mcp-proxy-adapter 6.2.18__py3-none-any.whl → 6.2.22__py3-none-any.whl

mcp_proxy_adapter/examples/run_security_tests.py

@@ -14,11 +14,15 @@ import asyncio
 import json
 import os
 import signal
+import socket
 import subprocess
 import sys
 import time
 from pathlib import Path
-from typing import Dict, List, Optional, Any
+from typing import Dict, List, Optional, Any, Tuple
+
+import psutil
+import requests
 # Import security test client with proper module path
 from mcp_proxy_adapter.examples.security_test_client import SecurityTestClient, TestResult
 class SecurityTestRunner:
@@ -27,39 +31,149 @@ class SecurityTestRunner:
         """Initialize test runner."""
         self.servers = {}
         self.proxy_server = None
+        self.server_logs = {}
+        self.proxy_log = None
         self.test_results = {}
+        # Base and proxy ports
+        self.base_port = 20000
+        self.proxy_port = 20010
+        # Server configurations with ports starting from 20000
         self.configs = {
             "basic_http": {
                 "config": "configs/http_simple.json",
-                "port": 8000,
-                "url": "http://localhost:8000",
+                "port": self.base_port + 0,
+                "url": f"http://localhost:{self.base_port + 0}",
                 "auth": "none"
             },
             "http_token": {
                 "config": "configs/http_token.json",
-                "port": 8001,
-                "url": "http://localhost:8001",
+                "port": self.base_port + 1,
+                "url": f"http://localhost:{self.base_port + 1}",
                 "auth": "api_key"
             },
             "https": {
                 "config": "configs/https_simple.json",
-                "port": 8002,
-                "url": "https://localhost:8002",
+                "port": self.base_port + 2,
+                "url": f"https://localhost:{self.base_port + 2}",
                 "auth": "none"
             },
             "https_token": {
                 "config": "configs/https_token.json",
-                "port": 8003,
-                "url": "https://localhost:8003",
+                "port": self.base_port + 3,
+                "url": f"https://localhost:{self.base_port + 3}",
                 "auth": "api_key"
             },
             "mtls": {
                 "config": "configs/mtls_no_roles.json",
-                "port": 8004,
-                "url": "https://localhost:8004",
+                "port": self.base_port + 4,
+                "url": f"https://localhost:{self.base_port + 4}",
                 "auth": "certificate"
             }
         }
+
+    def _port_in_use(self, port: int, host: str = "127.0.0.1") -> bool:
+        try:
+            with socket.create_connection((host, port), timeout=0.5):
+                return True
+        except Exception:
+            return False
+
+    def _pids_on_port(self, port: int) -> List[int]:
+        pids: List[int] = []
+        try:
+            for proc in psutil.process_iter(attrs=["pid", "connections"]):
+                for c in proc.connections(kind="inet"):
+                    if c.laddr and c.laddr.port == port:
+                        pids.append(proc.pid)
+                        break
+        except Exception:
+            pass
+        return list(set(pids))
+
+    def ensure_ports_free(self, ports: List[int]) -> None:
+        for port in ports:
+            pids = self._pids_on_port(port)
+            for pid in pids:
+                try:
+                    psutil.Process(pid).terminate()
+                except Exception:
+                    pass
+            time.sleep(0.3)
+            for pid in pids:
+                try:
+                    if psutil.pid_exists(pid):
+                        psutil.Process(pid).kill()
+                except Exception:
+                    pass
+
+    def wait_for_http(self, url: str, timeout_sec: float = 8.0) -> bool:
+        end = time.time() + timeout_sec
+        candidates = ["/health", "/proxy/health"]
+        while time.time() < end:
+            for path in candidates:
+                health_url = url.rstrip("/") + path
+                try:
+                    resp = requests.get(health_url, timeout=1.0, verify=False)
+                    if resp.status_code == 200:
+                        return True
+                except Exception:
+                    pass
+            time.sleep(0.2)
+        return False
+
+    def wait_for_port(self, port: int, timeout_sec: float = 8.0) -> bool:
+        end = time.time() + timeout_sec
+        while time.time() < end:
+            if self._port_in_use(port):
+                return True
+            time.sleep(0.2)
+        return False
+
+    def get_all_ports(self) -> List[int]:
+        ports = [self.proxy_port]
+        for cfg in self.configs.values():
+            ports.append(cfg["port"])
+        return list(sorted(set(ports)))
+
+    def _validate_file(self, base: Path, path_value: Optional[str]) -> Tuple[bool, str]:
+        if not path_value:
+            return True, ""
+        p = Path(path_value)
+        if not p.is_absolute():
+            p = base / p
+        return p.exists(), str(p)
+
+    def validate_config_files(self) -> bool:
+        ok = True
+        base = Path.cwd()
+        missing: List[str] = []
+        for name, cfg in self.configs.items():
+            cfg_path = Path(cfg["config"]).resolve()
+            try:
+                with open(cfg_path, "r", encoding="utf-8") as f:
+                    data = json.load(f)
+                ssl = data.get("ssl", {})
+                for key in ("cert_file", "key_file", "ca_cert"):
+                    exists, abs_path = self._validate_file(base, ssl.get(key))
+                    if ssl.get("enabled") and key in ("cert_file", "key_file") and not exists:
+                        ok = False
+                        missing.append(f"{name}:{key} -> {abs_path}")
+                sec = data.get("security", {})
+                perms = sec.get("permissions", {})
+                exists, abs_path = self._validate_file(base, perms.get("roles_file"))
+                if sec.get("enabled") and perms.get("enabled") and not exists:
+                    ok = False
+                    missing.append(f"{name}:roles_file -> {abs_path}")
+            except Exception as e:
+                ok = False
+                missing.append(f"{name}: cannot read {cfg_path} ({e})")
+        if not ok:
+            print("❌ CONFIG VALIDATION FAILED. Missing files:")
+            for m in missing:
+                print("   -", m)
+        else:
+            print("✅ Configuration file paths validated")
+        return ok
     def check_prerequisites(self) -> bool:
         """Check if all prerequisites are met."""
         print("🔍 Checking prerequisites...")
@@ -69,7 +183,7 @@ class SecurityTestRunner:
             return False
         # Check if certificates exist
         cert_files = [
-            "certs/mcp_proxy_adapter_test_ca_ca.crt",
+             "certs/mcp_proxy_adapter_ca_ca.crt",
             "certs/localhost_server.crt",
             "keys/localhost_server.key"
         ]
@@ -87,11 +201,26 @@ class SecurityTestRunner:
         """Start a server in background."""
         try:
             print(f"🚀 Starting {name} server on port {port}...")
+            # Ensure the port is free just before starting
+            self.ensure_ports_free([port])
+            if self._port_in_use(port):
+                print(f"⚠️ Port {port} still busy, waiting...")
+                if not self.wait_for_port(port, timeout_sec=1.5):
+                    # After wait_for_port True means busy; we invert logic here
+                    pass
+            # If still busy after attempts, abort this server start
+            if self._port_in_use(port):
+                print(f"❌ Port {port} is in use, cannot start {name}")
+                return None
             # Start server in background
+            logs_dir = Path("logs"); logs_dir.mkdir(exist_ok=True)
+            log_path = logs_dir / f"{name}.log"
+            log_file = open(log_path, "wb")
+            self.server_logs[name] = log_file
             process = subprocess.Popen([
                 sys.executable, "-m", "mcp_proxy_adapter.main",
                 "--config", config_path
-            ], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+            ], stdout=log_file, stderr=subprocess.STDOUT)
             # Wait a bit for server to start
             time.sleep(3)
             # Check if process is still running
@@ -99,10 +228,7 @@ class SecurityTestRunner:
                 print(f"✅ {name} server started (PID: {process.pid})")
                 return process
             else:
-                stdout, stderr = process.communicate()
-                print(f"❌ Failed to start {name} server:")
-                print(f"STDOUT: {stdout.decode()}")
-                print(f"STDERR: {stderr.decode()}")
+                print(f"❌ Failed to start {name} server (see logs/{name}.log)")
                 return None
         except Exception as e:
             print(f"❌ Error starting {name} server: {e}")
@@ -122,6 +248,13 @@ class SecurityTestRunner:
                 process.wait()
         except Exception as e:
             print(f"❌ Error stopping {name} server: {e}")
+        finally:
+            try:
+                lf = self.server_logs.pop(name, None)
+                if lf:
+                    lf.close()
+            except Exception:
+                pass
 
     def start_proxy_server(self) -> bool:
         """Start the proxy server for server registration."""
@@ -134,27 +267,24 @@ class SecurityTestRunner:
                 return False
 
             # Start proxy server
-            cmd = [sys.executable, str(proxy_script), "--host", "127.0.0.1", "--port", "3004"]
+            cmd = [sys.executable, str(proxy_script), "--host", "127.0.0.1", "--port", str(self.proxy_port)]
+            logs_dir = Path("logs"); logs_dir.mkdir(exist_ok=True)
+            proxy_log_path = logs_dir / "proxy_server.log"
+            self.proxy_log = open(proxy_log_path, "wb")
             process = subprocess.Popen(
                 cmd,
-                stdout=subprocess.PIPE,
-                stderr=subprocess.PIPE,
+                stdout=self.proxy_log,
+                stderr=subprocess.STDOUT,
                 cwd=Path.cwd()
             )
 
-            # Wait a bit for server to start
-            time.sleep(2)
-
-            # Check if process is still running
-            if process.poll() is None:
+            # Check readiness
+            if process.poll() is None and self.wait_for_http(f"http://127.0.0.1:{self.proxy_port}"):
                 self.proxy_server = process
                 print("✅ Proxy server started successfully (PID: {})".format(process.pid))
                 return True
             else:
-                stdout, stderr = process.communicate()
-                print("❌ Failed to start proxy server:")
-                print("STDOUT:", stdout.decode())
-                print("STDERR:", stderr.decode())
+                print("❌ Failed to start proxy server (see logs/proxy_server.log)")
                 return False
 
         except Exception as e:
@@ -178,6 +308,12 @@ class SecurityTestRunner:
                 print(f"❌ Error stopping proxy server: {e}")
             finally:
                 self.proxy_server = None
+                try:
+                    if self.proxy_log:
+                        self.proxy_log.close()
+                        self.proxy_log = None
+                except Exception:
+                    pass
     async def test_server(self, name: str, config: Dict[str, Any]) -> List[TestResult]:
         """Test a specific server configuration."""
         print(f"\n🧪 Testing {name} server...")
@@ -209,16 +345,23 @@ class SecurityTestRunner:
         """Run tests against all server configurations."""
         print("🚀 Starting comprehensive security testing")
         print("=" * 60)
-        # Start all servers
+        # Start all servers with verification and abort on failure
         for name, config in self.configs.items():
             process = self.start_server(name, config["config"], config["port"])
-            if process:
-                self.servers[name] = process
+            if not process:
+                print(f"❌ {name} failed to start. Aborting.")
+                return {}
+            url = config["url"]
+            ready = False
+            if name == "mtls":
+                ready = self.wait_for_port(config["port"], timeout_sec=8.0)
             else:
-                print(f"⚠️ Skipping tests for {name} due to startup failure")
-        # Wait for all servers to be ready
-        print("\n⏳ Waiting for servers to be ready...")
-        time.sleep(5)
+                ready = self.wait_for_http(url, timeout_sec=8.0)
+            if not ready:
+                print(f"❌ {name} did not become ready. Aborting.")
+                return {}
+            self.servers[name] = process
+        print("\n✅ All servers started and verified. Proceeding to client tests...")
         # Test each server
         all_results = {}
         for name, config in self.configs.items():
@@ -320,6 +463,14 @@ class SecurityTestRunner:
             if not self.check_prerequisites():
                 return False
 
+            # Free ports before run
+            print("\n🧹 Freeing ports before startup...")
+            self.ensure_ports_free(self.get_all_ports())
+
+            # Validate config file paths
+            if not self.validate_config_files():
+                return False
+
             # Start proxy server first
             print("\n🚀 Starting proxy server for server registration...")
             if not self.start_proxy_server():

mcp_proxy_adapter/examples/security_test_client.py

@@ -21,6 +21,7 @@ from typing import Dict, List, Optional, Any
 from dataclasses import dataclass
 import aiohttp
 from aiohttp import ClientSession, ClientTimeout, TCPConnector
+
 # Add project root to path for imports
 project_root = Path(__file__).parent.parent.parent
 current_dir = Path(__file__).parent
@@ -28,6 +29,26 @@ parent_dir = current_dir.parent
 sys.path.insert(0, str(project_root))
 sys.path.insert(0, str(current_dir))
 sys.path.insert(0, str(parent_dir))
+
+# Import mcp_security_framework components
+try:
+    from mcp_security_framework import SSLManager, CertificateManager
+    from mcp_security_framework.schemas.config import SSLConfig
+    _MCP_SECURITY_AVAILABLE = True
+    print("✅ mcp_security_framework available")
+except ImportError:
+    _MCP_SECURITY_AVAILABLE = False
+    print("⚠️ mcp_security_framework not available, falling back to standard SSL")
+
+# Import cryptography components
+try:
+    from cryptography import x509
+    from cryptography.hazmat.primitives import serialization
+    _CRYPTOGRAPHY_AVAILABLE = True
+    print("✅ cryptography available")
+except ImportError:
+    _CRYPTOGRAPHY_AVAILABLE = False
+    print("⚠️ cryptography not available, SSL validation will be limited")
 @dataclass
 class TestResult:
     """Test result data class."""
@@ -45,11 +66,33 @@ class SecurityTestClient:
         """Initialize security test client."""
         self.base_url = base_url
         self.session: Optional[ClientSession] = None
-        # Note: For basic testing, we'll use simple SSL context creation
-        # instead of full mcp_security_framework integration
-        self.security_manager = None
+
+        # Initialize security managers if available
         self.ssl_manager = None
-        self.auth_manager = None
+        self.cert_manager = None
+        self._security_available = _MCP_SECURITY_AVAILABLE
+        self._crypto_available = _CRYPTOGRAPHY_AVAILABLE
+
+        if self._security_available:
+            try:
+                # Initialize SSL manager with default config
+                ssl_config = SSLConfig(
+                    enabled=True,
+                    cert_file=None,
+                    key_file=None,
+                    ca_cert_file=None,
+                    verify_mode="CERT_NONE",  # For testing
+                    min_tls_version="TLSv1.2"
+                )
+                self.ssl_manager = SSLManager(ssl_config)
+                print("✅ SSL Manager initialized with mcp_security_framework")
+            except Exception as e:
+                print(f"⚠️ Failed to initialize SSL Manager: {e}")
+                self._security_available = False
+
+        if not self._security_available:
+            print("ℹ️ Using standard SSL library for testing")
+            self.ssl_manager = None
         self.test_results: List[TestResult] = []
         # Test tokens
         self.test_tokens = {
@@ -85,14 +128,33 @@ class SecurityTestClient:
         return self
     def create_ssl_context_for_mtls(self) -> ssl.SSLContext:
         """Create SSL context for mTLS connections."""
-        ssl_context = ssl.create_default_context()
-        # For mTLS testing
+        if self.ssl_manager and self._security_available:
+            try:
+                # Use mcp_security_framework for mTLS
+                cert_file = "./certs/user_cert.pem"
+                key_file = "./certs/user_key.pem"
+                ca_cert_file = "./certs/mcp_proxy_adapter_ca_ca.crt"
+
+                return self.ssl_manager.create_client_context(
+                    ca_cert_file=ca_cert_file if os.path.exists(ca_cert_file) else None,
+                    client_cert_file=cert_file if os.path.exists(cert_file) else None,
+                    client_key_file=key_file if os.path.exists(key_file) else None,
+                    verify_mode="CERT_NONE",  # For testing
+                    min_version="TLSv1.2"
+                )
+            except Exception as e:
+                print(f"⚠️ Failed to create mTLS context with mcp_security_framework: {e}")
+                print("ℹ️ Falling back to standard SSL")
+
+        # Fallback to standard SSL
+        ssl_context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+        # For mTLS testing - client needs to present certificate to server
         ssl_context.check_hostname = False
-        ssl_context.verify_mode = ssl.CERT_NONE
-        # Load client certificate and key
+        ssl_context.verify_mode = ssl.CERT_NONE  # Don't verify server cert for testing
+        # Load client certificate and key for mTLS
         cert_file = "./certs/user_cert.pem"
         key_file = "./certs/user_key.pem"
-        ca_cert_file = "./certs/ca_cert.pem"
+        ca_cert_file = "./certs/mcp_proxy_adapter_ca_ca.crt"
         if os.path.exists(cert_file) and os.path.exists(key_file):
             ssl_context.load_cert_chain(certfile=cert_file, keyfile=key_file)
         if os.path.exists(ca_cert_file):
@@ -106,6 +168,21 @@ class SecurityTestClient:
                           key_file: Optional[str] = None,
                           ca_cert_file: Optional[str] = None) -> ssl.SSLContext:
         """Create SSL context for client."""
+        if self.ssl_manager and self._security_available:
+            try:
+                # Use mcp_security_framework for SSL context creation
+                return self.ssl_manager.create_client_context(
+                    ca_cert_file=ca_cert_file if ca_cert_file and os.path.exists(ca_cert_file) else None,
+                    client_cert_file=cert_file if cert_file and os.path.exists(cert_file) else None,
+                    client_key_file=key_file if key_file and os.path.exists(key_file) else None,
+                    verify_mode="CERT_NONE",  # For testing
+                    min_version="TLSv1.2"
+                )
+            except Exception as e:
+                print(f"⚠️ Failed to create SSL context with mcp_security_framework: {e}")
+                print("ℹ️ Falling back to standard SSL")
+
+        # Fallback to standard SSL
         ssl_context = ssl.create_default_context()
         # For testing with self-signed certificates
         ssl_context.check_hostname = False
@@ -121,8 +198,10 @@ class SecurityTestClient:
         """Create authentication headers."""
         headers = {"Content-Type": "application/json"}
         if auth_type == "api_key":
-            token = kwargs.get("token", "test-token-123")  # Use correct token
-            headers["X-API-Key"] = token  # Use X-API-Key header
+            token = kwargs.get("token", "test-token-123")
+            # Provide both common header styles to maximize compatibility
+            headers["X-API-Key"] = token
+            headers["Authorization"] = f"Bearer {token}"
         elif auth_type == "basic":
             username = kwargs.get("username", "admin")
             password = kwargs.get("password", "password")
@@ -306,39 +385,104 @@ class SecurityTestClient:
         start_time = time.time()
         test_name = f"Negative Auth ({auth_type})"
         try:
-            # Use invalid token
-            headers = self.create_auth_headers("api_key", token="invalid-token-999")
-            data = {
-                "jsonrpc": "2.0",
-                "method": "echo",
-                "params": {"message": "Should fail"},
-                "id": 3
-            }
-            async with self.session.post(f"{server_url}/cmd",
-                                        headers=headers,
-                                        json=data) as response:
-                duration = time.time() - start_time
-                # Expected to fail with 401
-                if response.status == 401:
-                    return TestResult(
-                        test_name=test_name,
-                        server_url=server_url,
-                        auth_type=auth_type,
-                        success=True,  # This is expected to fail
-                        status_code=response.status,
-                        response_data={"expected": "authentication_failure"},
-                        duration=duration
-                    )
-                else:
+            if auth_type == "certificate":
+                # For mTLS, test with invalid/expired certificate or no certificate
+                import aiohttp
+                from aiohttp import ClientTimeout, TCPConnector
+                import ssl
+
+                # Create SSL context with wrong certificate (should be rejected)
+                ssl_context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+                ssl_context.check_hostname = False
+                # Don't load any client certificate - this should cause rejection
+                # Load CA certificate for server verification
+                ca_cert_file = "./certs/mcp_proxy_adapter_ca_ca.crt"
+                if os.path.exists(ca_cert_file):
+                    ssl_context.load_verify_locations(cafile=ca_cert_file)
+                ssl_context.verify_mode = ssl.CERT_NONE  # Don't verify server cert for testing
+
+                connector = TCPConnector(ssl=ssl_context)
+                timeout = ClientTimeout(total=10)  # Shorter timeout
+
+                try:
+                    async with aiohttp.ClientSession(timeout=timeout, connector=connector) as temp_session:
+                        data = {
+                            "jsonrpc": "2.0",
+                            "method": "echo",
+                            "params": {"message": "Should fail without certificate"},
+                            "id": 3
+                        }
+                        async with temp_session.post(f"{server_url}/cmd", json=data) as response:
+                            duration = time.time() - start_time
+                            # If we get here, the server accepted the connection without proper certificate
+                            # This is actually a security issue - server should reject
+                            return TestResult(
+                                test_name=test_name,
+                                server_url=server_url,
+                                auth_type=auth_type,
+                                success=False,
+                                status_code=response.status,
+                                error_message=f"SECURITY ISSUE: mTLS server accepted connection without client certificate (status: {response.status})",
+                                duration=duration
+                            )
+                except (aiohttp.ClientError, aiohttp.ServerDisconnectedError, asyncio.TimeoutError) as e:
+                    # This is expected - server should reject connections without proper certificate
+                    duration = time.time() - start_time
                     return TestResult(
                         test_name=test_name,
                         server_url=server_url,
                         auth_type=auth_type,
-                        success=False,
-                        status_code=response.status,
-                        error_message=f"Expected 401, got {response.status}",
+                        success=True,
+                        status_code=0,
+                        response_data={"expected": "connection_rejected", "error": str(e)},
                         duration=duration
                     )
+            else:
+                # For other auth types, use invalid token
+                headers = self.create_auth_headers("api_key", token="invalid-token-999")
+                data = {
+                    "jsonrpc": "2.0",
+                    "method": "echo",
+                    "params": {"message": "Should fail"},
+                    "id": 3
+                }
+                async with self.session.post(f"{server_url}/cmd",
+                                            headers=headers,
+                                            json=data) as response:
+                    duration = time.time() - start_time
+                    # Expect 401 only when auth is enforced
+                    expects_auth = auth_type in ("api_key", "certificate", "basic")
+                    if expects_auth and response.status == 401:
+                        return TestResult(
+                            test_name=test_name,
+                            server_url=server_url,
+                            auth_type=auth_type,
+                            success=True,
+                            status_code=response.status,
+                            response_data={"expected": "authentication_failure"},
+                            duration=duration
+                        )
+                    elif not expects_auth and response.status == 200:
+                        # Security disabled: negative auth should not fail
+                        return TestResult(
+                            test_name=test_name,
+                            server_url=server_url,
+                            auth_type=auth_type,
+                            success=True,
+                            status_code=response.status,
+                            response_data={"expected": "no_auth_required"},
+                            duration=duration
+                        )
+                    else:
+                        return TestResult(
+                            test_name=test_name,
+                            server_url=server_url,
+                            auth_type=auth_type,
+                            success=False,
+                            status_code=response.status,
+                            error_message=f"Unexpected status for negative auth: {response.status}",
+                            duration=duration
+                        )
         except Exception as e:
             duration = time.time() - start_time
             return TestResult(

mcp_proxy_adapter/main.py

@@ -7,6 +7,7 @@ email: vasilyvz@gmail.com
 """
 
 import sys
+import ssl
 import hypercorn.asyncio
 import hypercorn.config
 import asyncio
@@ -32,7 +33,10 @@ def main():
         config = Config(config_path=args.config)
     else:
         config = Config()
-    
+
+    print(f"DEBUG main.py: config type: {type(config)}")
+    print(f"DEBUG main.py: config.get_all() type: {type(config.get_all())}")
+
     # Create application
     app = create_app(app_config=config)
     
@@ -70,8 +74,14 @@ def main():
             config_hypercorn.ca_certs = ssl_ca_cert
         
         if verify_client:
-            import ssl
+            # For mTLS, require client certificates
+            config_hypercorn.set_cert_reqs(ssl.CERT_REQUIRED)
             config_hypercorn.verify_mode = ssl.CERT_REQUIRED
+            print("🔐 mTLS: Client certificate verification enabled")
+        else:
+            # For regular HTTPS without client verification
+            config_hypercorn.set_cert_reqs(ssl.CERT_NONE)
+            config_hypercorn.verify_mode = ssl.CERT_NONE
         
         print(f"🔐 Starting HTTPS server with hypercorn...")
     else: