From bc31c2700c3779cfad688eb098042060bf09df3c Mon Sep 17 00:00:00 2001 From: Stanislav Levin Date: Mon, 2 Dec 2024 15:04:30 +0300 Subject: [PATCH] pyca: adapt import paths for TripleDES cipher https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#cryptography.hazmat.primitives.ciphers.algorithms.TripleDES > This algorithm has been deprecated and moved to the Decrepit cryptography module. If you need to continue using it then update your code to use the new module path. It will be removed from this namespace in 48.0.0. Fixes: https://pagure.io/freeipa/issue/9708 Signed-off-by: Stanislav Levin Reviewed-By: Florence Blanc-Renaud --- ipaclient/plugins/vault.py | 8 +++++++- ipalib/constants.py | 24 +++++++++++------------- ipaserver/install/ipa_otptoken_import.py | 8 +++++++- 3 files changed, 25 insertions(+), 15 deletions(-) diff --git a/ipaclient/plugins/vault.py b/ipaclient/plugins/vault.py index 75415c03a..6af729793 100644 --- a/ipaclient/plugins/vault.py +++ b/ipaclient/plugins/vault.py @@ -34,6 +34,12 @@ from cryptography.hazmat.primitives import hashes from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC from cryptography.hazmat.primitives.asymmetric import padding from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes +try: + # cryptography>=43.0.0 + from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES +except ImportError: + # will be removed from this module in cryptography 48.0.0 + from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES from cryptography.hazmat.primitives.padding import PKCS7 from cryptography.hazmat.primitives.serialization import ( load_pem_public_key, load_pem_private_key) @@ -661,7 +667,7 @@ class ModVaultData(Local): if name == constants.VAULT_WRAPPING_AES128_CBC: return algorithms.AES(os.urandom(128 // 8)) elif name == constants.VAULT_WRAPPING_3DES: - return algorithms.TripleDES(os.urandom(196 // 8)) + return TripleDES(os.urandom(196 // 8)) else: # unreachable raise ValueError(name) diff --git a/ipalib/constants.py b/ipalib/constants.py index b657e5a90..c90caa221 100644 --- a/ipalib/constants.py +++ b/ipalib/constants.py @@ -25,20 +25,19 @@ All constants centralised in one file. import os import string import uuid -import warnings - -warnings.filterwarnings( - "ignore", - "TripleDES has been moved to " - "cryptography.hazmat.decrepit.ciphers.algorithms.TripleDES and " - "will be removed from this module in 48.0.0", - category=UserWarning) from ipaplatform.constants import constants as _constants from ipapython.dn import DN from ipapython.fqdn import gethostfqdn from ipapython.version import VERSION, API_VERSION -from cryptography.hazmat.primitives.ciphers import algorithms, modes +from cryptography.hazmat.primitives.ciphers import modes +try: + # cryptography>=43.0.0 + from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES +except ImportError: + # will be removed from this module in cryptography 48.0.0 + from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES + from cryptography.hazmat.backends.openssl.backend import backend @@ -389,7 +388,6 @@ VAULT_WRAPPING_SUPPORTED_ALGOS = ( VAULT_WRAPPING_DEFAULT_ALGO = VAULT_WRAPPING_AES128_CBC # Add 3DES for backwards compatibility if supported -if getattr(algorithms, 'TripleDES', None): - if backend.cipher_supported(algorithms.TripleDES( - b"\x00" * 8), modes.CBC(b"\x00" * 8)): - VAULT_WRAPPING_SUPPORTED_ALGOS += (VAULT_WRAPPING_3DES,) +if backend.cipher_supported(TripleDES( + b"\x00" * 8), modes.CBC(b"\x00" * 8)): + VAULT_WRAPPING_SUPPORTED_ALGOS += (VAULT_WRAPPING_3DES,) diff --git a/ipaserver/install/ipa_otptoken_import.py b/ipaserver/install/ipa_otptoken_import.py index 279a7502d..17457f6c5 100644 --- a/ipaserver/install/ipa_otptoken_import.py +++ b/ipaserver/install/ipa_otptoken_import.py @@ -37,6 +37,12 @@ from cryptography.hazmat.primitives import hashes, hmac from cryptography.hazmat.primitives.padding import PKCS7 from cryptography.hazmat.primitives.kdf import pbkdf2 from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes +try: + # cryptography>=43.0.0 + from cryptography.hazmat.decrepit.ciphers.algorithms import TripleDES +except ImportError: + # will be removed from this module in cryptography 48.0.0 + from cryptography.hazmat.primitives.ciphers.algorithms import TripleDES from cryptography.hazmat.backends import default_backend from ipaplatform.paths import paths @@ -169,7 +175,7 @@ def convertAlgorithm(value): # in the list of the vault wrapping algorithms, we cannot use 3DES anywhere if VAULT_WRAPPING_3DES in VAULT_WRAPPING_SUPPORTED_ALGOS: supported_algs["http://www.w3.org/2001/04/xmlenc#tripledes-cbc"] = ( - algorithms.TripleDES, modes.CBC, 64) + TripleDES, modes.CBC, 64) return supported_algs.get(value.lower(), (None, None, None))