Use TLS 1.2 compatibility mode for Proxmox API

COMPATIBILITY.md

@@ -16,3 +16,4 @@
 | 0.2.2          | 4.4.0                  | 4.6.x                  |
 | 0.2.3          | 4.4.0                  | 4.6.x                  |
 | 0.2.4          | 4.4.0                  | 4.6.x                  |
+| 0.2.5          | 4.4.0                  | 4.6.x                  |

README.md

@@ -58,6 +58,8 @@ Der Proxmox-Client ignoriert Proxy-Umgebungsvariablen des NetBox-Dienstes, damit
 
 Der unauthentifizierte Proxmox-`version`-Probe ist nur diagnostisch. Wenn er haengt, versucht das Plugin den eigentlichen Login trotzdem.
 
+Proxmox-API-Verbindungen nutzen TLS 1.2-Kompatibilitaetsmodus, weil einige Firewalls oder TLS-Inspektionspfade moderne TLS-1.3-ClientHellos blockieren.
+
 Wenn Passwort-Login auf `access/ticket` haengt, zuerst den Realm im Benutzernamen pruefen (`root@pam`, `user@pve`, `user@ldaprealm`). Fuer produktive Imports ist ein Proxmox API-Token meistens stabiler als Passwort-Login.
 
 Wenn `Sync interval minutes` gesetzt ist, prueft ein Systemjob alle fuenf Minuten, welche Endpoints faellig sind, und stellt die eigentlichen Sync-Jobs in die Queue.

netbox_vmware_importer/__init__.py

@@ -5,7 +5,7 @@ class VMwareImporterConfig(PluginConfig):
     name = "netbox_vmware_importer"
     verbose_name = "Virtualization Importer"
     description = "Synchronize VMware vSphere and Proxmox VE virtual machines into NetBox."
-    version = "0.2.4"
+    version = "0.2.5"
     author = "Internal NetBox Team"
     base_url = "vmware-importer"
     min_version = "4.4.0"

netbox_vmware_importer/sync.py

@@ -14,8 +14,10 @@ from .choices import EndpointAuthMethodChoices, EndpointProviderChoices
 
 try:
     import requests
+    from requests.adapters import HTTPAdapter
     from urllib3.exceptions import InsecureRequestWarning
 except ImportError:  # pragma: no cover - handled at runtime inside NetBox
+    HTTPAdapter = None
     requests = None
     InsecureRequestWarning = None
 
@@ -83,6 +85,30 @@ class ProxmoxConnectionError(RuntimeError):
     pass
 
 
+class ProxmoxTLSCompatibilityAdapter(HTTPAdapter):
+    def __init__(self, validate_ssl=True, *args, **kwargs):
+        self.validate_ssl = validate_ssl
+        super().__init__(*args, **kwargs)
+
+    def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs):
+        pool_kwargs["ssl_context"] = self._build_ssl_context()
+        return super().init_poolmanager(connections, maxsize, block=block, **pool_kwargs)
+
+    def proxy_manager_for(self, *args, **kwargs):
+        kwargs["ssl_context"] = self._build_ssl_context()
+        return super().proxy_manager_for(*args, **kwargs)
+
+    def _build_ssl_context(self):
+        context = ssl.create_default_context()
+        if hasattr(ssl, "TLSVersion"):
+            context.minimum_version = ssl.TLSVersion.TLSv1_2
+            context.maximum_version = ssl.TLSVersion.TLSv1_2
+        if not self.validate_ssl:
+            context.check_hostname = False
+            context.verify_mode = ssl.CERT_NONE
+        return context
+
+
 class VMwareClient:
     def __init__(self, endpoint):
         self.endpoint = endpoint
@@ -244,6 +270,8 @@ class ProxmoxClient:
         self.session = requests.Session()
         self.session.trust_env = False
         self.session.verify = self.endpoint.validate_ssl
+        if HTTPAdapter is not None:
+            self.session.mount("https://", ProxmoxTLSCompatibilityAdapter(validate_ssl=self.endpoint.validate_ssl))
         self.session.headers.update(
             {
                 "Accept": "application/json",

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "netbox-vmware-importer"
-version = "0.2.4"
+version = "0.2.5"
 description = "NetBox plugin to synchronize VMware vSphere and Proxmox VE virtual machines into NetBox."
 readme = "README.md"
 requires-python = ">=3.12"