-
Notifications
You must be signed in to change notification settings - Fork 263
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756
python-bareos: use TLS-PSK from core ssl module (available since Python >= 3.13) #1756
Conversation
7ec4e77
to
07b6579
Compare
07b6579
to
457285c
Compare
457285c
to
e04c7ff
Compare
except ImportError: | ||
warnings.warn( | ||
"Connection encryption via TLS-PSK is not available " | ||
"(TLS-PSK is not available in the ssl module and the extra module sslpsk is not installed)." |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I found the warning too long on terminal output.
We may want to fix also the additional warning.warn
/bareos/git/b-at-bareos/python-bareos/bareos/bsock/lowlevel.py:60: UserWarning: Connection encryption via TLS-PSK is not available (TLS-PSK is not available in the ssl module and the extra module sslpsk is not installed).
warnings.warn(
test_fileset (test_show.PythonBareosShowTest.test_fileset)
Filesets are stored in the database, ... ok
test_show_resources (test_show.PythonBareosShowTest.test_show_resources)
show resources in bconsole ... ok
----------------------------------------------------------------------
Ran 2 tests in 4.268s
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I've shorted the warning.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Nice work, please see comments
One more thing we would like to treat as next LTS python will be not compatible with with python >= 3.10 you can install sslpsk but it will failed when tried to used. We certainly want after the first import do another try except block to catch this missing property, and then failed due to incompatible python/sslpsk mix.
|
You mean an extra check in the tests? |
I'm not sure how to cover this. The combination is broken, so the test should fail. I can do |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
While there's certainly room for improvement, we want to merge this as it is now.
If someone decide to sponsor development around sslpsk forks like sslpsk3 we may then have the resources to even make it better.
self.socket = context.wrap_socket(client_socket, server_side=False) | ||
else: | ||
try: | ||
self.socket = sslpsk.wrap_socket( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So here with python 3.11 and sslpsk from github there a deprecate warning
test_execute_external_command (test_filedaemon.PythonBareosFiledaemonTest.test_execute_external_command) ... DeprecationWarning: ssl.wrap_socket() is deprecated, use SSLContext.wrap_socket()
DeprecationWarning: ssl.PROTOCOL_TLSv1_2 is deprecated
So to resume the situation, for those who tried to install sslpsk from pypi and got the following error
You have to remove and install sslpsk from github source. |
04d009b
to
6cff0b2
Compare
The ssl module in Python 3.13 (cpython) added support for TLS-PSK. This changes uses TLS-PSK from this core module, if the functionality is available. If not, it still fails back to sslpsk and than to unencrypted.
Thank you for contributing to the Bareos Project!
Backport of PR #0000 to bareos-2x (remove this line if this is no backport; for backport use cherry-pick -x)
Please check
If you have any questions or problems, please give a comment in the PR.
Helpful documentation and best practices
Checklist for the reviewer of the PR (will be processed by the Bareos team)
Make sure you check/merge the PR using
devtools/pr-tool
to have some simple automated checks run and a proper changelog record added.General
Source code quality
Tests