mcp-proxy-adapter 6.2.35__py3-none-any.whl → 6.3.0__py3-none-any.whl

mcp_proxy_adapter/core/config_validator.py

@@ -7,8 +7,8 @@ with invalid or insecure configurations.
 
 import os
 import json
-from typing import Dict, Any, List, Optional
-from pathlib import Path
+import uuid
+from typing import Dict, Any, List
 
 from mcp_proxy_adapter.core.logging import logger
 
@@ -16,220 +16,257 @@ from mcp_proxy_adapter.core.logging import logger
 class ConfigValidator:
     """
     Strict configuration validator.
-    
+
     Validates configuration before startup and prevents startup
     with invalid or insecure configurations.
     """
-    
+
     def __init__(self, config: Dict[str, Any]):
         """
         Initialize configuration validator.
-        
+
         Args:
             config: Configuration dictionary to validate
         """
         self.config = config
         self.errors: List[str] = []
         self.warnings: List[str] = []
-    
+
     def validate_all(self) -> bool:
         """
         Validate all configuration sections.
-        
+
         Returns:
             True if configuration is valid, False otherwise
         """
         self.errors.clear()
         self.warnings.clear()
-        
+
         # Validate basic structure
         if not self._validate_basic_structure():
             return False
-        
+
+        # Validate UUID configuration (mandatory)
+        if not self._validate_uuid_config():
+            return False
+
         # Validate server configuration
         if not self._validate_server_config():
             return False
-        
+
         # Validate security configuration
         if not self._validate_security_config():
             return False
-        
+
         # Validate commands configuration
         if not self._validate_commands_config():
             return False
-        
+
         # Validate SSL configuration
         if not self._validate_ssl_config():
             return False
-        
+
         # Validate roles configuration
         if not self._validate_roles_config():
             return False
-        
+
         # Log warnings if any
         if self.warnings:
             for warning in self.warnings:
                 logger.warning(f"Configuration warning: {warning}")
-        
+
         # Return success only if no errors
         return len(self.errors) == 0
-    
+
     def _validate_basic_structure(self) -> bool:
         """Validate basic configuration structure."""
         required_sections = ["server", "logging", "commands"]
-        
+
         for section in required_sections:
             if section not in self.config:
                 self.errors.append(f"Missing required configuration section: {section}")
-        
+
         return len(self.errors) == 0
-    
+
+    def _validate_uuid_config(self) -> bool:
+        """Validate UUID configuration (mandatory parameter)."""
+        # Check if UUID is present in root config
+        service_uuid = self.config.get("uuid")
+
+        if not service_uuid:
+            self.errors.append(
+                "UUID is required in configuration. Add 'uuid' field with a valid UUID4 value."
+            )
+            return False
+
+        # Validate UUID format
+        try:
+            # Try to parse as UUID
+            parsed_uuid = uuid.UUID(service_uuid)
+
+            # Check if it's UUID4 (version 4)
+            if parsed_uuid.version != 4:
+                self.errors.append(
+                    f"UUID must be version 4 (UUID4). Current version: {parsed_uuid.version}"
+                )
+                return False
+
+        except (ValueError, TypeError) as e:
+            self.errors.append(f"Invalid UUID format: {service_uuid}. Error: {e}")
+            return False
+
+        return len(self.errors) == 0
+
     def _validate_server_config(self) -> bool:
         """Validate server configuration."""
         server_config = self.config.get("server", {})
-        
+
         # Validate host
         host = server_config.get("host")
         if not host:
             self.errors.append("Server host is required")
-        
+
         # Validate port
         port = server_config.get("port")
         if not isinstance(port, int) or port < 1 or port > 65535:
             self.errors.append("Server port must be an integer between 1 and 65535")
-        
+
         return len(self.errors) == 0
-    
+
     def _validate_security_config(self) -> bool:
         """Validate security configuration."""
         security_config = self.config.get("security", {})
-        
+
         # Check if security is enabled
         security_enabled = security_config.get("enabled", True)
         auth_enabled = self.config.get("auth_enabled", False)
-        
+
         # Validate permissions configuration
         permissions_config = security_config.get("permissions", {})
         permissions_enabled = permissions_config.get("enabled", False)
-        
+
         if permissions_enabled:
             # Permissions require authentication to identify users
             auth_config = security_config.get("auth", {})
             if not auth_config.get("enabled", False):
-                self.errors.append("Permissions are enabled but authentication is disabled. Permissions require authentication to identify users.")
+                self.errors.append(
+                    "Permissions are enabled but authentication is disabled. Permissions require authentication to identify users."
+                )
                 return False
-            
+
             # Check if there are any authentication methods available
             auth_methods = auth_config.get("methods", [])
             if not auth_methods:
-                self.errors.append("Permissions are enabled but no authentication methods are configured. At least one authentication method is required.")
+                self.errors.append(
+                    "Permissions are enabled but no authentication methods are configured. At least one authentication method is required."
+                )
                 return False
-        
+
         if security_enabled and auth_enabled:
             # Validate auth configuration
             auth_config = security_config.get("auth", {})
             if not auth_config.get("enabled", False):
                 self.errors.append("Security is enabled but auth is disabled")
                 return False
-            
+
             # Validate API keys if auth is enabled
             if auth_config.get("enabled", False):
                 api_keys = auth_config.get("api_keys", {})
                 if not api_keys:
                     self.errors.append("API keys are required when authentication is enabled")
                     return False
-                
+
                 # Validate API key format
                 for key, value in api_keys.items():
                     if not key or not value:
                         self.errors.append("API keys must have non-empty key and value")
                         return False
-        
+
         return len(self.errors) == 0
-    
+
     def _validate_commands_config(self) -> bool:
         """Validate commands configuration."""
         commands_config = self.config.get("commands", {})
-        
+
         # Validate commands directory if auto_discovery is enabled
         if commands_config.get("auto_discovery", True):
             commands_dir = commands_config.get("commands_directory", "./commands")
             if not os.path.exists(commands_dir):
                 self.warnings.append(f"Commands directory does not exist: {commands_dir}")
-        
+
         return True
-    
+
     def _validate_ssl_config(self) -> bool:
         """Validate SSL configuration."""
         ssl_config = self.config.get("ssl", {})
         ssl_enabled = ssl_config.get("enabled", False)
-        
+
         if ssl_enabled:
             # Validate certificate files
             cert_file = ssl_config.get("cert_file")
             key_file = ssl_config.get("key_file")
-            
+
             if not cert_file or not key_file:
                 self.errors.append("SSL certificate and key files are required when SSL is enabled")
                 return False
-            
+
             if not os.path.exists(cert_file):
                 self.errors.append(f"SSL certificate file not found: {cert_file}")
-            
+
             if not os.path.exists(key_file):
                 self.errors.append(f"SSL private key file not found: {key_file}")
-        
+
         return len(self.errors) == 0
-    
+
     def _validate_roles_config(self) -> bool:
         """Validate roles configuration."""
         roles_config = self.config.get("roles", {})
         roles_enabled = roles_config.get("enabled", False)
-        
+
         if roles_enabled:
             config_file = roles_config.get("config_file")
             if not config_file:
                 self.errors.append("Roles config file is required when roles are enabled")
                 return False
-            
+
             if not os.path.exists(config_file):
                 self.errors.append(f"Roles config file not found: {config_file}")
                 return False
-            
+
             # Validate roles schema file
             try:
-                with open(config_file, 'r') as f:
+                with open(config_file, "r") as f:
                     roles_schema = json.load(f)
-                
+
                 if "roles" not in roles_schema:
                     self.errors.append("Roles config file must contain 'roles' section")
                     return False
-                
+
             except (json.JSONDecodeError, IOError) as e:
                 self.errors.append(f"Failed to read roles config file: {e}")
                 return False
-        
+
         return len(self.errors) == 0
-    
+
     def get_errors(self) -> List[str]:
         """Get validation errors."""
         return self.errors.copy()
-    
+
     def get_warnings(self) -> List[str]:
         """Get validation warnings."""
         return self.warnings.copy()
-    
+
     def print_validation_report(self):
         """Print validation report."""
         if self.errors:
             logger.error("Configuration validation failed:")
             for error in self.errors:
                 logger.error(f"  - {error}")
-        
+
         if self.warnings:
             logger.warning("Configuration warnings:")
             for warning in self.warnings:
                 logger.warning(f"  - {warning}")
-        
+
         if not self.errors and not self.warnings:
             logger.info("Configuration validation passed")

mcp_proxy_adapter/core/crl_utils.py

@@ -0,0 +1,348 @@
+"""
+CRL Utilities Module
+
+This module provides utilities for working with Certificate Revocation Lists (CRL).
+Supports both file-based and URL-based CRL sources.
+
+Author: Vasiliy Zdanovskiy
+email: vasilyvz@gmail.com
+Version: 1.0.0
+"""
+
+import logging
+import os
+import tempfile
+from pathlib import Path
+from typing import Optional, Union, Dict, Any
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.util.retry import Retry
+
+# Import mcp_security_framework CRL utilities
+try:
+    from mcp_security_framework.utils.cert_utils import (
+        is_certificate_revoked,
+        validate_certificate_against_crl,
+        is_crl_valid,
+        get_crl_info,
+    )
+
+    SECURITY_FRAMEWORK_AVAILABLE = True
+except ImportError:
+    SECURITY_FRAMEWORK_AVAILABLE = False
+
+logger = logging.getLogger(__name__)
+
+
+class CRLManager:
+    """
+    Manager for Certificate Revocation Lists (CRL).
+
+    Supports both file-based and URL-based CRL sources.
+    Automatically downloads CRL from URLs and caches them locally.
+    """
+
+    def __init__(self, config: Dict[str, Any]):
+        """
+        Initialize CRL manager.
+
+        Args:
+            config: Configuration dictionary containing CRL settings
+        """
+        self.config = config
+        self.crl_enabled = config.get("crl_enabled", False)
+
+        # Only analyze CRL paths if certificates are enabled
+        certificates_enabled = config.get("certificates_enabled", True)
+        if certificates_enabled and self.crl_enabled:
+            self.crl_path = config.get("crl_path")
+            self.crl_url = config.get("crl_url")
+            self.crl_validity_days = config.get("crl_validity_days", 30)
+        else:
+            # Don't analyze CRL paths if certificates are disabled
+            self.crl_path = None
+            self.crl_url = None
+            self.crl_validity_days = 30
+
+        # Cache for downloaded CRL files
+        self._crl_cache: Dict[str, str] = {}
+
+        # Setup HTTP session with retry strategy
+        self._setup_http_session()
+
+        logger.info(
+            f"CRL Manager initialized - enabled: {self.crl_enabled}, certificates_enabled: {certificates_enabled}"
+        )
+
+    def _setup_http_session(self):
+        """Setup HTTP session with retry strategy for CRL downloads."""
+        self.session = requests.Session()
+
+        # Configure retry strategy
+        retry_strategy = Retry(
+            total=3,
+            backoff_factor=1,
+            status_forcelist=[429, 500, 502, 503, 504],
+        )
+
+        adapter = HTTPAdapter(max_retries=retry_strategy)
+        self.session.mount("http://", adapter)
+        self.session.mount("https://", adapter)
+
+        # Set timeout
+        self.session.timeout = 30
+
+    def get_crl_data(self) -> Optional[Union[str, bytes, Path]]:
+        """
+        Get CRL data from configured source.
+
+        Returns:
+            CRL data as string, bytes, or Path, or None if not available
+
+        Raises:
+            ValueError: If CRL is enabled but no source is configured
+            FileNotFoundError: If CRL file is not found
+            requests.RequestException: If CRL download fails
+        """
+        if not self.crl_enabled:
+            logger.debug("CRL is disabled, skipping CRL check")
+            return None
+
+        # Check if CRL URL is configured
+        if self.crl_url:
+            return self._get_crl_from_url()
+
+        # Check if CRL file path is configured
+        if self.crl_path:
+            return self._get_crl_from_file()
+
+        # If CRL is enabled but no source is configured, this is an error
+        if self.crl_enabled:
+            raise ValueError("CRL is enabled but neither crl_path nor crl_url is configured")
+
+        return None
+
+    def _get_crl_from_url(self) -> str:
+        """
+        Download CRL from URL.
+
+        Returns:
+            Path to downloaded CRL file
+
+        Raises:
+            requests.RequestException: If download fails
+            ValueError: If downloaded data is not valid CRL
+        """
+        try:
+            logger.info(f"Downloading CRL from URL: {self.crl_url}")
+
+            # Download CRL
+            response = self.session.get(self.crl_url)
+            response.raise_for_status()
+
+            # Validate content type
+            content_type = response.headers.get("content-type", "").lower()
+            if (
+                "application/pkix-crl" not in content_type
+                and "application/x-pkcs7-crl" not in content_type
+            ):
+                logger.warning(f"Unexpected content type for CRL: {content_type}")
+
+            # Save to temporary file
+            with tempfile.NamedTemporaryFile(mode="wb", suffix=".crl", delete=False) as temp_file:
+                temp_file.write(response.content)
+                temp_file_path = temp_file.name
+
+            # Validate CRL format
+            if SECURITY_FRAMEWORK_AVAILABLE:
+                try:
+                    is_crl_valid(temp_file_path)
+                    logger.info(f"CRL downloaded and validated successfully from {self.crl_url}")
+                except Exception as e:
+                    os.unlink(temp_file_path)
+                    raise ValueError(f"Downloaded CRL is not valid: {e}")
+            else:
+                logger.warning("mcp_security_framework not available, skipping CRL validation")
+
+            # Cache the file path
+            self._crl_cache[self.crl_url] = temp_file_path
+
+            return temp_file_path
+
+        except requests.RequestException as e:
+            logger.error(f"Failed to download CRL from {self.crl_url}: {e}")
+            raise
+        except Exception as e:
+            logger.error(f"CRL download failed: {e}")
+            raise
+
+    def _get_crl_from_file(self) -> str:
+        """
+        Get CRL from file path.
+
+        Returns:
+            Path to CRL file
+
+        Raises:
+            FileNotFoundError: If CRL file is not found
+            ValueError: If CRL file is not valid
+        """
+        if not os.path.exists(self.crl_path):
+            raise FileNotFoundError(f"CRL file not found: {self.crl_path}")
+
+        # Validate CRL format
+        if SECURITY_FRAMEWORK_AVAILABLE:
+            try:
+                is_crl_valid(self.crl_path)
+                logger.info(f"CRL file validated successfully: {self.crl_path}")
+            except Exception as e:
+                raise ValueError(f"CRL file is not valid: {e}")
+        else:
+            logger.warning("mcp_security_framework not available, skipping CRL validation")
+
+        return self.crl_path
+
+    def is_certificate_revoked(self, cert_path: str) -> bool:
+        """
+        Check if certificate is revoked according to CRL.
+
+        Args:
+            cert_path: Path to certificate file
+
+        Returns:
+            True if certificate is revoked, False otherwise
+
+        Raises:
+            ValueError: If CRL is enabled but not available
+            FileNotFoundError: If certificate file is not found
+        """
+        if not self.crl_enabled:
+            return False
+
+        if not SECURITY_FRAMEWORK_AVAILABLE:
+            logger.warning("mcp_security_framework not available, skipping CRL check")
+            return False
+
+        try:
+            crl_data = self.get_crl_data()
+            if not crl_data:
+                logger.warning("CRL is enabled but no CRL data is available")
+                return False
+
+            is_revoked = is_certificate_revoked(cert_path, crl_data)
+
+            if is_revoked:
+                logger.warning(f"Certificate is revoked according to CRL: {cert_path}")
+            else:
+                logger.debug(f"Certificate is not revoked according to CRL: {cert_path}")
+
+            return is_revoked
+
+        except Exception as e:
+            logger.error(f"CRL check failed for certificate {cert_path}: {e}")
+            # For security, consider certificate invalid if CRL check fails
+            return True
+
+    def validate_certificate_against_crl(self, cert_path: str) -> Dict[str, Any]:
+        """
+        Validate certificate against CRL and return detailed status.
+
+        Args:
+            cert_path: Path to certificate file
+
+        Returns:
+            Dictionary containing validation results
+
+        Raises:
+            ValueError: If CRL is enabled but not available
+            FileNotFoundError: If certificate file is not found
+        """
+        if not self.crl_enabled:
+            return {
+                "is_revoked": False,
+                "crl_checked": False,
+                "crl_source": None,
+                "message": "CRL check is disabled",
+            }
+
+        if not SECURITY_FRAMEWORK_AVAILABLE:
+            logger.warning("mcp_security_framework not available, skipping CRL validation")
+            return {
+                "is_revoked": False,
+                "crl_checked": False,
+                "crl_source": None,
+                "message": "mcp_security_framework not available",
+            }
+
+        try:
+            crl_data = self.get_crl_data()
+            if not crl_data:
+                logger.warning("CRL is enabled but no CRL data is available")
+                return {
+                    "is_revoked": True,  # For security, consider invalid if CRL unavailable
+                    "crl_checked": False,
+                    "crl_source": None,
+                    "message": "CRL is enabled but not available",
+                }
+
+            # Get CRL source info
+            crl_source = self.crl_url if self.crl_url else self.crl_path
+
+            # Validate certificate against CRL
+            result = validate_certificate_against_crl(cert_path, crl_data)
+
+            result["crl_checked"] = True
+            result["crl_source"] = crl_source
+
+            return result
+
+        except Exception as e:
+            logger.error(f"CRL validation failed for certificate {cert_path}: {e}")
+            # For security, consider certificate invalid if CRL validation fails
+            return {
+                "is_revoked": True,
+                "crl_checked": False,
+                "crl_source": self.crl_url if self.crl_url else self.crl_path,
+                "message": f"CRL validation failed: {e}",
+            }
+
+    def get_crl_info(self) -> Optional[Dict[str, Any]]:
+        """
+        Get information about the configured CRL.
+
+        Returns:
+            Dictionary containing CRL information, or None if CRL is not available
+        """
+        if not self.crl_enabled:
+            return None
+
+        if not SECURITY_FRAMEWORK_AVAILABLE:
+            logger.warning("mcp_security_framework not available, cannot get CRL info")
+            return None
+
+        try:
+            crl_data = self.get_crl_data()
+            if not crl_data:
+                return None
+
+            return get_crl_info(crl_data)
+
+        except Exception as e:
+            logger.error(f"Failed to get CRL info: {e}")
+            return None
+
+    def cleanup_cache(self):
+        """Clean up temporary CRL files."""
+        for url, temp_path in self._crl_cache.items():
+            try:
+                if os.path.exists(temp_path):
+                    os.unlink(temp_path)
+                    logger.debug(f"Cleaned up temporary CRL file: {temp_path}")
+            except Exception as e:
+                logger.warning(f"Failed to cleanup temporary CRL file {temp_path}: {e}")
+
+        self._crl_cache.clear()
+
+    def __del__(self):
+        """Cleanup when object is destroyed."""
+        self.cleanup_cache()