AMBARI-18512. Ambari-Server restart causes all host components to go in Heartbeat Lost state indefinitely. (aonishuk)

ambari-agent/src/main/python/ambari_agent/alerts/web_alert.py

@@ -33,7 +33,7 @@ from resource_management.libraries.functions.get_port_from_url import get_port_f
 from resource_management.libraries.functions.get_path_from_url import get_path_from_url
 from resource_management.libraries.functions.curl_krb_request import curl_krb_request
 from ambari_commons import OSCheck
-from ambari_commons.inet_utils import resolve_address
+from ambari_commons.inet_utils import resolve_address, ensure_ssl_using_tls_v1
 from ambari_agent import Constants
 
 # hashlib is supplied as of Python 2.5 as the replacement interface for md5
@@ -54,15 +54,7 @@ DEFAULT_CONNECTION_TIMEOUT = 5
 
 WebResponse = namedtuple('WebResponse', 'status_code time_millis error_msg')
 
-# patch ssl module to fix SSLv3 communication bug
-# for more info see http://stackoverflow.com/questions/9835506/urllib-urlopen-works-on-sslv3-urls-with-python-2-6-6-on-1-machine-but-not-wit
-def sslwrap(func):
-    @wraps(func)
-    def bar(*args, **kw):
-        kw['ssl_version'] = ssl.PROTOCOL_TLSv1
-        return func(*args, **kw)
-    return bar
-ssl.wrap_socket = sslwrap(ssl.wrap_socket)
+ensure_ssl_using_tls_v1()
 
 class WebAlert(BaseAlert):
 

ambari-common/src/main/python/ambari_commons/inet_utils.py

@@ -22,6 +22,7 @@ import os
 import sys
 import urllib2
 import socket
+from functools import wraps
 
 from exceptions import FatalException, NonFatalException, TimeoutError
 
@@ -181,3 +182,23 @@ def resolve_address(address):
     if address == '0.0.0.0':
       return '127.0.0.1'
   return address
+
+def ensure_ssl_using_tls_v1():
+  """
+  Monkey patching ssl module to force it use tls_v1. Do this in common module to avoid problems with
+  PythonReflectiveExecutor.
+  :return:
+  """
+  from functools import wraps
+  import ssl
+  if hasattr(ssl.wrap_socket, "_ambari_patched"):
+    return # do not create chain of wrappers, patch only once
+  def sslwrap(func):
+    @wraps(func)
+    def bar(*args, **kw):
+      import ssl
+      kw['ssl_version'] = ssl.PROTOCOL_TLSv1
+      return func(*args, **kw)
+    bar._ambari_patched = True
+    return bar
+  ssl.wrap_socket = sslwrap(ssl.wrap_socket)

ambari-server/src/main/resources/common-services/HDFS/2.1.0.2.0/package/scripts/utils.py

@@ -35,21 +35,10 @@ from resource_management.core.exceptions import Fail
 from resource_management.libraries.functions.namenode_ha_utils import get_namenode_states
 from resource_management.libraries.script.script import Script
 from resource_management.libraries.functions.show_logs import show_logs
-
+from ambari_commons.inet_utils import ensure_ssl_using_tls_v1
 from zkfc_slave import ZkfcSlaveDefault
 
-import ssl
-from functools import wraps
-
-# patch ssl module to fix SSLv3 communication bug
-# for more info see http://stackoverflow.com/questions/9835506/urllib-urlopen-works-on-sslv3-urls-with-python-2-6-6-on-1-machine-but-not-wit
-def sslwrap(func):
-    @wraps(func)
-    def bar(*args, **kw):
-        kw['ssl_version'] = ssl.PROTOCOL_TLSv1
-        return func(*args, **kw)
-    return bar
-ssl.wrap_socket = sslwrap(ssl.wrap_socket)
+ensure_ssl_using_tls_v1()
 
 def safe_zkfc_op(action, env):
   """