Merge "Python 3.12: do not use ssl.wrap_socket"

e.g. Watcher endpoint is "127.0.0.1:8081",
Watcher client sends http request to "127.0.0.1:808"

Closes-Bug: #2052779
Change-Id: I78631c8a13ff73a236f3bfadd7f4258b254b6113

setup.cfg

@@ -6,7 +6,7 @@ description_file =
 author = OpenStack
 author_email = openstack-discuss@lists.openstack.org
 home_page =  https://docs.openstack.org/python-watcherclient/latest/
-python_requires = >=3.8
+python_requires = >=3.9
 classifier =
     Environment :: OpenStack
     Intended Audience :: Information Technology
@@ -15,10 +15,10 @@ classifier =
     Operating System :: POSIX :: Linux
     Programming Language :: Python
     Programming Language :: Python :: 3
-    Programming Language :: Python :: 3.8
     Programming Language :: Python :: 3.9
     Programming Language :: Python :: 3.10
     Programming Language :: Python :: 3.11
+    Programming Language :: Python :: 3.12
 
 [files]
 packages =

watcherclient/common/httpclient.py

@@ -20,6 +20,7 @@ import http.client
 import io
 import logging
 import os
+import re
 import socket
 import ssl
 import textwrap
@@ -61,7 +62,7 @@ SUPPORTED_ENDPOINT_SCHEME = ('http', 'https')
 
 def _trim_endpoint_api_version(url):
     """Trim API version and trailing slash from endpoint."""
-    return url.rstrip('/').rstrip(API_VERSION)
+    return re.sub(f'{API_VERSION}$', '', url.rstrip('/'))
 
 
 def _extract_error_json(body):
@@ -436,11 +437,6 @@ class VerifiedHTTPSConnection(http.client.HTTPSConnection):
         """Connect to a host on a given (SSL) port.
 
         If ca_file is pointing somewhere, use it to check Server Certificate.
-
-        Redefined/copied and extended from httplib.py:1105 (Python 2.6.x).
-        This is needed to pass cert_reqs=ssl.CERT_REQUIRED as parameter to
-        ssl.wrap_socket(), which forces SSL to check server certificate against
-        our client certificate.
         """
         sock = socket.create_connection((self.host, self.port), self.timeout)
 
@@ -448,17 +444,21 @@ class VerifiedHTTPSConnection(http.client.HTTPSConnection):
             self.sock = sock
             self._tunnel()
 
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+
         if self.insecure is True:
-            kwargs = {'cert_reqs': ssl.CERT_NONE}
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
         else:
-            kwargs = {'cert_reqs': ssl.CERT_REQUIRED, 'ca_certs': self.ca_file}
+            context.load_verify_locations(self.ca_file)
 
         if self.cert_file:
-            kwargs['certfile'] = self.cert_file
             if self.key_file:
-                kwargs['keyfile'] = self.key_file
+                context.load_cert_chain(self.cert_file, self.key_file)
+            else:
+                context.load_cert_chain(self.cert_file)
 
-        self.sock = ssl.wrap_socket(sock, **kwargs)
+        self.sock = context.wrap_socket(sock)
 
     @staticmethod
     def get_system_ca_file():

watcherclient/tests/unit/test_client.py

@@ -358,3 +358,8 @@ class ClientTest(utils.BaseTestCase):
         client = httpclient.HTTPClient(endpoint)
         conn_url = client._make_connection_url(url)
         self.assertEqual(expected_url, conn_url)
+
+    def test_port_ends_with_one(self):
+        endpoint = "http://localhost:8081/"
+        http_client = httpclient.HTTPClient(endpoint)
+        self.assertEqual(endpoint, http_client._make_connection_url(""))