  File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1481, in _verify_cert
      assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL)
UnboundLocalError: local variable 'verify_mode' referenced before assignment
2020-09-16 17:19:37,423 - asyncio - ERROR - Exception in callback None()
handle: <Handle cancelled>
Traceback (most recent call last):
    File "/home/me/python/lib/python3.7/asyncio/events.py", line 88, in _run
        self._context.run(self._callback, *self._args)
    File "/home/me/.env/lib/python3.7/site-packages/tornado/platform/asyncio.py", line 139, in _handle_events
        handler_func(fileobj, events)
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 711, in _handle_events
        self._handle_read()
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1498, in _handle_read
        self._do_ssl_handshake()
    File "/home/me/.env/lib/python3.7/site-packages/tornado/iostream.py", line 1458, in _do_ssl_handshake
        if not self._verify_cert(self.socket.getpeercert()):
    File "/home/me/.env/lib/python/site-packages/tornado/iostream.py", line 1481, in _verify_cert
        assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL)
UnboundLocalError: local variable 'verify_mode' referenced before assignment

Note: Everything works when running Flower with

celery -B brokerURL flower --keyfile=/home/me/cert/key.pem --certfile=/home/me/cert/cert.pem

In /home/me/.env/lib/python3.7/site-packages/tornado/iostream.py there is:

def _verify_cert(self, peercert: Any) -> bool:
    """Returns ``True`` if peercert is valid according to the configured
    validation mode and hostname.

    The ssl handshake already tested the certificate for a valid
    CA signature; the only thing that remains is to check
    the hostname.
    """   
    if isinstance(self._ssl_options, dict):
        verify_mode = self._ssl_options.get("cert_reqs", ssl.CERT_NONE)
    elif isinstance(self._ssl_options, ssl.SSLContext):
        verify_mode = self._ssl_options.verify_mode
    assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL) # LINE 1481
    if verify_mode == ssl.CERT_NONE or self._server_hostname is None:
        return True
    cert = self.socket.getpeercert()
    if cert is None and verify_mode == ssl.CERT_REQUIRED:
        gen_log.warning("No SSL certificate given")
        return False
    try:
        ssl.match_hostname(peercert, self._server_hostname)
    except ssl.CertificateError as e:
        gen_log.warning("Invalid SSL certificate: %s" % e)
        return False
    else:
        return True

How can I pass verify_mode = ssl.CERT_REQUIRED to tornado via Flower? Setting it manually inside _verify_cert does work.

Kruspe
  • 626
  • 6
  • 19
  • If you look at the `if/elif` block above the assertion, you'll see that `verify_mode` will get set if `ssl_options` is either a dict or an `SSLContext`. So apparently we're getting to this point with an `ssl_options` object that isn't one of those things (and if it was None, SSL would be disabled). What type is it? The only reference to `ssl_options` I can find in flower is a dict, so I'm not sure what might be going wrong. – Ben Darnell Sep 18 '20 at 15:49

0 Answers0