mcp-security-framework 2.3.0__tar.gz → 2.3.2__tar.gz

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.3.0
+Version: 2.3.2
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
@@ -60,6 +60,10 @@ Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: pytest-cov>=4.0.0; extra == "test"
 Requires-Dist: pytest-asyncio>=0.21.0; extra == "test"
 Requires-Dist: pytest-mock>=3.8.0; extra == "test"
+Requires-Dist: fastapi>=0.68.0; extra == "test"
+Requires-Dist: uvicorn[standard]>=0.15.0; extra == "test"
+Requires-Dist: flask>=2.0.0; extra == "test"
+Requires-Dist: flask-cors>=3.0.0; extra == "test"
 Requires-Dist: httpx>=0.24.0; extra == "test"
 Dynamic: license-file
 

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.2}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.3.0"
+__version__ = "2.3.2"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.2}/mcp_security_framework/core/cert_manager.py

@@ -27,6 +27,7 @@ Version: 1.0.0
 License: MIT
 """
 
+import ipaddress
 import logging
 import os
 from datetime import datetime, timedelta, timezone
@@ -248,6 +249,14 @@ def _certificate_type_of(certificate) -> CertificateType:
     return CertificateType.CLIENT
 
 
+def _subject_alt_name(value: str) -> x509.GeneralName:
+    """Return the correct SAN type for a DNS name or IP literal string."""
+    try:
+        return x509.IPAddress(ipaddress.ip_address(value))
+    except ValueError:
+        return x509.DNSName(value)
+
+
 class CertificateManager:
     """
     Certificate Management Class
@@ -1023,6 +1032,10 @@ class CertificateManager:
                 x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),
                 critical=False,
             )
+            builder = builder.add_extension(
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_key.public_key()),
+                critical=False,
+            )
 
             # Add roles and permissions to certificate extensions
             # Validate and normalize roles using CertificateRole enum
@@ -1333,11 +1346,15 @@ class CertificateManager:
                 x509.SubjectKeyIdentifier.from_public_key(private_key.public_key()),
                 critical=False,
             )
+            builder = builder.add_extension(
+                x509.AuthorityKeyIdentifier.from_issuer_public_key(ca_key.public_key()),
+                critical=False,
+            )
 
             # Add Subject Alternative Name (SAN) if provided
             if server_config.subject_alt_names:
                 san_names = [
-                    x509.DNSName(name) for name in server_config.subject_alt_names
+                    _subject_alt_name(name) for name in server_config.subject_alt_names
                 ]
 
                 builder = builder.add_extension(
@@ -2112,8 +2129,12 @@ class CertificateManager:
             )
 
             # Add Subject Alternative Name extension if common name looks like a domain
+            # or an IP literal. Reuse _subject_alt_name so an IP-literal common_name
+            # (e.g. "127.0.0.1") is encoded as x509.IPAddress, never x509.DNSName.
             if "." in common_name and not common_name.startswith("*"):
-                san_extension = x509.SubjectAlternativeName([x509.DNSName(common_name)])
+                san_extension = x509.SubjectAlternativeName(
+                    [_subject_alt_name(common_name)]
+                )
                 csr_builder = csr_builder.add_extension(san_extension, critical=False)
 
             # Build and sign CSR

{mcp_security_framework-2.3.0 → mcp_security_framework-2.3.2}/mcp_security_framework/core/ssl_manager.py

@@ -432,9 +432,27 @@ class SSLManager:
             if key_data is None:
                 client_key_file = client_key_file or self.config.client_key_file
             ca_cert_file = ca_cert_file or self.config.ca_cert_file
-            verify_mode = verify_mode or self.config.verify_mode
             min_version = min_version or self.config.min_tls_version
 
+            # Validate client_cert_file/client_key_file compatibility (bug B6),
+            # on the EFFECTIVE values resolved just above (call-site argument or
+            # config fallback). Skipped when cert_data/key_data supply the pair
+            # instead: cert_data/key_data are already validated all-or-none
+            # above, and both loading branches below try cert_data/key_data
+            # FIRST, falling back to client_cert_file/client_key_file only when
+            # cert_data/key_data are absent — so a lone client_cert_file/
+            # client_key_file value is never actually used together with
+            # cert_data/key_data. Raised here, once, before the cache lookup
+            # and before any context is built, so it covers both the CERT_NONE
+            # branch and the verifying branch below and no partially
+            # configured context is ever cached.
+            if cert_data is None and key_data is None:
+                if bool(client_cert_file) != bool(client_key_file):
+                    raise SSLConfigurationError(
+                        "client_cert_file and client_key_file must be provided "
+                        "together; got one without the other"
+                    )
+
             # Validate that material_from_memory promises are kept
             if cert_data is None and self.config.material_from_memory:
                 raise SSLConfigurationError(
@@ -447,17 +465,13 @@ class SSLManager:
                     "provide key_data as PEM bytes or set material_from_memory=False"
                 )
 
-            # Check cache (only for file-based contexts)
-            cache_key = None
-            if cert_data is None and key_data is None:
-                cache_key = (
-                    f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
-                    f"_{verify_mode}_{min_version}"
-                )
-                if cache_key in self._contexts:
-                    return self._contexts[cache_key]
-
-            # Determine actual verify mode (explicit parameter takes precedence)
+            # Determine actual verify mode. Precedence (bug B5):
+            #   1) an explicit call-site verify_mode argument
+            #   2) self.config.verify is False -> CERT_NONE
+            #   3) self.config.verify_mode
+            # NOTE: verify_mode must NOT be defaulted from self.config.verify_mode
+            # before this check runs, otherwise it is never falsy here and
+            # self.config.verify is never consulted (bug B5's root cause).
             actual_verify_mode = (
                 verify_mode
                 if verify_mode
@@ -466,6 +480,30 @@ class SSLManager:
                 )
             )
 
+            # Effective check_hostname actually applied to the context: always
+            # False when verification is disabled (ssl refuses check_hostname=True
+            # with CERT_NONE), otherwise the configured value (bug B1).
+            effective_check_hostname = (
+                False
+                if actual_verify_mode == "CERT_NONE"
+                else bool(self.config.check_hostname)
+            )
+
+            # Check cache (only for file-based contexts). The key must reflect
+            # the RESOLVED verify mode and the check_hostname actually applied
+            # to the context (bugs B1, B5c) so that mutating
+            # manager.config.check_hostname or manager.config.verify between
+            # two calls on the same instance, with the raw inputs otherwise
+            # unchanged, never returns a context built for different values.
+            cache_key = None
+            if cert_data is None and key_data is None:
+                cache_key = (
+                    f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
+                    f"_{actual_verify_mode}_{effective_check_hostname}_{min_version}"
+                )
+                if cache_key in self._contexts:
+                    return self._contexts[cache_key]
+
             # Check if verification is disabled
             if actual_verify_mode == "CERT_NONE":
                 # For disabled verification or CERT_NONE, create a basic context
@@ -518,6 +556,7 @@ class SSLManager:
             else:
                 # For other modes, use default context with verification
                 context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
+                context.check_hostname = effective_check_hostname
                 context.verify_mode = self._get_verify_mode(actual_verify_mode)
 
                 # Set minimum TLS version
@@ -582,7 +621,7 @@ class SSLManager:
                     "ca_cert_file": ca_cert_file,
                     "client_cert_file": client_cert_file,
                     "cert_data_provided": cert_data is not None,
-                    "verify_mode": verify_mode,
+                    "verify_mode": actual_verify_mode,
                     "min_version": min_version,
                 },
             )