errors with python 3.8 about htgettoken

[retzkek]

I started diving into the rabbit hole and hit a brick wall called M2Crypto and its wonderful documentation. So I backed up and tried changing to the standard HTTPSConnection, which worked wonderfully. Note that as of Python 3.7 cert hostnames are checked so I don't think there's any reason to not use the standard library.

@DrDaveD what do you think, put in a version check to decide which HTTPSConnection to use?

For testing I just patched VerifiedHTTPSHandler, but probably needs a bit more thought:

diff --git a/htgettoken b/htgettoken
index febb9f1..57714b8 100755
--- a/htgettoken
+++ b/htgettoken
@@ -272,7 +272,7 @@ class VerifiedHTTPSHandler(urllib_request.HTTPSHandler):
             full_kwargs = dict(self._connection_args)
             full_kwargs.update(kwargs)
             p = urllib_parse.urlsplit('https://'+netloc)
-            return CertValidatingHTTPSConnection(p.hostname, p.port, **full_kwargs)
+            return http_client.HTTPSConnection(p.hostname, p.port, **full_kwargs)
 
         return self.do_open(http_class_wrapper, req)
 
@@ -627,8 +627,10 @@ def main():
 
     parseargs(parser, envargs + sys.argv[1:])
 
-    httpshandler = VerifiedHTTPSHandler(
-        cafile=options.cafile, capath=options.capath)
+    context = ssl.SSLContext(cafile=options.cafile,
+                             capath=options.capath,
+                             verify_mode=ssl.CERT_REQUIRED)
+    httpshandler = VerifiedHTTPSHandler(context=context)
     if options.debug:
         httpshandler.set_http_debuglevel(1)
     opener = urllib_request.build_opener(httpshandler)

[retzkek]

Here's a more more fleshed out patch with version check, verified to work with 3.8 and 3.6.

diff --git a/htgettoken b/htgettoken
index febb9f1..c8de02f 100755
--- a/htgettoken
+++ b/htgettoken
@@ -272,7 +272,17 @@ class VerifiedHTTPSHandler(urllib_request.HTTPSHandler):
             full_kwargs = dict(self._connection_args)
             full_kwargs.update(kwargs)
             p = urllib_parse.urlsplit('https://'+netloc)
-            return CertValidatingHTTPSConnection(p.hostname, p.port, **full_kwargs)
+            if sys.version_info.major > 3 or \
+               (sys.version_info.major == 3 and sys.version_info.minor >= 7):
+                context = ssl.SSLContext(cafile=full_kwargs['cafile'],
+                                        capath=full_kwargs['capath'],
+                                        verify_mode=ssl.CERT_REQUIRED)
+                del full_kwargs['cafile']
+                del full_kwargs['capath']
+                full_kwargs['context'] = context
+                return http_client.HTTPSConnection(p.hostname, p.port, **full_kwargs)
+            else:
+                return CertValidatingHTTPSConnection(p.hostname, p.port, **full_kwargs)
 
         return self.do_open(http_class_wrapper, req)

I don't actually think whatever python 4 is it will have any semblance of compatibility, but may as well be optimistic.

[DrDaveD]

It turns out that just a week ago I merged pr #18 (not yet in a tagged release) which added another use into CertValidatingHTTPSConnection, to override the host name that is verified to be different than anything in the Subject Alternate Names list on the host cert. That is useful when testing with a multi-host installation without making a new host cert for each of the servers which includes the cluster name as well as the individual host name. That's kind of a niche use case so I don't think that the python library supports that, but on the other hand I'd hate to give it up at this point.

Doesn't 3.8 work by just changing that 'is' into '=='?

[DrDaveD]

Also the comment on CertValidatingHTTPSConnection says to make sure timeouts work as desired. I think that's going to at least take some additional configuration.

[retzkek]

Doesn't 3.8 work by just changing that 'is' into '=='?

That just fixes the warning.

[DrDaveD]

I have been able to reproduce the problem using the rh-python38-python package on el7, and found another workaround for the problem. Please see if #20 fixes the problem for you.

[retzkek]

@DrDaveD thanks, yes that does work for me (tested with 3.8.11 on Darwin/arm64).