{"action":"opened","issue":{"url":"https://api.github.com/repos/ansible/ansible/issues/18676","repository_url":"https://api.github.com/repos/ansible/ansible","labels_url":"https://api.github.com/repos/ansible/ansible/issues/18676/labels{/name}","comments_url":"https://api.github.com/repos/ansible/ansible/issues/18676/comments","events_url":"https://api.github.com/repos/ansible/ansible/issues/18676/events","html_url":"https://github.com/ansible/ansible/issues/18676","id":192513412,"number":18676,"title":"Git module fails to add hostkey to known_hosts and doesn't notice it","user":{"login":"ngo","id":78071,"avatar_url":"https://avatars.githubusercontent.com/u/78071?v=3","gravatar_id":"","url":"https://api.github.com/users/ngo","html_url":"https://github.com/ngo","followers_url":"https://api.github.com/users/ngo/followers","following_url":"https://api.github.com/users/ngo/following{/other_user}","gists_url":"https://api.github.com/users/ngo/gists{/gist_id}","starred_url":"https://api.github.com/users/ngo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ngo/subscriptions","organizations_url":"https://api.github.com/users/ngo/orgs","repos_url":"https://api.github.com/users/ngo/repos","events_url":"https://api.github.com/users/ngo/events{/privacy}","received_events_url":"https://api.github.com/users/ngo/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-11-30T09:18:43Z","updated_at":"2016-11-30T09:18:43Z","closed_at":null,"body":"##### ISSUE TYPE\r\n - Bug Report\r\n\r\n##### COMPONENT NAME\r\n\r\nansible.module_utils.known_hosts\r\n\r\n##### ANSIBLE VERSION\r\n```\r\nansible 2.1.3.0\r\n  config file = \r\n  configured module search path = Default w/o overrides\r\n```\r\n\r\n##### OS / ENVIRONMENT\r\n\r\nUbuntu 16.04 \r\n\r\n##### SUMMARY\r\n\r\nFunction add_host_key which gets called from  add_git_host_key, which gets called from the git module when accept_hostkey=yes, does not check that the output from ssh-keyscan is not empty. But ssh-keyscan has a timeout (5 seconds by default), and if the server could not answer in a timely manner, ssh-keyscan prints nothing to stdout and returns with return code 0. Ansible assumes that this operation is successful and proceeds to call git, which then hangs on a host key confirmation dialog.\r\n\r\nThe demonstration is as follows (I used -T1 to reproduce more easily, with default timeout of 5 seconds this also happens)\r\n```\r\n~$ ssh-keyscan -t rsa -T 1  bitbucket.org // this is succesful\r\n# bitbucket.org:22 SSH-2.0-conker_1.0.263-aeae7ee app-134\r\nbitbucket.org ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAubiN81eDcafrgMeLzaFPsw2kNvEcqTKl/VqLat/MaB33pZy0y3rJZtnqwR2qOOvbwKZYKiEO1O6VqNEBxKvJJelCq0dTXWT5pbO2gDXC6h6QDXCaHo6pOHGPUy+YBaGQRGuSusMEASYiWunYN0vCAI8QaXnWMXNMdFP3jHAJH0eDsoiGnLPBlBp4TNm6rYI74nMzgz3B9IikW4WVK+dc8KZJZWYjAuORU3jc1c/NPskD2ASinf8v3xnfXeukU0sJ5N6m5E8VLjObPEO+mN2t/FZTMZLiFqPWc/ALSqnMnnhwrNi2rbfg/rd/IpL8Le3pSBne8+seeFVBoGqzHM9yXw==\r\n~$ echo $? // ret code zero\r\n0\r\n~$ ssh-keyscan -t rsa -T 1  bitbucket.org // this one failed\r\n~$ echo $? // ret code still zero\r\n0\r\n```\r\n\r\n##### STEPS TO REPRODUCE\r\n\r\nExecute a git task with a slow git server with accept_hostkey=yes\r\n\r\n##### EXPECTED RESULTS\r\n\r\nFail with a meaningful error specifying that the keyscan was unsuccessful. Also, a way to increase the default timeout would be nice.\r\n\r\n##### ACTUAL RESULTS\r\n\r\nThe module hangs indefinitely\r\n\r\nrelated issue: https://github.com/ansible/ansible-modules-core/issues/1343\r\n"}}
{"actor":{"display_login":"ngo"}}