Merge "Python 3.12: do not use ssl.wrap_socket"

e.g. Watcher endpoint is "127.0.0.1:8081",
Watcher client sends http request to "127.0.0.1:808"

Closes-Bug: #2052779
Change-Id: I78631c8a13ff73a236f3bfadd7f4258b254b6113

setup.cfg

@@ -6,7 +6,7 @@ description_file =
 author = OpenStack
 author_email = openstack-discuss@lists.openstack.org
 home_page =  https://docs.openstack.org/python-watcherclient/latest/
-python_requires = >=3.8
+python_requires = >=3.9
 classifier =
     Environment :: OpenStack
     Intended Audience :: Information Technology
@@ -15,10 +15,10 @@ classifier =
     Operating System :: POSIX :: Linux
     Programming Language :: Python
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
+    Programming Language :: Python :: 3.12
 
 [files]
 packages =

test-requirements.txt

@@ -6,4 +6,3 @@ python-subunit>=1.0.0 # Apache-2.0/BSD
 stestr>=2.0.0 # Apache-2.0
 testscenarios>=0.4 # Apache-2.0/BSD
 testtools>=2.2.0 # MIT
-tempest>=17.1.0 # Apache-2.0

watcherclient/common/httpclient.py

@@ -14,13 +14,13 @@
 #    under the License.
 
 import copy
-from distutils import version
 import functools
 import hashlib
 import http.client
 import io
 import logging
 import os
+import re
 import socket
 import ssl
 import textwrap
@@ -62,7 +62,7 @@ SUPPORTED_ENDPOINT_SCHEME = ('http', 'https')
 
 def _trim_endpoint_api_version(url):
     """Trim API version and trailing slash from endpoint."""
-    return url.rstrip('/').rstrip(API_VERSION)
+    return re.sub(f'{API_VERSION}$', '', url.rstrip('/'))
 
 
 def _extract_error_json(body):
@@ -123,16 +123,19 @@ class VersionNegotiationMixin(object):
                 % {'req': self.os_infra_optim_api_version,
                    'min': min_ver, 'max': max_ver}))
 
-        negotiated_ver = str(
-            min(version.StrictVersion(self.os_infra_optim_api_version),
-                version.StrictVersion(max_ver)))
+        negotiated_ver = api_versioning.APIVersion(
+            self.os_infra_optim_api_version)
+        min_ver = api_versioning.APIVersion(min_ver)
+        max_ver = api_versioning.APIVersion(max_ver)
+        if negotiated_ver > max_ver:
+            negotiated_ver = max_ver
         if negotiated_ver < min_ver:
             negotiated_ver = min_ver
         # server handles microversions, but doesn't support
         # the requested version, so try a negotiated version
         self.api_version_select_state = 'negotiated'
-        self.os_infra_optim_api_version = negotiated_ver
-        LOG.debug('Negotiated API version is %s', negotiated_ver)
+        self.os_infra_optim_api_version = negotiated_ver.get_string()
+        LOG.debug('Negotiated API version is %s', negotiated_ver.get_string())
 
         return negotiated_ver
 
@@ -434,11 +437,6 @@ class VerifiedHTTPSConnection(http.client.HTTPSConnection):
         """Connect to a host on a given (SSL) port.
 
         If ca_file is pointing somewhere, use it to check Server Certificate.
-
-        Redefined/copied and extended from httplib.py:1105 (Python 2.6.x).
-        This is needed to pass cert_reqs=ssl.CERT_REQUIRED as parameter to
-        ssl.wrap_socket(), which forces SSL to check server certificate against
-        our client certificate.
         """
         sock = socket.create_connection((self.host, self.port), self.timeout)
 
@@ -446,17 +444,21 @@ class VerifiedHTTPSConnection(http.client.HTTPSConnection):
             self.sock = sock
             self._tunnel()
 
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+
         if self.insecure is True:
-            kwargs = {'cert_reqs': ssl.CERT_NONE}
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
         else:
-            kwargs = {'cert_reqs': ssl.CERT_REQUIRED, 'ca_certs': self.ca_file}
+            context.load_verify_locations(self.ca_file)
 
         if self.cert_file:
-            kwargs['certfile'] = self.cert_file
             if self.key_file:
-                kwargs['keyfile'] = self.key_file
+                context.load_cert_chain(self.cert_file, self.key_file)
+            else:
+                context.load_cert_chain(self.cert_file)
 
-        self.sock = ssl.wrap_socket(sock, **kwargs)
+        self.sock = context.wrap_socket(sock)
 
     @staticmethod
     def get_system_ca_file():

watcherclient/shell.py

@@ -203,7 +203,9 @@ class WatcherShell(app.App):
             LOG.info("END return value: %s", ret_val)
 
 
-def main(argv=sys.argv[1:]):
+def main(argv=None):
+    if argv is None:
+        argv = sys.argv[1:]
     watcher_app = WatcherShell()
     return watcher_app.run(argv)
 

watcherclient/tests/unit/test_client.py

@@ -358,3 +358,8 @@ class ClientTest(utils.BaseTestCase):
         client = httpclient.HTTPClient(endpoint)
         conn_url = client._make_connection_url(url)
         self.assertEqual(expected_url, conn_url)
+
+    def test_port_ends_with_one(self):
+        endpoint = "http://localhost:8081/"
+        http_client = httpclient.HTTPClient(endpoint)
+        self.assertEqual(endpoint, http_client._make_connection_url(""))