pyca: adapt import paths for TripleDES cipher

https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.TripleDES

> This algorithm has been deprecated and moved to the Decrepit
  cryptography module. If you need to continue using it then update your
  code to use the new module path. It will be removed from this namespace
  in 48.0.0.

Fixes: https://pagure.io/freeipa/issue/9708
Signed-off-by: Stanislav Levin <slev@altlinux.org>
Reviewed-By: Florence Blanc-Renaud <flo@redhat.com>

ipaclient/plugins/vault.py

@@ -34,6 +34,12 @@ from cryptography.hazmat.primitives import hashes
 from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
 from cryptography.hazmat.primitives.asymmetric import padding
 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+try:
+    # cryptography>=43.0.0
+    from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
+except ImportError:
+    # will be removed from this module in cryptography 48.0.0
+    from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES
 from cryptography.hazmat.primitives.padding import PKCS7
 from cryptography.hazmat.primitives.serialization import (
     load_pem_public_key, load_pem_private_key)
@@ -661,7 +667,7 @@ class ModVaultData(Local):
         if name == constants.VAULT_WRAPPING_AES128_CBC:
             return algorithms.AES(os.urandom(128 // 8))
         elif name == constants.VAULT_WRAPPING_3DES:
-            return algorithms.TripleDES(os.urandom(196 // 8))
+            return TripleDES(os.urandom(196 // 8))
         else:
             # unreachable
             raise ValueError(name)

ipalib/constants.py

@@ -25,20 +25,19 @@ All constants centralised in one file.
 import os
 import string
 import uuid
-import warnings
-
-warnings.filterwarnings(
-    "ignore",
-    "TripleDES has been moved to "
-    "cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and "
-    "will be removed from this module in 48.0.0",
-    category=UserWarning)
 
 from ipaplatform.constants import constants as _constants
 from ipapython.dn import DN
 from ipapython.fqdn import gethostfqdn
 from ipapython.version import VERSION, API_VERSION
-from cryptography.hazmat.primitives.ciphers import algorithms, modes
+from cryptography.hazmat.primitives.ciphers import modes
+try:
+    # cryptography>=43.0.0
+    from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
+except ImportError:
+    # will be removed from this module in cryptography 48.0.0
+    from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES
+
 from cryptography.hazmat.backends.openssl.backend import backend
 
 
@@ -389,7 +388,6 @@ VAULT_WRAPPING_SUPPORTED_ALGOS = (
 VAULT_WRAPPING_DEFAULT_ALGO = VAULT_WRAPPING_AES128_CBC
 
 # Add 3DES for backwards compatibility if supported
-if getattr(algorithms, 'TripleDES', None):
-    if backend.cipher_supported(algorithms.TripleDES(
-                                b"\x00" * 8), modes.CBC(b"\x00" * 8)):
-        VAULT_WRAPPING_SUPPORTED_ALGOS += (VAULT_WRAPPING_3DES,)
+if backend.cipher_supported(TripleDES(
+                            b"\x00" * 8), modes.CBC(b"\x00" * 8)):
+    VAULT_WRAPPING_SUPPORTED_ALGOS += (VAULT_WRAPPING_3DES,)

ipaserver/install/ipa_otptoken_import.py

@@ -37,6 +37,12 @@ from cryptography.hazmat.primitives import hashes, hmac
 from cryptography.hazmat.primitives.padding import PKCS7
 from cryptography.hazmat.primitives.kdf import pbkdf2
 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+try:
+    # cryptography>=43.0.0
+    from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES
+except ImportError:
+    # will be removed from this module in cryptography 48.0.0
+    from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES
 from cryptography.hazmat.backends import default_backend
 
 from ipaplatform.paths import paths
@@ -169,7 +175,7 @@ def convertAlgorithm(value):
     # in the list of the vault wrapping algorithms, we cannot use 3DES anywhere
     if VAULT_WRAPPING_3DES in VAULT_WRAPPING_SUPPORTED_ALGOS:
         supported_algs["http://www.w3.org/2001/04/xmlenc#tripledes-cbc"] = (
-            algorithms.TripleDES, modes.CBC, 64)
+            TripleDES, modes.CBC, 64)
 
     return supported_algs.get(value.lower(), (None, None, None))