1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
Description: Add python 3.12 and 3.13 support
Author: Steven Silvester <steven.silvester@ieee.org>
Origin: upstream, https://patch-diff.githubusercontent.com/raw/OpenKMIP/PyKMIP/pull/707.patch
Bug-Debian: https://bugs.debian.org/1117734
Last-Update: 2025-11-21
Index: python-pykmip/docs/source/conf.py
===================================================================
--- python-pykmip.orig/docs/source/conf.py
+++ python-pykmip/docs/source/conf.py
@@ -85,7 +85,7 @@ todo_include_todos = False
#
#html_theme = 'alabaster'
html_theme = "sphinx_rtd_theme"
-html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
+# html_theme_path = []
# Theme options are theme-specific and customize the look and feel of a theme
# further. For a list of options available for each theme, see the
@@ -169,6 +169,3 @@ texinfo_documents = [
author, 'PyKMIP', 'One line description of project.',
'Miscellaneous'),
]
-
-
-
Index: python-pykmip/kmip/services/kmip_client.py
===================================================================
--- python-pykmip.orig/kmip/services/kmip_client.py
+++ python-pykmip/kmip/services/kmip_client.py
@@ -285,13 +285,17 @@ class KMIPProxy(object):
six.reraise(*last_error)
def _create_socket(self, sock):
- self.socket = ssl.wrap_socket(
+ context = ssl.SSLContext(self.ssl_version)
+ context.verify_mode = self.cert_reqs
+ if self.ca_certs:
+ context.load_verify_locations(self.ca_certs)
+ if self.keyfile and not self.certfile:
+ raise ValueError("certfile must be specified")
+ if self.certfile:
+ context.load_cert_chain(self.certfile, self.keyfile)
+ self.socket = context.wrap_socket(
sock,
- keyfile=self.keyfile,
- certfile=self.certfile,
- cert_reqs=self.cert_reqs,
- ssl_version=self.ssl_version,
- ca_certs=self.ca_certs,
+ server_side=False,
do_handshake_on_connect=self.do_handshake_on_connect,
suppress_ragged_eofs=self.suppress_ragged_eofs)
self.socket.settimeout(self.timeout)
Index: python-pykmip/kmip/services/server/server.py
===================================================================
--- python-pykmip.orig/kmip/services/server/server.py
+++ python-pykmip/kmip/services/server/server.py
@@ -287,17 +287,22 @@ class KmipServer(object):
for cipher in auth_suite_ciphers:
self._logger.debug(cipher)
- self._socket = ssl.wrap_socket(
+ cafile = self.config.settings.get('ca_path')
+ context = ssl.SSLContext(self.auth_suite.protocol)
+ context.verify_mode = ssl.CERT_REQUIRED
+ if self.auth_suite.ciphers:
+ context.set_ciphers(self.auth_suite.ciphers)
+ if cafile:
+ context.load_verify_locations(cafile)
+ certfile = self.config.settings.get('certificate_path')
+ keyfile = self.config.settings.get('key_path')
+ context.load_cert_chain(certfile, keyfile=keyfile)
+
+ self._socket = context.wrap_socket(
self._socket,
- keyfile=self.config.settings.get('key_path'),
- certfile=self.config.settings.get('certificate_path'),
server_side=True,
- cert_reqs=ssl.CERT_REQUIRED,
- ssl_version=self.auth_suite.protocol,
- ca_certs=self.config.settings.get('ca_path'),
do_handshake_on_connect=False,
- suppress_ragged_eofs=True,
- ciphers=self.auth_suite.ciphers
+ suppress_ragged_eofs=True
)
try:
Index: python-pykmip/kmip/tests/unit/services/server/test_server.py
===================================================================
--- python-pykmip.orig/kmip/tests/unit/services/server/test_server.py
+++ python-pykmip/kmip/tests/unit/services/server/test_server.py
@@ -210,9 +210,10 @@ class TestKmipServer(testtools.TestCase)
# Test that in ideal cases no errors are generated and the right
# log messages are.
with mock.patch('socket.socket') as socket_mock:
- with mock.patch('ssl.wrap_socket') as ssl_mock:
+ with mock.patch('ssl.SSLContext') as ssl_mock:
socket_mock.return_value = a_mock
- ssl_mock.return_value = b_mock
+ ssl_mock.return_value.wrap_socket.return_value = b_mock
+ ssl_mock.return_value.load_cert_chain.return_value = None
manager_mock.assert_not_called()
monitor_mock.assert_not_called()
@@ -271,9 +272,10 @@ class TestKmipServer(testtools.TestCase)
# Test that a NetworkingError is generated if the socket bind fails.
with mock.patch('socket.socket') as socket_mock:
- with mock.patch('ssl.wrap_socket') as ssl_mock:
+ with mock.patch('ssl.SSLContext') as ssl_mock:
socket_mock.return_value = a_mock
- ssl_mock.return_value = b_mock
+ ssl_mock.return_value.wrap_socket.return_value = b_mock
+ ssl_mock.return_value.load_cert_chain.return_value = None
test_exception = Exception()
b_mock.bind.side_effect = test_exception
|
