Add python 3.12 support

.github/workflows/tox.yml

@@ -15,6 +15,8 @@ jobs:
                     - {version: '3.9', env: py39}
                     - {version: '3.10', env: py310}
                     - {version: '3.11', env: py311}
+                    - {version: '3.12', env: py312}
+                    - {version: '3.13', env: py313}
                 test_mode: [0, 1]
         runs-on: ${{ matrix.os }}
         env:
@@ -35,7 +37,7 @@ jobs:
         strategy:
             matrix:
                 os: [ubuntu-latest]
-                python: ['3.8', '3.9', '3.10', '3.11']
+                python: ['3.8', '3.9', '3.10', '3.11', '3.12', '3.13']
                 test: [pep8, bandit, docs]
         runs-on: ${{ matrix.os }}
         env:

docs/source/conf.py

@@ -85,7 +85,7 @@
 #
 #html_theme = 'alabaster'
 html_theme = "sphinx_rtd_theme"
-html_theme_path = [sphinx_rtd_theme.get_html_theme_path()]
+# html_theme_path = []
 
 # Theme options are theme-specific and customize the look and feel of a theme
 # further.  For a list of options available for each theme, see the
@@ -169,6 +169,3 @@
      author, 'PyKMIP', 'One line description of project.',
      'Miscellaneous'),
 ]
-
-
-

kmip/__init__.py

@@ -15,8 +15,6 @@
 
 import os
 import re
-import sys
-import warnings
 
 from kmip.core import enums
 from kmip.pie import client
@@ -46,22 +44,3 @@
     'objects',
     'services'
 ]
-
-
-if sys.version_info[:2] == (2, 7):
-    warnings.warn(
-        (
-            "PyKMIP will drop support for Python 2.7 in a future release. "
-            "Please upgrade to a newer version of Python (3.5+ preferred)."
-        ),
-        PendingDeprecationWarning
-    )
-
-if sys.version_info[:2] == (3, 4):
-    warnings.warn(
-        (
-            "PyKMIP will drop support for Python 3.4 in a future release. "
-            "Please upgrade to a newer version of Python (3.5+ preferred)."
-        ),
-        PendingDeprecationWarning
-    )

kmip/services/kmip_client.py

@@ -285,13 +285,17 @@ def open(self):
             six.reraise(*last_error)
 
     def _create_socket(self, sock):
-        self.socket = ssl.wrap_socket(
+        context = ssl.SSLContext(self.ssl_version)
+        context.verify_mode = self.cert_reqs
+        if self.ca_certs:
+            context.load_verify_locations(self.ca_certs)
+        if self.keyfile and not self.certfile:
+            raise ValueError("certfile must be specified")
+        if self.certfile:
+            context.load_cert_chain(self.certfile, self.keyfile)
+        self.socket = context.wrap_socket(
             sock,
-            keyfile=self.keyfile,
-            certfile=self.certfile,
-            cert_reqs=self.cert_reqs,
-            ssl_version=self.ssl_version,
-            ca_certs=self.ca_certs,
+            server_side=False,
             do_handshake_on_connect=self.do_handshake_on_connect,
             suppress_ragged_eofs=self.suppress_ragged_eofs)
         self.socket.settimeout(self.timeout)

kmip/services/server/crypto/engine.py

@@ -584,13 +584,17 @@ def _encrypt_asymmetric(self,
                     "encryption.".format(padding_method)
                 )
 
-            backend = default_backend()
-
             try:
-                public_key = backend.load_der_public_key(encryption_key)
+                public_key = serialization.load_der_public_key(
+                    encryption_key,
+                    backend=default_backend()
+                )
             except Exception:
                 try:
-                    public_key = backend.load_pem_public_key(encryption_key)
+                    public_key = serialization.load_pem_public_key(
+                        encryption_key,
+                        backend=default_backend()
+                    )
                 except Exception:
                     raise exceptions.CryptographicFailure(
                         "The public key bytes could not be loaded."
@@ -1433,8 +1437,6 @@ def verify_signature(self,
                 loaded, or when the signature verification process fails
                 unexpectedly.
         """
-        backend = default_backend()
-
         hash_algorithm = None
         dsa_hash_algorithm = None
         dsa_signing_algorithm = None
@@ -1488,10 +1490,16 @@ def verify_signature(self,
                 )
 
             try:
-                public_key = backend.load_der_public_key(signing_key)
+                public_key = serialization.load_der_public_key(
+                    signing_key,
+                    backend=default_backend()
+                )
             except Exception:
                 try:
-                    public_key = backend.load_pem_public_key(signing_key)
+                    public_key = serialization.load_pem_public_key(
+                        signing_key,
+                        backend=default_backend()
+                    )
                 except Exception:
                     raise exceptions.CryptographicFailure(
                         "The signing key bytes could not be loaded."

kmip/services/server/server.py

@@ -287,17 +287,22 @@ def interrupt_handler(trigger, frame):
         for cipher in auth_suite_ciphers:
             self._logger.debug(cipher)
 
-        self._socket = ssl.wrap_socket(
+        cafile = self.config.settings.get('ca_path')
+        context = ssl.SSLContext(self.auth_suite.protocol)
+        context.verify_mode = ssl.CERT_REQUIRED
+        if self.auth_suite.ciphers:
+            context.set_ciphers(self.auth_suite.ciphers)
+        if cafile:
+            context.load_verify_locations(cafile)
+        certfile = self.config.settings.get('certificate_path')
+        keyfile = self.config.settings.get('key_path')
+        context.load_cert_chain(certfile, keyfile=keyfile)
+
+        self._socket = context.wrap_socket(
             self._socket,
-            keyfile=self.config.settings.get('key_path'),
-            certfile=self.config.settings.get('certificate_path'),
             server_side=True,
-            cert_reqs=ssl.CERT_REQUIRED,
-            ssl_version=self.auth_suite.protocol,
-            ca_certs=self.config.settings.get('ca_path'),
             do_handshake_on_connect=False,
-            suppress_ragged_eofs=True,
-            ciphers=self.auth_suite.ciphers
+            suppress_ragged_eofs=True
         )
 
         try:

kmip/services/server/session.py

@@ -14,6 +14,7 @@
 # under the License.
 
 import binascii
+import errno
 import logging
 import socket
 import struct
@@ -113,8 +114,13 @@ def run(self):
                     self._logger.info("Failure handling message loop")
                     self._logger.exception(e)
 
-        self._connection.shutdown(socket.SHUT_RDWR)
-        self._connection.close()
+        try:
+            self._connection.shutdown(socket.SHUT_RDWR)
+        except OSError as e:
+            if e.errno != errno.ENOTCONN:
+                raise
+        finally:
+            self._connection.close()
         self._logger.info("Stopping session: {0}".format(self.name))
 
     def _handle_message_loop(self):

kmip/tests/unit/services/server/test_server.py

@@ -210,9 +210,10 @@ def test_start(self,
         # Test that in ideal cases no errors are generated and the right
         # log messages are.
         with mock.patch('socket.socket') as socket_mock:
-            with mock.patch('ssl.wrap_socket') as ssl_mock:
+            with mock.patch('ssl.SSLContext') as ssl_mock:
                 socket_mock.return_value = a_mock
-                ssl_mock.return_value = b_mock
+                ssl_mock.return_value.wrap_socket.return_value = b_mock
+                ssl_mock.return_value.load_cert_chain.return_value = None
 
                 manager_mock.assert_not_called()
                 monitor_mock.assert_not_called()
@@ -271,9 +272,10 @@ def test_start(self,
 
         # Test that a NetworkingError is generated if the socket bind fails.
         with mock.patch('socket.socket') as socket_mock:
-            with mock.patch('ssl.wrap_socket') as ssl_mock:
+            with mock.patch('ssl.SSLContext') as ssl_mock:
                 socket_mock.return_value = a_mock
-                ssl_mock.return_value = b_mock
+                ssl_mock.return_value.wrap_socket.return_value = b_mock
+                ssl_mock.return_value.load_cert_chain.return_value = None
 
                 test_exception = Exception()
                 b_mock.bind.side_effect = test_exception

requirements.txt

@@ -1,4 +1,4 @@
-cryptography>=1.4
+cryptography>=2.5
 enum-compat
 requests
 six>=1.11.0

setup.py

@@ -57,6 +57,7 @@
         "six",
         "sqlalchemy"
     ],
+    python_requires=">= 3.8",
     classifiers=[
         "Intended Audience :: Developers",
         "License :: OSI Approved :: Apache Software License",
@@ -65,11 +66,13 @@
         "Operating System :: POSIX :: BSD",
         "Operating System :: POSIX :: Linux",
         "Programming Language :: Python",
-        "Programming Language :: Python :: 2",
-        "Programming Language :: Python :: 2.7",
-        "Programming Language :: Python :: 3.4",
-        "Programming Language :: Python :: 3.5",
-        "Programming Language :: Python :: 3.6",
-        "Programming Language :: Python :: 3.7",
+        "Programming Language :: Python :: 3",
+        "Programming Language :: Python :: 3 :: Only",
+        "Programming Language :: Python :: 3.8",
+        "Programming Language :: Python :: 3.9",
+        "Programming Language :: Python :: 3.10",
+        "Programming Language :: Python :: 3.11",
+        "Programming Language :: Python :: 3.12",
+        "Programming Language :: Python :: 3.13",
     ],
 )