codeql/python/ql/test/query-tests/Security/CWE-327-InsecureProtocol/ssl_fluent.py at ef82617b422994fa109683bcb9d341fa07eab897 · github/codeql · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
import socket
import ssl

def test_fluent_tls():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())


def test_fluent_tls_no_TLSv1():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_fluent_tls_client_no_TLSv1():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
    context.options |= ssl.OP_NO_TLSv1

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_fluent_tls_server_no_TLSv1():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
    context.options |= ssl.OP_NO_TLSv1

    with socket.create_server((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_fluent_tls_safe():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1
    context.options |= ssl.OP_NO_TLSv1_1

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(ssock.version())

def test_fluent_ssl():
    hostname = 'www.python.org'
    # notice that `ssl.PROTOCOL_SSLv23` is just a deprecated alias for `ssl.PROTOCOL_TLS`.
    # Therefore, we only have this one test using PROTOCOL_SSLv23, to show that we handle this alias correctly.
    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())


def create_relaxed_context():
    return ssl.SSLContext(ssl.PROTOCOL_TLS)

def create_secure_context():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    return context

def create_connection(context):
    with socket.create_connection(('www.python.org', 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_delegated_context_unsafe():
    context = create_relaxed_context()
    with socket.create_connection(('www.python.org', 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_delegated_context_safe():
    context = create_secure_context()
    with socket.create_connection(('www.python.org', 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(ssock.version())

def test_delegated_context_made_safe():
    context = create_relaxed_context()
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    with socket.create_connection(('www.python.org', 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(ssock.version())

def test_delegated_context_made_unsafe():
    context = create_secure_context()
    context.options &= ~ssl.OP_NO_TLSv1_1
    with socket.create_connection(('www.python.org', 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_delegated_connection_unsafe():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    create_connection(context)

def test_delegated_connection_safe():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    create_connection(context)

def test_delegated_connection_made_safe():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    create_connection(context)

def test_delegated_connection_made_unsafe():
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    context.options &= ~ssl.OP_NO_TLSv1_1
    create_connection(context)

def test_delegated_unsafe():
    context = create_relaxed_context()
    create_connection(context)

def test_delegated_safe():
    context = create_secure_context()
    create_connection(context)

def test_delegated_made_safe():
    context = create_relaxed_context()
    context.options |= ssl.OP_NO_TLSv1 | ssl.OP_NO_TLSv1_1
    create_connection(context)

def test_delegated_made_unsafe():
    context = create_secure_context()
    context.options &= ~ssl.OP_NO_TLSv1_1
    create_connection(context)

# From Python 3.7
# see https://docs.python.org/3/library/ssl.html#ssl.SSLContext.minimum_version
def test_fluent_ssl_unsafe_version():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.minimum_version = ssl.TLSVersion.TLSv1_1

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

def test_fluent_ssl_safe_version():
    hostname = 'www.python.org'
    context = ssl.SSLContext(ssl.PROTOCOL_TLS)
    context.minimum_version = ssl.TLSVersion.TLSv1_3

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock:
            print(ssock.version())

# Taken from https://docs.python.org/3/library/ssl.html#context-creation
def test_fluent_explicitly_unsafe():
    hostname = 'www.python.org'
    context = ssl.create_default_context(ssl.Purpose.CLIENT_AUTH)
    context.options &= ~ssl.OP_NO_SSLv3

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # $ Alert
            print(ssock.version())

# Since Python 3.10, `ssl.create_default_context` sets `minimum_version` to
# `TLSVersion.TLSv1_2`, so TLSv1 and TLSv1_1 are not allowed.
# see https://docs.python.org/3/library/ssl.html#context-creation
def test_fluent_default_context_safe():
    hostname = 'www.python.org'
    context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)

    with socket.create_connection((hostname, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=hostname) as ssock: # No alert
            print(ssock.version())