python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756

joergsteffens · 2024-03-28T14:59:01Z

The ssl module in Python 3.13 (cpython) added support for TLS-PSK. This changes uses TLS-PSK from this core module, if the functionality is available. If not, it still fails back to sslpsk and than to unencrypted.

Thank you for contributing to the Bareos Project!

Backport of PR #0000 to bareos-2x (remove this line if this is no backport; for backport use cherry-pick -x)

Please check

Short description and the purpose of this PR is present above this paragraph
Your name is present in the AUTHORS file (optional)

If you have any questions or problems, please give a comment in the PR.

Helpful documentation and best practices

Checklist for the reviewer of the PR (will be processed by the Bareos team)

Make sure you check/merge the PR using devtools/pr-tool to have some simple automated checks run and a proper changelog record added.

General

Is the PR title usable as CHANGELOG entry?
Purpose of the PR is understood
Commit descriptions are understandable and well formatted
Check backport line
Required backport PRs have been created

Source code quality

Source code changes are understandable
Variable and function names are meaningful
Code comments are correct (logically and spelling)
Required documentation changes are present and part of the PR

Tests

Decision taken that a test is required (if not, then remove this paragraph)
The choice of the type of test (unit test or systemtest) is reasonable
Testname matches exactly what is being tested
On a fail, output of the test leads quickly to the origin of the fault

python-bareos/bareos/bsock/lowlevel.py

bruno-at-bareos · 2024-04-03T12:16:50Z

python-bareos/bareos/bsock/lowlevel.py

+    except ImportError:
+        warnings.warn(
+            "Connection encryption via TLS-PSK is not available "
+            "(TLS-PSK is not available in the ssl module and the extra module sslpsk is not installed)."


I found the warning too long on terminal output.

We may want to fix also the additional warning.warn

/bareos/git/b-at-bareos/python-bareos/bareos/bsock/lowlevel.py:60: UserWarning: Connection encryption via TLS-PSK is not available (TLS-PSK is not available in the ssl module and the extra module sslpsk is not installed). warnings.warn( test_fileset (test_show.PythonBareosShowTest.test_fileset) Filesets are stored in the database, ... ok test_show_resources (test_show.PythonBareosShowTest.test_show_resources) show resources in bconsole ... ok ---------------------------------------------------------------------- Ran 2 tests in 4.268s

I've shorted the warning.

bruno-at-bareos

Nice work, please see comments

bruno-at-bareos · 2024-04-03T13:02:51Z

One more thing we would like to treat as next LTS python will be not compatible with sslpsk library

with python >= 3.10 you can install sslpsk but it will failed when tried to used.

We certainly want after the first import do another try except block to catch this missing property, and then failed due to incompatible python/sslpsk mix.

======================================================================
ERROR: test_login_tls_tls_require (test_tlspsk.PythonBareosTlsPskTest.test_login_tls_tls_require)
console: tls, director: tls     => login
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/bareos/git/build/systemtests/tests/python-bareos/test_tlspsk.py", line 225, in test_login_tls_tls_require
    director = bareos.bsock.DirectorConsole(
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/bareos/git/b-at-bareos/python-bareos/bareos/bsock/directorconsole.py", line 200, in __init__
    self.connect(
  File "/bareos/git/b-at-bareos/python-bareos/bareos/bsock/lowlevel.py", line 180, in connect
    return self.__connect()
           ^^^^^^^^^^^^^^^^
  File "/bareos/git/b-at-bareos/python-bareos/bareos/bsock/lowlevel.py", line 198, in __connect
    self.__connect_tls_psk()
  File "/bareos/git/b-at-bareos/python-bareos/bareos/bsock/lowlevel.py", line 284, in __connect_tls_psk
    self.socket = sslpsk.wrap_socket(
                  ^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/site-packages/sslpsk/sslpsk.py", line 106, in wrap_socket
    _ssl_set_psk_client_callback(sock, cb)
  File "/usr/lib64/python3.11/site-packages/sslpsk/sslpsk.py", line 73, in _ssl_set_psk_client_callback
    ssl_id = _sslpsk.sslpsk_set_psk_client_callback(_sslobj(sock))
                                                    ^^^^^^^^^^^^^
  File "/usr/lib64/python3.11/site-packages/sslpsk/sslpsk.py", line 55, in _sslobj
    return sock._sslobj._sslobj
           ^^^^^^^^^^^^^^^^^^^^
AttributeError: '_ssl._SSLSocket' object has no attribute '_sslobj'

joergsteffens · 2024-04-03T13:29:56Z

One more thing we would like to treat as next LTS python will be not compatible with sslpsk library

with python >= 3.10 you can install sslpsk but it will failed when tried to used.

We certainly want after the first import do another try except block to catch this missing property, and then failed due to incompatible python/sslpsk mix.
...
AttributeError: '_ssl._SSLSocket' object has no attribute '_sslobj'

You mean an extra check in the tests?

joergsteffens · 2024-04-03T13:55:15Z

One more thing we would like to treat as next LTS python will be not compatible with sslpsk library
with python >= 3.10 you can install sslpsk but it will failed when tried to used.
We certainly want after the first import do another try except block to catch this missing property, and then failed due to incompatible python/sslpsk mix.
...
AttributeError: '_ssl._SSLSocket' object has no attribute '_sslobj'
You mean an extra check in the tests?

I'm not sure how to cover this. The combination is broken, so the test should fail. I can do try/except AttributeError block around the connect, but still I should raise the problem after it has occurred. It seams, there exists a PR, that would solve these issues (drbild/sslpsk#28), but it seams, as it will not get merged.

bruno-at-bareos

While there's certainly room for improvement, we want to merge this as it is now.
If someone decide to sponsor development around sslpsk forks like sslpsk3 we may then have the resources to even make it better.

python-bareos/bareos/bsock/lowlevel.py

bruno-at-bareos · 2024-04-08T11:56:25Z

python-bareos/bareos/bsock/lowlevel.py

+            self.socket = context.wrap_socket(client_socket, server_side=False)
+        else:
+            try:
+                self.socket = sslpsk.wrap_socket(


So here with python 3.11 and sslpsk from github there a deprecate warning

test_execute_external_command (test_filedaemon.PythonBareosFiledaemonTest.test_execute_external_command) ... DeprecationWarning: ssl.wrap_socket() is deprecated, use SSLContext.wrap_socket() DeprecationWarning: ssl.PROTOCOL_TLSv1_2 is deprecated

bruno-at-bareos · 2024-04-08T12:05:00Z

So to resume the situation, for those who tried to install sslpsk from pypi and got the following error

AttributeError: '_ssl._SSLSocket' object has no attribute '_sslobj'

You have to remove and install sslpsk from github source.

joergsteffens requested a review from bruno-at-bareos March 28, 2024 14:59

joergsteffens force-pushed the dev/joergs/master/python313-tlspsk branch 2 times, most recently from 7ec4e77 to 07b6579 Compare March 28, 2024 17:52

bruno-at-bareos self-assigned this Apr 2, 2024

joergsteffens force-pushed the dev/joergs/master/python313-tlspsk branch from 07b6579 to 457285c Compare April 2, 2024 14:18

arogge added the enhancement label Apr 2, 2024

arogge modified the milestones: 23.1.0, 24.0.0 Apr 2, 2024

joergsteffens force-pushed the dev/joergs/master/python313-tlspsk branch from 457285c to e04c7ff Compare April 2, 2024 19:54

bruno-at-bareos reviewed Apr 3, 2024

View reviewed changes

python-bareos/bareos/bsock/lowlevel.py Show resolved Hide resolved

bruno-at-bareos reviewed Apr 3, 2024

View reviewed changes

bruno-at-bareos approved these changes Apr 8, 2024

View reviewed changes

bruno-at-bareos added the requires backport to 23 label Apr 8, 2024

joergsteffens mentioned this pull request Apr 8, 2024

python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1764

Merged

6 tasks

joergsteffens and others added 8 commits April 8, 2024 14:55

python-bareos: implement format_values() for argparse

b4a0a0a

python-bareos: improve argument descriptions

ca521c0

python-bareos: implement TLS-PSK for Python >= 3.13

fbd3f8a

python-bareos: improve protocolversion handling

2281afb

python-bareos: update docs for TLS-PSK with Python>=3.13

2e27498

python-bareos: shorten TLS-PSK not available warning

cd3feae

python-bareos: sslpsk is only working with Python <= 3.9

3653681

Update CHANGELOG.md

6cff0b2

BareosBot force-pushed the dev/joergs/master/python313-tlspsk branch from 04d009b to 6cff0b2 Compare April 8, 2024 14:55

BareosBot merged commit 04f4538 into bareos:master Apr 8, 2024

joergsteffens deleted the dev/joergs/master/python313-tlspsk branch April 15, 2024 14:44

joergsteffens mentioned this pull request May 6, 2024

Python bindings broken on Fedora >= 39 #1803

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756

python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756

joergsteffens commented Mar 28, 2024 •

edited by bruno-at-bareos

Loading

bruno-at-bareos Apr 3, 2024 •

edited

Loading

joergsteffens Apr 3, 2024

bruno-at-bareos left a comment

bruno-at-bareos commented Apr 3, 2024

joergsteffens commented Apr 3, 2024

joergsteffens commented Apr 3, 2024

bruno-at-bareos left a comment

bruno-at-bareos Apr 8, 2024

bruno-at-bareos commented Apr 8, 2024

python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756

python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756

Conversation

joergsteffens commented Mar 28, 2024 • edited by bruno-at-bareos Loading

Thank you for contributing to the Bareos Project!

Please check

Helpful documentation and best practices

Checklist for the reviewer of the PR (will be processed by the Bareos team)

General

Source code quality

Tests

bruno-at-bareos Apr 3, 2024 • edited Loading

Choose a reason for hiding this comment

joergsteffens Apr 3, 2024

Choose a reason for hiding this comment

bruno-at-bareos left a comment

Choose a reason for hiding this comment

bruno-at-bareos commented Apr 3, 2024

joergsteffens commented Apr 3, 2024

joergsteffens commented Apr 3, 2024

bruno-at-bareos left a comment

Choose a reason for hiding this comment

bruno-at-bareos Apr 8, 2024

Choose a reason for hiding this comment

bruno-at-bareos commented Apr 8, 2024

joergsteffens commented Mar 28, 2024 •

edited by bruno-at-bareos

Loading

bruno-at-bareos Apr 3, 2024 •

edited

Loading