Switch from ssl.wrap_socket to SSLContext.wrap_socket #608
Conversation
|
@adamemerson - thanks! |
|
Schedule a test run against this branch on Teuthology, you'll need to make a custom branch of Ceph that points to this branch of s3-tests. |
The python docs specify that since python 3.2, it is recommended to use
`SSLContext.wrap_socket` instead of `ssl.wrap_socket` ("since it is both
inefficient and has no support for SNI and hostname matching").
In python3.12, `ssl.wrap_socket` was removed, which causes the 100-continue
test to reliably fail whenever it's configured with `is_secure=True`.
Switching to the recommended `SSLContext.wrap_socket` (using the default
SSL context) fixes this, allowing the test to run cleanly again.
Signed-off-by: Jacques Heunis <jheunis@bloomberg.net>
jheunis-bloomberg
force-pushed
the
fix-ssl-socket-wrap-for-python312
branch
from
3c714d3 to
108c12b
Compare
|
@adamemerson I know its been almost a year but I've finally gotten around to this (I believe there were some issues with Teuthology at the time so it fell off my radar). I did a test run on Teuthology against this change. I see there are a load of failures but none of them appear to be relevant (many are either complaining that they couldn't clone OpenStack's keystone or that valgrind doesn't like a call to This is the first time I'm running tests on teuthology myself so I'm not sure what to expect, but...did I do something wrong here? Are failures like this somehow expected? Is there some other test I should be running? |
4 participants
The python docs specify that since python 3.2, it is recommended to use
SSLContext.wrap_socketinstead ofssl.wrap_socket("since it is both inefficient and has no support for SNI and hostname matching").In python3.12,
ssl.wrap_socketwas removed, which causes the 100-continue test to reliably fail whenever it's configured withis_secure=True. Switching to the recommendedSSLContext.wrap_socket(using the default SSL context) fixes this, allowing the test to run cleanly again.