diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md index 9be31c9..b782b01 100644 --- a/COMPATIBILITY.md +++ b/COMPATIBILITY.md @@ -16,3 +16,4 @@ | 0.2.2 | 4.4.0 | 4.6.x | | 0.2.3 | 4.4.0 | 4.6.x | | 0.2.4 | 4.4.0 | 4.6.x | +| 0.2.5 | 4.4.0 | 4.6.x | diff --git a/README.md b/README.md index f3880e6..3a5c4cb 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,8 @@ Der Proxmox-Client ignoriert Proxy-Umgebungsvariablen des NetBox-Dienstes, damit Der unauthentifizierte Proxmox-`version`-Probe ist nur diagnostisch. Wenn er haengt, versucht das Plugin den eigentlichen Login trotzdem. +Proxmox-API-Verbindungen nutzen TLS 1.2-Kompatibilitaetsmodus, weil einige Firewalls oder TLS-Inspektionspfade moderne TLS-1.3-ClientHellos blockieren. + Wenn Passwort-Login auf `access/ticket` haengt, zuerst den Realm im Benutzernamen pruefen (`root@pam`, `user@pve`, `user@ldaprealm`). Fuer produktive Imports ist ein Proxmox API-Token meistens stabiler als Passwort-Login. Wenn `Sync interval minutes` gesetzt ist, prueft ein Systemjob alle fuenf Minuten, welche Endpoints faellig sind, und stellt die eigentlichen Sync-Jobs in die Queue. diff --git a/netbox_vmware_importer/__init__.py b/netbox_vmware_importer/__init__.py index 96fcf42..ac09b90 100644 --- a/netbox_vmware_importer/__init__.py +++ b/netbox_vmware_importer/__init__.py @@ -5,7 +5,7 @@ class VMwareImporterConfig(PluginConfig): name = "netbox_vmware_importer" verbose_name = "Virtualization Importer" description = "Synchronize VMware vSphere and Proxmox VE virtual machines into NetBox." - version = "0.2.4" + version = "0.2.5" author = "Internal NetBox Team" base_url = "vmware-importer" min_version = "4.4.0" diff --git a/netbox_vmware_importer/sync.py b/netbox_vmware_importer/sync.py index f789e04..2bc1214 100644 --- a/netbox_vmware_importer/sync.py +++ b/netbox_vmware_importer/sync.py @@ -14,8 +14,10 @@ from .choices import EndpointAuthMethodChoices, EndpointProviderChoices try: import requests + from requests.adapters import HTTPAdapter from urllib3.exceptions import InsecureRequestWarning except ImportError: # pragma: no cover - handled at runtime inside NetBox + HTTPAdapter = None requests = None InsecureRequestWarning = None @@ -83,6 +85,30 @@ class ProxmoxConnectionError(RuntimeError): pass +class ProxmoxTLSCompatibilityAdapter(HTTPAdapter): + def __init__(self, validate_ssl=True, *args, **kwargs): + self.validate_ssl = validate_ssl + super().__init__(*args, **kwargs) + + def init_poolmanager(self, connections, maxsize, block=False, **pool_kwargs): + pool_kwargs["ssl_context"] = self._build_ssl_context() + return super().init_poolmanager(connections, maxsize, block=block, **pool_kwargs) + + def proxy_manager_for(self, *args, **kwargs): + kwargs["ssl_context"] = self._build_ssl_context() + return super().proxy_manager_for(*args, **kwargs) + + def _build_ssl_context(self): + context = ssl.create_default_context() + if hasattr(ssl, "TLSVersion"): + context.minimum_version = ssl.TLSVersion.TLSv1_2 + context.maximum_version = ssl.TLSVersion.TLSv1_2 + if not self.validate_ssl: + context.check_hostname = False + context.verify_mode = ssl.CERT_NONE + return context + + class VMwareClient: def __init__(self, endpoint): self.endpoint = endpoint @@ -244,6 +270,8 @@ class ProxmoxClient: self.session = requests.Session() self.session.trust_env = False self.session.verify = self.endpoint.validate_ssl + if HTTPAdapter is not None: + self.session.mount("https://", ProxmoxTLSCompatibilityAdapter(validate_ssl=self.endpoint.validate_ssl)) self.session.headers.update( { "Accept": "application/json", diff --git a/pyproject.toml b/pyproject.toml index d6938f3..15c0e5b 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta" [project] name = "netbox-vmware-importer" -version = "0.2.4" +version = "0.2.5" description = "NetBox plugin to synchronize VMware vSphere and Proxmox VE virtual machines into NetBox." readme = "README.md" requires-python = ">=3.12"