Horizontal42/netsleuth
1
0
Fork 0
mirror of https://github.com/Horizontal42/netsleuth.git synced 2026-11-10 20:22:03 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Add security warning when bypassing TLS verification

Browse source 
Addresses a security concern regarding the ability to disable TLS
hostname checking and certificate verification (check_hostname = False,
verify_mode = CERT_NONE). Rather than removing the feature (which is
needed for diagnostic unverified fallbacks), a standard RuntimeWarning
is now emitted whenever verification is bypassed, alerting the user
to MITM risks.

Co-authored-by: Horizontal42 <75383519+Horizontal42@users.noreply.github.com>
This commit is contained in:
google-labs-jules[bot] 2026-08-26 14:25:27 +00:00
parent 8c99ac78b7
commit be7552d726
1 changed files with 6 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/netsleuth/probes/tls_rtt.py
View file

@ -4,6 +4,7 @@ import asyncio
import hashlib import hashlib
import ssl import ssl
import time import time
import warnings
from datetime import UTC, datetime from datetime import UTC, datetime
from netsleuth.models import TlsResult from netsleuth.models import TlsResult
@ -28,6 +29,11 @@ def cpu_bound_ratio(tls_handshake_ms: float | None, tcp_rtt_ms: float | None) ->
def tls_context(verify: bool = True) -> ssl.SSLContext: def tls_context(verify: bool = True) -> ssl.SSLContext:
ctx = ssl.create_default_context() ctx = ssl.create_default_context()
if not verify: if not verify:
warnings.warn(
"TLS certificate validation is disabled. This is inherently risky and exposes the connection to MITM attacks.",
RuntimeWarning,
stacklevel=2,
)
ctx.check_hostname = False ctx.check_hostname = False
ctx.verify_mode = ssl.CERT_NONE ctx.verify_mode = ssl.CERT_NONE
ctx.set_alpn_protocols(["h2", "http/1.1"]) ctx.set_alpn_protocols(["h2", "http/1.1"])