Kuskuren ProxyError na Requests a kan API mai zaman kansa? Fara duba muhallin

VPN yana aiki, dashboard na ciki yana buɗewa a browser, kuma rubutun Python har yanzu yana ɗaga kuskuren wakili. Babu abin da ba daidai ba game da ramin a wannan hoton: mai fassara yana karanta adireshin wakili daga muhallinsa kuma yana aika buƙatar can. Wannan jagorar tana karanta muhallin da tsari ke gani da gaske, tana amfani da mafi ƙuntataccen keɓancewa, sannan kawai tana yin la'akari da manufar zama bayyananne. Kowane mataki yana ƙarewa da umarni wanda fitarwarsa ke yanke shawarar ko za ka ci gaba.

Karanta muhallin da tsari ke gani da gaske

Saitin wakili na tebur, fitarwar shell da layukan Environment= na sashin systemd mabanbantan tushe ne guda uku, kuma Requests yana karanta na ƙarshe kawai wanda ya gada. Gudanar da bincike na ƙasa a cikin wannan shell, kwantena ko sashin da ke gudanar da rubutun da ke kasawa, ba a cikin tashar tattaunawa ba. Canjin da aka fitar a cikin shell ɗinka na shiga ba a gani ga tsarin kwantena, kuma wannan gibin yana bayyana yawancin rahotanni game da wakilin da ke fitowa daga inda babu shi. Umarnin biyu suna buga bayanai ɗaya a matakai daban-daban na dalla-dalla.

env | grep -i -E 'proxy|requests_ca_bundle|curl_ca_bundle'
python3 -c "import os;[print(k,'=',v) for k,v in sorted(os.environ.items()) if 'proxy' in k.lower()]"

Ana karanta duka rubutun kowane canji, kuma ana amfani da shigarwar da aka maimaita bisa tsarin da tsarin ya karɓa su, don haka tsohon HTTP_PROXY zai iya wuce ƙimar da ka fitar yanzu. Canjin fakitin CA ma suna da muhimmanci a nan, domin suna canza abin da verify ke warwarewa ba tare da bayyana a ko'ina cikin lambar ba. Idan fitarwar ba komai, muhalli ba shine matsalarka ba kuma za ka iya daina karanta wannan sashe. Idan ya lissafa wakilin da ba ka gane ba, nemo fayil ko sashin da ke saita shi kafin ka canza wani abu.

Tambayi Requests abin da zai yi da takamaiman URL. Wannan kiran yana nuna haɗaɗɗun ƙimar wakili, verify da cert na wannan buƙatar ba tare da aika fakiti ba.

python3 -c "import requests;s=requests.Session();print(s.merge_environment_settings('https://api.corp.example/status',{},None,None,None))"

Shigarwar proxies mara komai ga mai masaukin sirri ita ce amsarka, kuma ƙimar verify da aka buga tana gaya maka wane fakitin CA buƙatar za ta amince da shi. Idan duka biyu sun yi daidai, gazawar tana gaba a cikin tari kuma ya kamata ka tsallake zuwa sashen tabbatarwa. Kada ka yi hasashe daga lambar: haɗuwar tana faruwa ga kowace buƙata, shi ya sa zama ɗaya zai iya yin daban ga masaukai biyu.

Ware mai masaukin sirri kafin ka kashe wani abu

Lokacin da ake buƙatar wakili da gaske ga wasu wurare, madaidaicin gyara shine keɓancewa ga wannan mai masauki. Ƙara wa jerin da ke akwai maimakon maye gurbinsa, domin share NO_PROXY yana karya kowace wata manufa ta ciki da ta dogara da shi. Umarnin ƙasa suna ƙara shigarwar sannan su tambayi Requests ko ketarewar ta shafi.

export NO_PROXY="${NO_PROXY:+$NO_PROXY,}api.corp.example,.corp.example"
python3 -c "import requests;print(requests.utils.should_bypass_proxies('https://api.corp.example/status',None))"

Daidaitawa ta ƙarin sunan mai masauki ne, don haka .corp.example yana rufe dukkan yankin yayin da api.corp.example ke rufe suna ɗaya. Tauraro tsirara tana kashe wakili ga kowane mai masauki kuma kusan ba abin da aikin samarwa ke so bane. Ko za a mutunta shigarwar CIDR ya dogara da sigogin Requests da urllib3 a cikin hoton, don haka gwada takamaiman shigarwar maimakon ɗauka tana aiki. Duba sakamakon should_bypass_proxies don ainihin URL, ba don sunan mai masauki da ka buga daga tuna ba.

Ka riƙe matakan biyu daban a cikin kanka. Ketare wakilin HTTP ba ya ketare VPN, domin shawarar wakili tana faruwa a ɗakin karatu kuma shawarar rami tana faruwa a teburin hanya na kernel.

Kashe trust_env kawai a matsayin manufar zama da gangan

Idan dukan aikin ya kamata ya yi watsi da tsarin muhalli, gina zamar a bayyane kuma rubuta shawarar a cikin lambar. Wannan manufa ce, ba hanyar wucewa ba, kuma tana cikin diff da mai bita zai iya gani. Misalin ƙasa yana riƙe lokacin jira, hanyar CA bayyananne da duba matsayi.

import requests

with requests.Session() as session:
    session.trust_env = False
    response = session.get(
        "https://api.corp.example/status",
        timeout=(5, 20),
        verify="/etc/ssl/certs/corp-ca.pem",
    )
    response.raise_for_status()

Kashe trust_env yana canza halaye uku lokaci ɗaya, kuma ɗaya kawai daga cikinsu ya shafi wakili. Requests yana daina karanta shaidun .netrc, kuma canjin REQUESTS_CA_BUNDLE da CURL_CA_BUNDLE suna daina shafar verify, wanda sannan zai koma zuwa ajiyar takardar shedar da aka haɗa. Idan ƙungiyarka tana ƙare TLS da CA nata, wannan koma baya yana ɗaga kuskuren tabbatarwa wanda yake kama da ba shi da alaƙa da canjin da ka yi yanzu. Wuce verify a bayyane shine abin da ke riƙe tasirin biyu daban.

Abin da bai kamata ka yi ba shine saita verify=False don yin shiru da kuskuren da ya biyo baya. Wannan yana musanya kuskuren saitin wakili da haɗi mara tabbatarwa, kuma yana ɓoye matsalar takardar shedar da keɓancewar ta kamata ta bayyana.

Tabbatar da matakin da ke kasawa kuma ka riƙe hanyar komawa

Gazawa uku suna kama da juna a cikin log kuma ba su da wani abu ɗaya: wakilin da ba zai iya isa wurin ba yana ɗaga ProxyError ko yana mayar da 502, matsalar amincewa tana ɗaga SSLError, kuma ƙin aikace-aikace yana mayar da 401 ko 403. Sake maimaita buƙatar a wajen Requests don ganin wanne kake da shi. Umarnin ƙasa suna cire wakilin, gwada sarkar takardar shedar sannan su maimaita kiran ta ɗakin karatu.

curl -sv --noproxy '*' https://api.corp.example/status -o /dev/null
openssl s_client -connect api.corp.example:443 -servername api.corp.example </dev/null
python3 -c "import requests;r=requests.get('https://api.corp.example/status',timeout=10);print(r.status_code)"

Idan kiran curl ya yi nasara kuma kiran Python ya kasa, muhalli ne har yanzu bambancin. Idan duka biyu sun kasa a matakin TLS, wakilin bai taɓa zama matsala ba kuma sarkar takardar shedar ce. Idan duka biyu sun mayar da 401, buƙatar ta isa aikace-aikacen kuma sauran aikin shine tabbatar da asali. Rubuta wanne daga cikin ukun da ka lura yana ceton mutum na gaba awa ɗaya.

Komawa layi ɗaya ne a kowace hanya: cire keɓancewar, ko juya trust_env baya. Ajiye ƙimar NO_PROXY ta baya kafin ka ƙara mata, kuma fi son rubutun nadi ko shigarwar Environment= a matakin sashe maimakon fitarwar da ke rayuwa kawai a tarihin tasharka. Duk canje-canjen biyu ana iya gani a muhallin tsari, don haka sake kunnawa yawanci yana mayar da kai ga tsohon hali.

Kammala ta hanyar tabbatar da abubuwa huɗu: haɗaɗɗun saitin URL ɗin sirri ba ya nuna wakili, takardar shedar tana ingantuwa da CA da aka nufa, buƙatar tana mayar da matsayin da kake tsammani, kuma an yi commit ɗin canjin a wurin da za a iya maimaitawa. Koren rubutu da muhalli mara bayani gyara ne da zai sake karyewa a na'ura ta gaba. Umarnin da ke cikin wannan jagorar sune waɗanda za ka liƙa a tikitin.