mcp-security-framework 2.3.1__tar.gz → 2.3.2__tar.gz

{mcp_security_framework-2.3.1 → mcp_security_framework-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mcp-security-framework
-Version: 2.3.1
+Version: 2.3.2
 Summary: Universal security framework for microservices with SSL/TLS, authentication, authorization, and rate limiting. Added extensible security adapter system for custom operation validation, structured audit logging, and operation context support. Comprehensive test coverage with 1104+ tests. Fully backward compatible. Requires cryptography>=42.0.0 for certificate operations.
 Author-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>
 Maintainer-email: Vasiliy Zdanovskiy <vasilyvz@gmail.com>

{mcp_security_framework-2.3.1 → mcp_security_framework-2.3.2}/mcp_security_framework/__init__.py

@@ -79,7 +79,7 @@ from mcp_security_framework.schemas.responses import (
 )
 
 # Version information
-__version__ = "2.3.1"
+__version__ = "2.3.2"
 __author__ = "Vasiliy Zdanovskiy"
 __email__ = "vasilyvz@gmail.com"
 __license__ = "MIT"

{mcp_security_framework-2.3.1 → mcp_security_framework-2.3.2}/mcp_security_framework/core/cert_manager.py

@@ -2129,8 +2129,12 @@ class CertificateManager:
             )
 
             # Add Subject Alternative Name extension if common name looks like a domain
+            # or an IP literal. Reuse _subject_alt_name so an IP-literal common_name
+            # (e.g. "127.0.0.1") is encoded as x509.IPAddress, never x509.DNSName.
             if "." in common_name and not common_name.startswith("*"):
-                san_extension = x509.SubjectAlternativeName([x509.DNSName(common_name)])
+                san_extension = x509.SubjectAlternativeName(
+                    [_subject_alt_name(common_name)]
+                )
                 csr_builder = csr_builder.add_extension(san_extension, critical=False)
 
             # Build and sign CSR

{mcp_security_framework-2.3.1 → mcp_security_framework-2.3.2}/mcp_security_framework/core/ssl_manager.py

@@ -432,9 +432,27 @@ class SSLManager:
             if key_data is None:
                 client_key_file = client_key_file or self.config.client_key_file
             ca_cert_file = ca_cert_file or self.config.ca_cert_file
-            verify_mode = verify_mode or self.config.verify_mode
             min_version = min_version or self.config.min_tls_version
 
+            # Validate client_cert_file/client_key_file compatibility (bug B6),
+            # on the EFFECTIVE values resolved just above (call-site argument or
+            # config fallback). Skipped when cert_data/key_data supply the pair
+            # instead: cert_data/key_data are already validated all-or-none
+            # above, and both loading branches below try cert_data/key_data
+            # FIRST, falling back to client_cert_file/client_key_file only when
+            # cert_data/key_data are absent — so a lone client_cert_file/
+            # client_key_file value is never actually used together with
+            # cert_data/key_data. Raised here, once, before the cache lookup
+            # and before any context is built, so it covers both the CERT_NONE
+            # branch and the verifying branch below and no partially
+            # configured context is ever cached.
+            if cert_data is None and key_data is None:
+                if bool(client_cert_file) != bool(client_key_file):
+                    raise SSLConfigurationError(
+                        "client_cert_file and client_key_file must be provided "
+                        "together; got one without the other"
+                    )
+
             # Validate that material_from_memory promises are kept
             if cert_data is None and self.config.material_from_memory:
                 raise SSLConfigurationError(
@@ -447,17 +465,13 @@ class SSLManager:
                     "provide key_data as PEM bytes or set material_from_memory=False"
                 )
 
-            # Check cache (only for file-based contexts)
-            cache_key = None
-            if cert_data is None and key_data is None:
-                cache_key = (
-                    f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
-                    f"_{verify_mode}_{min_version}"
-                )
-                if cache_key in self._contexts:
-                    return self._contexts[cache_key]
-
-            # Determine actual verify mode (explicit parameter takes precedence)
+            # Determine actual verify mode. Precedence (bug B5):
+            #   1) an explicit call-site verify_mode argument
+            #   2) self.config.verify is False -> CERT_NONE
+            #   3) self.config.verify_mode
+            # NOTE: verify_mode must NOT be defaulted from self.config.verify_mode
+            # before this check runs, otherwise it is never falsy here and
+            # self.config.verify is never consulted (bug B5's root cause).
             actual_verify_mode = (
                 verify_mode
                 if verify_mode
@@ -466,6 +480,30 @@ class SSLManager:
                 )
             )
 
+            # Effective check_hostname actually applied to the context: always
+            # False when verification is disabled (ssl refuses check_hostname=True
+            # with CERT_NONE), otherwise the configured value (bug B1).
+            effective_check_hostname = (
+                False
+                if actual_verify_mode == "CERT_NONE"
+                else bool(self.config.check_hostname)
+            )
+
+            # Check cache (only for file-based contexts). The key must reflect
+            # the RESOLVED verify mode and the check_hostname actually applied
+            # to the context (bugs B1, B5c) so that mutating
+            # manager.config.check_hostname or manager.config.verify between
+            # two calls on the same instance, with the raw inputs otherwise
+            # unchanged, never returns a context built for different values.
+            cache_key = None
+            if cert_data is None and key_data is None:
+                cache_key = (
+                    f"client_{ca_cert_file}_{client_cert_file}_{client_key_file}"
+                    f"_{actual_verify_mode}_{effective_check_hostname}_{min_version}"
+                )
+                if cache_key in self._contexts:
+                    return self._contexts[cache_key]
+
             # Check if verification is disabled
             if actual_verify_mode == "CERT_NONE":
                 # For disabled verification or CERT_NONE, create a basic context
@@ -518,7 +556,7 @@ class SSLManager:
             else:
                 # For other modes, use default context with verification
                 context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
-                context.check_hostname = bool(self.config.check_hostname)
+                context.check_hostname = effective_check_hostname
                 context.verify_mode = self._get_verify_mode(actual_verify_mode)
 
                 # Set minimum TLS version
@@ -583,7 +621,7 @@ class SSLManager:
                     "ca_cert_file": ca_cert_file,
                     "client_cert_file": client_cert_file,
                     "cert_data_provided": cert_data is not None,
-                    "verify_mode": verify_mode,
+                    "verify_mode": actual_verify_mode,
                     "min_version": min_version,
                 },
             )