Skip to content

Commit

Permalink
Use ssl.match_hostname from urllib3 as it was removed from Python 3.12
Browse files Browse the repository at this point in the history
Based on upstream freeipa rawhide patch by Miro Hrončok

See python/cpython#94224 (comment)

Fixes: https://pagure.io/freeipa/issue/9409

Signed-off-by: Rob Crittenden <rcritten@redhat.com>
  • Loading branch information
hroncok authored and rcritten committed Jul 7, 2023
1 parent 4a3e3ef commit a8a733a
Show file tree
Hide file tree
Showing 4 changed files with 15 additions and 8 deletions.
7 changes: 6 additions & 1 deletion freeipa.spec.in
Original file line number Diff line number Diff line change
Expand Up @@ -324,6 +324,11 @@ BuildRequires: libunistring-devel
# 0.13.0-2: fix for missing dependency on python-six
BuildRequires: python3-lesscpy >= 0.13.0-2
BuildRequires: cracklib-dicts
%if 0%{?rhel}
BuildRequires: python3-urllib3 >= 1.24.2-3
%else
BuildRequires: python3-urllib3 >= 1.25.8
%endif
# ONLY_CLIENT
%endif

Expand Down Expand Up @@ -569,7 +574,7 @@ Requires: rpm-libs
%if 0%{?rhel}
Requires: python3-urllib3 >= 1.24.2-3
%else
Requires: python3-urllib3 >= 1.25.7
Requires: python3-urllib3 >= 1.25.8
%endif

%description -n python3-ipaserver
Expand Down
10 changes: 7 additions & 3 deletions ipalib/x509.py
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,6 @@
import datetime
import enum
import ipaddress
import ssl
import base64
import re

Expand All @@ -53,6 +52,11 @@
from pyasn1_modules import rfc2315, rfc2459
import six

try:
from urllib3.util import ssl_match_hostname
except ImportError:
from urllib3.packages import ssl_match_hostname

from ipalib import errors
from ipapython.dnsutil import DNSName

Expand Down Expand Up @@ -385,6 +389,7 @@ def san_a_label_dns_names(self):
return result

def match_hostname(self, hostname):
# The caller is expected to catch any exceptions
match_cert = {}

match_cert['subject'] = match_subject = []
Expand All @@ -401,8 +406,7 @@ def match_hostname(self, hostname):
for value in values:
match_san.append(('DNS', value))

# deprecated in Python3.7 without replacement
ssl.match_hostname( # pylint: disable=deprecated-method
ssl_match_hostname.match_hostname(
match_cert, DNSName(hostname).ToASCII()
)

Expand Down
3 changes: 1 addition & 2 deletions ipaserver/install/cainstance.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,6 @@
import os
import re
import shutil
import ssl
import sys
import syslog
import time
Expand Down Expand Up @@ -2378,7 +2377,7 @@ def check_ipa_ca_san(cert):

try:
cert.match_hostname(expect)
except ssl.CertificateError:
except x509.ssl_match_hostname.CertificateError:
raise errors.ValidationError(
name='certificate',
error='Does not have a \'{}\' SAN'.format(expect)
Expand Down
3 changes: 1 addition & 2 deletions ipaserver/install/server/upgrade.py
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@
import glob
import shutil
import fileinput
import ssl
import stat
import sys
import tempfile
Expand Down Expand Up @@ -717,7 +716,7 @@ def http_certificate_ensure_ipa_ca_dnsname(http):

try:
cert.match_hostname(expect)
except ssl.CertificateError:
except x509.ssl_match_hostname.CertificateError:
if certs.is_ipa_issued_cert(api, cert):
request_id = certmonger.get_request_id(
{'cert-file': paths.HTTPD_CERT_FILE})
Expand Down

0 comments on commit a8a733a

Please sign in to comment.