Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PYTHON-1331 ssl.match_hostname() is deprecated in 3.7 #1191

Merged
merged 13 commits into from
Dec 19, 2023
Merged

Conversation

absurdfarce
Copy link
Collaborator

No description provided.

Copy link
Collaborator Author

@absurdfarce absurdfarce left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Local testing confirms that this change gets identical behaviour for a simple client using Python 3.8, 3.10 and 3.12 (see notes on the ticket for a lot more detail about this testing). Next step is probably to try to bring test_ssl.py back from the dead, confirm that it's good with the existing impl and then try it out with these changes.

Jenkinsfile Outdated
@@ -196,7 +196,7 @@ def initializeEnvironment() {
}

sh label: 'Install unit test modules', script: '''#!/bin/bash -lex
pip install pynose nose-ignore-docstring nose-exclude service_identity
pip install nose-ignore-docstring nose-exclude service_identity
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Moved into test-requirements (replacing nose) rather than keeping it in the Jenkinsfile

if excs:
raise DependencyException("Exception loading connection class dependencies", excs)
if not conn_class:
raise DependencyException("Unable to load a default connection class", excs)
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A fix for an issue discovered in testing. Goal of the changes to support asyncore as an optional dependency was to raise an error if we were unable to find a workable event loop at all. Unfortunately my original impl just looked for the presence of any exception in any event loop impl which is... not at all the same thing.

if ciphers:
rv.set_ciphers(ciphers)

return rv
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Follows the idea roughly sketched out in Python docs for ssl.wrap_socket()

@absurdfarce
Copy link
Collaborator Author

Tested by running the following ops using Python 3.8, 3.10 and 3.12 against a C* instance with client_encryption_options enabled:

client_encryption_options:
  enabled: true
  keystore: /work/git/working/python/client/client.jks
  keystore_password: password
  require_client_auth: true
  truststore: /work/git/working/python/rootca/ca_truststore.jks
  truststore_password: password

The following scenarios were tested:

  • Basic SSL connectivity (using a CA-signed cert)
  • Same with a self-signed cert, confirm that connection fails
  • Specify invalid server_hostname in ssl_options, confirm that connection fails

All tests behaved as expected

@absurdfarce absurdfarce merged commit 8ff0ba0 into master Dec 19, 2023
1 of 5 checks passed
@absurdfarce absurdfarce deleted the python1331 branch December 19, 2023 21:03
fruch added a commit to fruch/python-driver that referenced this pull request Jun 6, 2024
…sync_with_upstream_3.29.1

version 3.29.0

* tag '3.29.0' of https://github.com/datastax/python-driver:
  Documentation (and other) updates for 3.29.0 (datastax#1194)
  PYTHON-1331 ssl.match_hostname() is deprecated in 3.7 (datastax#1191)
  PYTHON-1371 Add explicit exception type for serialization failures (datastax#1193)
  Remove outdated Python pre-3.7 references (datastax#1186)
  PYTHON-1368 Avoid installing DSE deps + executing DSE tests for Python 3.12 (datastax#1188)
  PYTHON-1366 Handle removal of asyncore in Python 3.12 (datastax#1187)
  Removed backup(.bak) files (datastax#1185)
  docs: Fix typo in add_callbacks (datastax#1177)
  Remove some remnants of Python2 (datastax#1172)
  PYTHON-1313 Fix asyncio removals in Python 3.10 (datastax#1179)
  PYTHON-1364 Fix ssl.wrap_socket errors (from eventlet) for Python 3.12 (datastax#1181)
  Add Jenkins support for Python 3.12.0 (datastax#1180)
  Update redirects in docs.yaml (datastax#1178)
  Jenkins using new python versions in the matrix (datastax#1174)
  Update docs.yaml to point to most recent 3.28.0 docs changes
  CONN-38 Notes for 3.28.0 on PYTHON-1350 (datastax#1167)
  Include docs for 3.28.0
  Fixed non-valid rst in README
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant