[Bug] KLISH Python C Extension Loading Failure Affecting builtin="clish_pyobj" Commands

[albmartmart]

Summary

When KLISH invokes Python actioners using builtin="clish_pyobj", Python C extensions (such as charset_normalizer and the SSL module) fail to load due to missing Python C API symbols. This affects all commands using this invocation method, including MCLAG commands and any new implementations.

Environment

• SONiC Version: SONiC Virtual Switch 2025
• Python version: 3.11
• KLISH version: 2.1.4
• Affected repository: sonic-net/sonic-mgmt-framework
• Platform: SONiC Virtual Switch (VS)

Problem Description

The KLISH CLI framework embeds Python to execute actioner scripts via the builtin="clish_pyobj" mechanism implemented in CLI/klish/patches/klish-2.1.4/plugins/clish/call_pyobj.c.

When Python C extensions are loaded in this embedded context, they fail with errors like:

/usr/local/lib/python3.11/dist-packages/charset_normalizer/md.cpython-311-x86_64-linux-gnu.so: undefined symbol: PyObject_GetAttrString

And:

Can't connect to HTTPS URL because the SSL module is not available.

This prevents REST API calls from functioning, causing commands to fail with "Internal error". The mentioned errors can be checked by modifying the CLI/actioner/sonic_cli_mclag.py fixing the python2 print statements and adding the next lines:

try:
    import charset_normalizer
except Exception as e:
    print(e)

....

if __name__ == '__main__':
    pipestr().write(sys.argv)
    #pdb.set_trace()
    try:
        run(sys.argv[1], sys.argv[2:])
    except Exception as e:
        print("%Error: {}".format(str(e)))

After that, the errors will be printed:

admin@sonic:~$ sonic-cli
sonic# configure terminal
sonic(config)# no mclag domain 123
/usr/local/lib/python3.11/dist-packages/requests/__init__.py:86: RequestsDependencyWarning: Unable to find acceptable character detection dependency (chardet or charset_normalizer).
  warnings.warn(
/usr/lib/python3.11/lib-dynload/termios.cpython-311-x86_64-linux-gnu.so: undefined symbol: PyExc_TypeError
/usr/local/lib/python3.11/dist-packages/charset_normalizer/md.cpython-311-x86_64-linux-gnu.so: undefined symbol: PyObject_GetAttrString
%Error: Can't connect to HTTPS URL because the SSL module is not available.
sonic(config)# 

Affected Commands

All commands using builtin="clish_pyobj" are affected, including:

1. MCLAG commands in CLI/clitree/cli-xml/mclag.xml:
   • no mclag domain
   • source-ip, peer-ip, peer-link configuration commands
   • All other MCLAG configuration commands
2. Show commands using the pattern:
   • show mclag brief
   • show mclag interface
3. Any new implementations attempting to use builtin="clish_pyobj" for conditional view switching

Root Cause

The KLISH binary is built without exporting Python C API symbols to dynamically loaded libraries. When KLISH embeds Python and loads actioner modules, those modules can import pure Python code, but any C extensions they depend on (like charset_normalizer, ssl, etc.) cannot resolve Python C API symbols like PyObject_GetAttrString.