Skip to content

Commit 0f10fc4

Browse files
robsdeduderobsdedude
authored
Deprecate old SSL config options instead of removing them (#656)
Amends #639
1 parent d88235d commit 0f10fc4

File tree

10 files changed

+322
-46
lines changed

10 files changed

+322
-46
lines changed

‎CHANGELOG.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
Use `ResultSummary.server.agent`, `ResultSummary.server.protocol_version`,
1313
or call the `dbms.components` procedure instead.
1414
- SSL configuration options have been changed:
15-
- `trust` has been removed.
15+
- `trust` has been deprecated and will be removed in a future release.
1616
Use `trusted_certificates` instead which expects `None` or a `list`. See the
1717
API documentation for more details.
1818
- `neo4j.time` module:

‎docs/source/api.rst

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,7 @@ Additional configuration can be provided via the :class:`neo4j.Driver` construct
164164
+ :ref:`max-connection-pool-size-ref`
165165
+ :ref:`max-transaction-retry-time-ref`
166166
+ :ref:`resolver-ref`
167+
+ :ref:`trust-ref`
167168
+ :ref:`ssl-context-ref`
168169
+ :ref:`trusted-certificates-ref`
169170
+ :ref:`user-agent-ref`
@@ -276,6 +277,36 @@ For example:
276277
:Default: :const:`None`
277278

278279

280+
.. _trust-ref:
281+
282+
``trust``
283+
---------
284+
Specify how to determine the authenticity of encryption certificates provided by the Neo4j instance on connection.
285+
286+
This setting does not have any effect if ``encrypted`` is set to ``False``.
287+
288+
:Type: ``neo4j.TRUST_SYSTEM_CA_SIGNED_CERTIFICATES``, ``neo4j.TRUST_ALL_CERTIFICATES``
289+
290+
.. py:attribute:: neo4j.TRUST_ALL_CERTIFICATES
291+
292+
Trust any server certificate (default). This ensures that communication
293+
is encrypted but does not verify the server certificate against a
294+
certificate authority. This option is primarily intended for use with
295+
the default auto-generated server certificate.
296+
297+
.. py:attribute:: neo4j.TRUST_SYSTEM_CA_SIGNED_CERTIFICATES
298+
299+
Trust server certificates that can be verified against the system
300+
certificate authority. This option is primarily intended for use with
301+
full certificates.
302+
303+
:Default: ``neo4j.TRUST_SYSTEM_CA_SIGNED_CERTIFICATES``.
304+
305+
.. deprecated:: 5.0
306+
This configuration option is deprecated and will be removed in a future
307+
release. Please use :ref:`trusted-certificates-ref` instead.
308+
309+
279310
.. _ssl-context-ref:
280311

281312
``ssl_context``
@@ -287,6 +318,8 @@ If give, ``encrypted`` and ``trusted_certificates`` have no effect.
287318
:Type: :class:`ssl.SSLContext` or :const:`None`
288319
:Default: :const:`None`
289320

321+
.. versionadded:: 5.0
322+
290323

291324
.. _trusted-certificates-ref:
292325

@@ -317,6 +350,8 @@ custom ``ssl_context`` is configured.
317350

318351
:Default: :const:`None`
319352

353+
.. versionadded:: 5.0
354+
320355

321356
.. _user-agent-ref:
322357

‎neo4j/__init__.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,8 @@
5454
"SessionConfig",
5555
"SummaryCounters",
5656
"Transaction",
57+
"TRUST_ALL_CERTIFICATES",
58+
"TRUST_SYSTEM_CA_SIGNED_CERTIFICATES",
5759
"unit_of_work",
5860
"Version",
5961
"WorkspaceConfig",
@@ -105,6 +107,8 @@
105107
READ_ACCESS,
106108
ServerInfo,
107109
SYSTEM_DATABASE,
110+
TRUST_ALL_CERTIFICATES,
111+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES,
108112
Version,
109113
WRITE_ACCESS,
110114
)

‎neo4j/_async/driver.py

Lines changed: 45 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,11 @@
2020

2121
from .._async_compat.util import AsyncUtil
2222
from ..addressing import Address
23-
from ..api import READ_ACCESS
23+
from ..api import (
24+
READ_ACCESS,
25+
TRUST_ALL_CERTIFICATES,
26+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES,
27+
)
2428
from ..conf import (
2529
Config,
2630
PoolConfig,
@@ -71,20 +75,47 @@ def driver(cls, uri, *, auth=None, **config):
7175

7276
driver_type, security_type, parsed = parse_neo4j_uri(uri)
7377

74-
if security_type in [SECURITY_TYPE_SELF_SIGNED_CERTIFICATE, SECURITY_TYPE_SECURE] and ("encrypted" in config.keys() or "trusted_certificates" in config.keys()):
78+
# TODO: 6.0 remove "trust" config option
79+
if "trust" in config.keys():
80+
if config["trust"] not in (TRUST_ALL_CERTIFICATES,
81+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES):
82+
from neo4j.exceptions import ConfigurationError
83+
raise ConfigurationError(
84+
"The config setting `trust` values are {!r}"
85+
.format(
86+
[
87+
TRUST_ALL_CERTIFICATES,
88+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES,
89+
]
90+
)
91+
)
92+
93+
if (security_type in [SECURITY_TYPE_SELF_SIGNED_CERTIFICATE, SECURITY_TYPE_SECURE]
94+
and ("encrypted" in config.keys()
95+
or "trust" in config.keys()
96+
or "trusted_certificates" in config.keys()
97+
or "ssl_context" in config.keys())):
7598
from neo4j.exceptions import ConfigurationError
76-
raise ConfigurationError("The config settings 'encrypted' and 'trust' can only be used with the URI schemes {!r}. Use the other URI schemes {!r} for setting encryption settings.".format(
77-
[
78-
URI_SCHEME_BOLT,
79-
URI_SCHEME_NEO4J,
80-
],
81-
[
82-
URI_SCHEME_BOLT_SELF_SIGNED_CERTIFICATE,
83-
URI_SCHEME_BOLT_SECURE,
84-
URI_SCHEME_NEO4J_SELF_SIGNED_CERTIFICATE,
85-
URI_SCHEME_NEO4J_SECURE,
86-
]
87-
))
99+
100+
# TODO: 6.0 remove "trust" from error message
101+
raise ConfigurationError(
102+
'The config settings "encrypted", "trust", '
103+
'"trusted_certificates", and "ssl_context" can only be used '
104+
"with the URI schemes {!r}. Use the other URI schemes {!r} "
105+
"for setting encryption settings."
106+
.format(
107+
[
108+
URI_SCHEME_BOLT,
109+
URI_SCHEME_NEO4J,
110+
],
111+
[
112+
URI_SCHEME_BOLT_SELF_SIGNED_CERTIFICATE,
113+
URI_SCHEME_BOLT_SECURE,
114+
URI_SCHEME_NEO4J_SELF_SIGNED_CERTIFICATE,
115+
URI_SCHEME_NEO4J_SECURE,
116+
]
117+
)
118+
)
88119

89120
if security_type == SECURITY_TYPE_SECURE:
90121
config["encrypted"] = True

‎neo4j/_sync/driver.py

Lines changed: 45 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,11 @@
2020

2121
from .._async_compat.util import Util
2222
from ..addressing import Address
23-
from ..api import READ_ACCESS
23+
from ..api import (
24+
READ_ACCESS,
25+
TRUST_ALL_CERTIFICATES,
26+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES,
27+
)
2428
from ..conf import (
2529
Config,
2630
PoolConfig,
@@ -71,20 +75,47 @@ def driver(cls, uri, *, auth=None, **config):
7175

7276
driver_type, security_type, parsed = parse_neo4j_uri(uri)
7377

74-
if security_type in [SECURITY_TYPE_SELF_SIGNED_CERTIFICATE, SECURITY_TYPE_SECURE] and ("encrypted" in config.keys() or "trusted_certificates" in config.keys()):
78+
# TODO: 6.0 remove "trust" config option
79+
if "trust" in config.keys():
80+
if config["trust"] not in (TRUST_ALL_CERTIFICATES,
81+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES):
82+
from neo4j.exceptions import ConfigurationError
83+
raise ConfigurationError(
84+
"The config setting `trust` values are {!r}"
85+
.format(
86+
[
87+
TRUST_ALL_CERTIFICATES,
88+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES,
89+
]
90+
)
91+
)
92+
93+
if (security_type in [SECURITY_TYPE_SELF_SIGNED_CERTIFICATE, SECURITY_TYPE_SECURE]
94+
and ("encrypted" in config.keys()
95+
or "trust" in config.keys()
96+
or "trusted_certificates" in config.keys()
97+
or "ssl_context" in config.keys())):
7598
from neo4j.exceptions import ConfigurationError
76-
raise ConfigurationError("The config settings 'encrypted' and 'trust' can only be used with the URI schemes {!r}. Use the other URI schemes {!r} for setting encryption settings.".format(
77-
[
78-
URI_SCHEME_BOLT,
79-
URI_SCHEME_NEO4J,
80-
],
81-
[
82-
URI_SCHEME_BOLT_SELF_SIGNED_CERTIFICATE,
83-
URI_SCHEME_BOLT_SECURE,
84-
URI_SCHEME_NEO4J_SELF_SIGNED_CERTIFICATE,
85-
URI_SCHEME_NEO4J_SECURE,
86-
]
87-
))
99+
100+
# TODO: 6.0 remove "trust" from error message
101+
raise ConfigurationError(
102+
'The config settings "encrypted", "trust", '
103+
'"trusted_certificates", and "ssl_context" can only be used '
104+
"with the URI schemes {!r}. Use the other URI schemes {!r} "
105+
"for setting encryption settings."
106+
.format(
107+
[
108+
URI_SCHEME_BOLT,
109+
URI_SCHEME_NEO4J,
110+
],
111+
[
112+
URI_SCHEME_BOLT_SELF_SIGNED_CERTIFICATE,
113+
URI_SCHEME_BOLT_SECURE,
114+
URI_SCHEME_NEO4J_SELF_SIGNED_CERTIFICATE,
115+
URI_SCHEME_NEO4J_SECURE,
116+
]
117+
)
118+
)
88119

89120
if security_type == SECURITY_TYPE_SECURE:
90121
config["encrypted"] = True

‎neo4j/api.py

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,10 @@
4848

4949
URI_SCHEME_BOLT_ROUTING = "bolt+routing"
5050

51+
# TODO: 6.0 - remove TRUST constants
52+
TRUST_SYSTEM_CA_SIGNED_CERTIFICATES = "TRUST_SYSTEM_CA_SIGNED_CERTIFICATES" # Default
53+
TRUST_ALL_CERTIFICATES = "TRUST_ALL_CERTIFICATES"
54+
5155
SYSTEM_DATABASE = "system"
5256
DEFAULT_DATABASE = None # Must be a non string hashable value
5357

0 commit comments

Comments
 (0)