tlslib.insecure

  1"""Insecure options for the abstract interface to TLS for Python."""
  2
  3import warnings
  4from abc import abstractmethod
  5from collections.abc import Callable
  6from typing import Generic, Protocol, TypeVar
  7
  8from ..tlslib import (
  9    ClientContext,
 10    ServerContext,
 11    TLSClientConfiguration,
 12    TLSImplementation,
 13    TLSServerConfiguration,
 14)
 15
 16
 17class SecurityWarning(Warning):
 18    """Warning regarding the insecurity caused by the use of this module"""
 19
 20
 21class InsecureConfiguration:
 22    """
 23    Class allowing users to define insecure configuration parameters for testing purposes.
 24    It should be noted that making use of any of the options in this class will lead to an
 25    insecure deployment of TLS.
 26
 27    :param _disable_hostname_check bool:
 28        Disables hostname_check of the server certificate. This allows anyone positioned
 29        in the network to intercept connections between legitimate clients and servers without
 30        detection and is insecure. A better option would be to obtain the server's (self-signed)
 31        certificate and place it in a newly-created TrustStore object.
 32
 33    :param disable_verification bool:
 34        Disables client verification of the server certificate. This allows anyone positioned
 35        in the network to intercept connections between legitimate clients and servers without
 36        detection and is insecure. A better option would be to obtain the server's (self-signed)
 37        certificate and place it in a newly-created TrustStore object.
 38    """
 39
 40    __slots__ = (
 41        "_disable_verification",
 42        "_disable_hostname_check",
 43    )
 44
 45    def __init__(
 46        self,
 47        disable_hostname_check: bool = False,
 48        disable_verification: bool = False,
 49    ) -> None:
 50        """Initializes the InsecureConfiguration."""
 51        warnings.warn(
 52            "Using InsecureConfiguration is insecure and should not be used in production.",
 53            SecurityWarning,
 54        )
 55
 56        if not disable_hostname_check and disable_verification:
 57            raise ValueError("Cannot disable verification without disabling hostname check")
 58
 59        self._disable_hostname_check = disable_hostname_check
 60        self._disable_verification = disable_verification
 61
 62    @property
 63    def disable_hostname_check(self) -> bool:
 64        """Whether client verification of the server hostname should be disabled."""
 65        return self._disable_hostname_check
 66
 67    @property
 68    def disable_verification(self) -> bool:
 69        """Whether client verification of the server certificate should be disabled."""
 70        return self._disable_verification
 71
 72
 73class InsecureClientContext(ClientContext, Protocol):
 74    """
 75    Class allowing users to make insecure choices for testing purposes.
 76
 77    :param tls_configuration TLSClientConfiguration
 78        The underlying TLS configuration to be used to instantiate the insecure context.
 79
 80    :param insecure_configuration InsecureConfiguration:
 81        The insecure configuration options that will make this context insecure.
 82    """
 83
 84    @abstractmethod
 85    def __init__(
 86        self,
 87        tls_configuration: TLSClientConfiguration,
 88        insecure_configuration: InsecureConfiguration,
 89    ) -> None:
 90        """
 91        Create a new insecure context object from a given TLS configuration and
 92        insecure configuration."""
 93
 94    @property
 95    @abstractmethod
 96    def insecure_configuration(self) -> InsecureConfiguration:
 97        """The insecure configuration options that will make this context insecure."""
 98
 99
100class InsecureServerContext(ServerContext, Protocol):
101    """
102    Class allowing users to make insecure choices for testing purposes.
103
104    :param tls_configuration TLSClientConfiguration | TLSServerConfiguration:
105        The underlying TLS configuration to be used to instantiate the insecure context.
106
107    :param insecure_configuration InsecureConfiguration:
108        The insecure configuration options that will make this context insecure.
109    """
110
111    @abstractmethod
112    def __init__(
113        self,
114        tls_configuration: TLSServerConfiguration,
115        insecure_configuration: InsecureConfiguration,
116    ) -> None:
117        """
118        Create a new insecure context object from a given TLS configuration and
119        insecure configuration."""
120
121    @property
122    @abstractmethod
123    def insecure_configuration(self) -> InsecureConfiguration:
124        """The insecure configuration options that will make this context insecure."""
125
126
127_ClientContext = TypeVar("_ClientContext", bound=ClientContext)
128_ServerContext = TypeVar("_ServerContext", bound=ServerContext)
129_InsecureClientContext = TypeVar("_InsecureClientContext", bound=InsecureClientContext)
130_InsecureServerContext = TypeVar("_InsecureServerContext", bound=InsecureServerContext)
131
132
133class InsecureTLSImplementation(
134    TLSImplementation, Generic[_InsecureClientContext, _InsecureServerContext]
135):
136    """
137    An insecure version of a TLS API implementation that allows a user to make insecure
138    choices for testing purposes.
139    """
140
141    __slots__ = (
142        "_insecure_client_context",
143        "_insecure_server_context",
144    )
145
146    def __init__(
147        self,
148        client_context: type[_ClientContext],
149        server_context: type[_ServerContext],
150        validate_config: Callable[[TLSClientConfiguration | TLSServerConfiguration], None],
151        insecure_client_context: type[_InsecureClientContext],
152        insecure_server_context: type[_InsecureServerContext],
153    ) -> None:
154        """Initializes all attributes of the implementation."""
155
156        warnings.warn(
157            "Using an InsecureTLSImplementation is insecure. "
158            "This should not be used in production.",
159            SecurityWarning,
160        )
161
162        self._insecure_client_context = insecure_client_context
163        self._insecure_server_context = insecure_server_context
164
165        super().__init__(
166            client_context=client_context,
167            server_context=server_context,
168            validate_config=validate_config,
169        )
170
171    @property
172    def insecure_client_context(self) -> type[_InsecureClientContext]:
173        """The concrete implementation of the PEP 543 Insecure Client Context object used
174        by this TLS implementation.
175        """
176        return self._insecure_client_context
177
178    @property
179    def insecure_server_context(self) -> type[_InsecureServerContext]:
180        """The concrete implementation of the PEP 543 Insecure Server Context object used
181        by this TLS implementation.
182        """
183        return self._insecure_server_context