ssl: avoid insecure pyopenssl fallback

Author: dkropachev

cassandra/datastax/cloud/__init__.py

@@ -176,17 +176,25 @@ def _ssl_context_from_cert(ca_cert_location, cert_location, key_location):
     return ssl_context
 
 
+def _default_pyopenssl_ssl_method(ssl_module):
+    for method_name in ('TLS_CLIENT_METHOD', 'TLS_METHOD', 'TLSv1_2_METHOD'):
+        method = getattr(ssl_module, method_name, None)
+        if method is not None:
+            return method
+    raise ImportError('pyOpenSSL does not expose a secure TLS client method')
+
+
 def _pyopenssl_context_from_cert(ca_cert_location, cert_location, key_location):
     try:
         from OpenSSL import SSL
     except ImportError as e:
         raise ImportError(
             "PyOpenSSL must be installed to connect to Astra with the Eventlet or Twisted event loops")\
             .with_traceback(e.__traceback__)
-    ssl_context = SSL.Context(SSL.TLSv1_METHOD)
+    ssl_context = SSL.Context(_default_pyopenssl_ssl_method(SSL))
     ssl_context.set_verify(SSL.VERIFY_PEER, callback=lambda _1, _2, _3, _4, ok: ok)
     ssl_context.use_certificate_file(cert_location)
     ssl_context.use_privatekey_file(key_location)
     ssl_context.load_verify_locations(ca_cert_location)
 
-    return ssl_context
+    return ssl_context

cassandra/io/eventletreactor.py

@@ -37,8 +37,11 @@
 
 
 def _default_ssl_method():
-    return getattr(SSL, 'TLS_CLIENT_METHOD',
-                   getattr(SSL, 'TLS_METHOD', SSL.TLSv1_METHOD))
+    for method_name in ('TLS_CLIENT_METHOD', 'TLS_METHOD', 'TLSv1_2_METHOD'):
+        method = getattr(SSL, method_name, None)
+        if method is not None:
+            return method
+    raise ImportError('pyOpenSSL does not expose a secure TLS client method')
 
 
 def _check_pyopenssl():

cassandra/io/twistedreactor.py

@@ -41,8 +41,11 @@
 
 
 def _default_ssl_method():
-    return getattr(SSL, "TLS_CLIENT_METHOD",
-                   getattr(SSL, "TLS_METHOD", SSL.TLSv1_METHOD))
+    for method_name in ("TLS_CLIENT_METHOD", "TLS_METHOD", "TLSv1_2_METHOD"):
+        method = getattr(SSL, method_name, None)
+        if method is not None:
+            return method
+    raise ImportError("pyOpenSSL does not expose a secure TLS client method")
 
 
 def _check_pyopenssl():

tests/unit/io/test_eventletreactor.py

@@ -15,6 +15,7 @@
 import os
 import unittest
 from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace
 
 from unittest.mock import Mock, patch
 
@@ -85,12 +86,24 @@ def test_empty_ssl_options_default_to_negotiating_tls(self):
         context_mock.assert_called_once_with(eventletreactor.SSL.TLS_CLIENT_METHOD)
         assert context is context_mock.return_value
 
+    def test_default_ssl_method_falls_back_to_tls_method(self):
+        tls_method = object()
+
+        with patch.object(eventletreactor, 'SSL', SimpleNamespace(TLS_METHOD=tls_method)):
+            assert eventletreactor._default_ssl_method() is tls_method
+
+    def test_default_ssl_method_falls_back_to_tlsv1_2_method(self):
+        tlsv1_2_method = object()
+
+        with patch.object(eventletreactor, 'SSL', SimpleNamespace(TLSv1_2_METHOD=tlsv1_2_method)):
+            assert eventletreactor._default_ssl_method() is tlsv1_2_method
+
     def test_ssl_version_option_is_preserved(self):
         with patch.object(eventletreactor.SSL, 'Context') as context_mock:
             eventletreactor._build_pyopenssl_context_from_options(
-                {'ssl_version': eventletreactor.SSL.TLSv1_METHOD})
+                {'ssl_version': eventletreactor.SSL.TLSv1_2_METHOD})
 
-        context_mock.assert_called_once_with(eventletreactor.SSL.TLSv1_METHOD)
+        context_mock.assert_called_once_with(eventletreactor.SSL.TLSv1_2_METHOD)
 
     def test_ca_certs_default_to_required_validation(self):
         conn = EventletConnection.__new__(EventletConnection)

tests/unit/io/test_twistedreactor.py

@@ -15,6 +15,7 @@
 import os
 import unittest
 from datetime import datetime, timedelta, timezone
+from types import SimpleNamespace
 from unittest.mock import Mock, patch
 
 try:
@@ -76,12 +77,24 @@ def test_empty_ssl_options_default_to_negotiating_tls(self):
         context_mock.assert_called_once_with(twistedreactor.SSL.TLS_CLIENT_METHOD)
         assert context is context_mock.return_value
 
+    def test_default_ssl_method_falls_back_to_tls_method(self):
+        tls_method = object()
+
+        with patch.object(twistedreactor, 'SSL', SimpleNamespace(TLS_METHOD=tls_method)):
+            assert twistedreactor._default_ssl_method() is tls_method
+
+    def test_default_ssl_method_falls_back_to_tlsv1_2_method(self):
+        tlsv1_2_method = object()
+
+        with patch.object(twistedreactor, 'SSL', SimpleNamespace(TLSv1_2_METHOD=tlsv1_2_method)):
+            assert twistedreactor._default_ssl_method() is tlsv1_2_method
+
     def test_ssl_version_option_is_preserved(self):
         with patch.object(twistedreactor.SSL, 'Context') as context_mock:
             twistedreactor._build_pyopenssl_context_from_options(
-                {'ssl_version': twistedreactor.SSL.TLSv1_METHOD})
+                {'ssl_version': twistedreactor.SSL.TLSv1_2_METHOD})
 
-        context_mock.assert_called_once_with(twistedreactor.SSL.TLSv1_METHOD)
+        context_mock.assert_called_once_with(twistedreactor.SSL.TLSv1_2_METHOD)
 
     def test_ca_certs_default_to_required_validation(self):
         context = twistedreactor._build_pyopenssl_context_from_options({'ca_certs': CA_CERTS})

tests/unit/test_cloud.py

@@ -0,0 +1,53 @@
+# Copyright DataStax, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from types import SimpleNamespace
+
+import pytest
+
+from cassandra.datastax import cloud
+
+
+def test_default_pyopenssl_ssl_method_prefers_tls_client_method():
+    tls_client_method = object()
+
+    ssl_module = SimpleNamespace(
+        TLS_CLIENT_METHOD=tls_client_method,
+        TLS_METHOD=object(),
+        TLSv1_2_METHOD=object())
+
+    assert cloud._default_pyopenssl_ssl_method(ssl_module) is tls_client_method
+
+
+def test_default_pyopenssl_ssl_method_falls_back_to_tls_method():
+    tls_method = object()
+
+    ssl_module = SimpleNamespace(
+        TLS_METHOD=tls_method,
+        TLSv1_2_METHOD=object())
+
+    assert cloud._default_pyopenssl_ssl_method(ssl_module) is tls_method
+
+
+def test_default_pyopenssl_ssl_method_falls_back_to_tlsv1_2_method():
+    tlsv1_2_method = object()
+
+    ssl_module = SimpleNamespace(TLSv1_2_METHOD=tlsv1_2_method)
+
+    assert cloud._default_pyopenssl_ssl_method(ssl_module) is tlsv1_2_method
+
+
+def test_default_pyopenssl_ssl_method_requires_secure_method():
+    with pytest.raises(ImportError, match="secure TLS client method"):
+        cloud._default_pyopenssl_ssl_method(SimpleNamespace())

tests/unit/test_cluster.py

@@ -12,6 +12,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 import unittest
+import warnings
 
 from concurrent.futures import Future
 import logging
@@ -278,6 +279,25 @@ def test_connection_factory_passes_compression_kwarg(self):
                 assert factory.call_args.kwargs['compression'] == expected
                 assert cluster.compression == expected
 
+    def test_empty_ssl_options_are_rejected_with_cloud_config(self):
+        with pytest.raises(ValueError) as exc:
+            Cluster(cloud={'secure_connect_bundle': 'unused'}, ssl_options={})
+
+        assert "cannot be specified with a cloud configuration" in str(exc.value)
+
+    def test_empty_ssl_options_emit_deprecation_warning(self):
+        with pytest.warns(DeprecationWarning, match="Using ssl_options without ssl_context"):
+            cluster = Cluster(ssl_options={})
+
+        assert cluster.ssl_options == {}
+
+    def test_omitted_ssl_options_do_not_emit_deprecation_warning(self):
+        with warnings.catch_warnings(record=True) as recorded_warnings:
+            warnings.simplefilter("always")
+            Cluster()
+
+        assert not [warning for warning in recorded_warnings if warning.category is DeprecationWarning]
+
 
 class SchedulerTest(unittest.TestCase):
     # TODO: this suite could be expanded; for now just adding a test covering a ticket