Update cryptography to 42.0.4 and update certdir (SYN-3552, SYN-6860)

pyproject.toml

@@ -23,8 +23,8 @@ classifiers = [
     'Operating System :: POSIX :: Linux',
 ]
 dependencies = [
-    'pyOpenSSL>=23.0.0,<23.3.0',
-    'cryptography>=39.0.1,<42.0.0',
+    'pyOpenSSL>=24.0.0,<25.0.0',
+    'cryptography>=42.0.4,<43.0.0',
     'msgpack>=1.0.5,<1.1.0',
     'xxhash>=1.4.4,<3.5.0',
     'lmdb>=1.2.1,<1.5.0',

requirements.txt

@@ -1,4 +1,4 @@
-pyOpenSSL>=23.0.0,<23.3.0
+pyOpenSSL>=24.0.0,<25.0.0
 msgpack>=1.0.5,<1.1.0
 xxhash>=1.4.4,<3.5.0
 lmdb>=1.2.1,<1.5.0
@@ -32,4 +32,4 @@ beautifulsoup4[html5lib]>=4.11.1,<5.0.0
 # pin. Cryptography also vendors a copy of OpenSSL, so it needs to be able to
 # have a minimum version bumped in the event of a OpenSSL vulnerability that
 # needs to be patched.
-cryptography>=39.0.1,<42.0.0
+cryptography>=42.0.4,<43.0.0

synapse/cortex.py

@@ -2451,7 +2451,7 @@ async def addStormPkg(self, pkgdef, verify=False):
                 raise s_exc.BadPkgDef(mesg=mesg)
 
             try:
-                cert = self.certdir.loadCertByts(certbyts)
+                cert = self.certdir.loadCertByts(certbyts.encode('utf-8'))
             except s_exc.BadCertBytes as e:
                 raise s_exc.BadPkgDef(mesg='Storm package has malformed certificate!') from None
 
@@ -2465,7 +2465,7 @@ async def addStormPkg(self, pkgdef, verify=False):
                     mesg = 'Storm package has invalid certificate!'
                 raise s_exc.BadPkgDef(mesg=mesg) from None
 
-            pubk = s_rsa.PubKey(cert.get_pubkey().to_cryptography_key())
+            pubk = s_rsa.PubKey(cert.public_key())
             if not pubk.verifyitem(pkgcopy, s_common.uhex(signbyts)):
                 mesg = 'Storm package signature does not match!'
                 raise s_exc.BadPkgDef(mesg=mesg)

synapse/lib/aha.py

@@ -5,6 +5,8 @@
 import logging
 import collections
 
+import cryptography.x509 as c_x509
+
 import synapse.exc as s_exc
 import synapse.common as s_common
 import synapse.daemon as s_daemon
@@ -379,8 +381,9 @@ async def signUserCsr(self, byts):
         username = f'{ahauser}@{ahanetw}'
 
         xcsr = self.aha.certdir._loadCsrByts(byts)
-        if xcsr.get_subject().CN != username:
-            mesg = f'Invalid user CSR CN={xcsr.get_subject().CN}.'
+        name = xcsr.subject.get_attributes_for_oid(c_x509.NameOID.COMMON_NAME)[0].value
+        if name != username:
+            mesg = f'Invalid user CSR CN={name}.'
             raise s_exc.BadArg(mesg=mesg)
 
         pkey, cert = self.aha.certdir.signUserCsr(xcsr, ahanetw, save=False)
@@ -407,8 +410,9 @@ async def signHostCsr(self, byts):
         hostname = f'{ahaname}.{ahanetw}'
 
         xcsr = self.aha.certdir._loadCsrByts(byts)
-        if xcsr.get_subject().CN != hostname:
-            mesg = f'Invalid host CSR CN={xcsr.get_subject().CN}.'
+        name = xcsr.subject.get_attributes_for_oid(c_x509.NameOID.COMMON_NAME)[0].value
+        if name != hostname:
+            mesg = f'Invalid host CSR CN={name}.'
             raise s_exc.BadArg(mesg=mesg)
 
         pkey, cert = self.aha.certdir.signHostCsr(xcsr, ahanetw, save=False)
@@ -422,8 +426,9 @@ async def signUserCsr(self, byts):
         username = f'{ahauser}@{ahanetw}'
 
         xcsr = self.aha.certdir._loadCsrByts(byts)
-        if xcsr.get_subject().CN != username:
-            mesg = f'Invalid user CSR CN={xcsr.get_subject().CN}.'
+        name = xcsr.subject.get_attributes_for_oid(c_x509.NameOID.COMMON_NAME)[0].value
+        if name != username:
+            mesg = f'Invalid user CSR CN={name}.'
             raise s_exc.BadArg(mesg=mesg)
 
         pkey, cert = self.aha.certdir.signUserCsr(xcsr, ahanetw, save=False)
@@ -938,7 +943,7 @@ async def saveUserCert(self, name, userkey, usercert):
     async def signHostCsr(self, csrtext, signas=None, sans=None):
         xcsr = self.certdir._loadCsrByts(csrtext.encode())
 
-        hostname = xcsr.get_subject().CN
+        hostname = xcsr.subject.get_attributes_for_oid(c_x509.NameOID.COMMON_NAME)[0].value
 
         hostpath = s_common.genpath(self.dirn, 'certs', 'hosts', f'{hostname}.crt')
         if os.path.isfile(hostpath):
@@ -957,7 +962,7 @@ async def signHostCsr(self, csrtext, signas=None, sans=None):
     async def signUserCsr(self, csrtext, signas=None):
         xcsr = self.certdir._loadCsrByts(csrtext.encode())
 
-        username = xcsr.get_subject().CN
+        username = xcsr.subject.get_attributes_for_oid(c_x509.NameOID.COMMON_NAME)[0].value
 
         userpath = s_common.genpath(self.dirn, 'certs', 'users', f'{username}.crt')
         if os.path.isfile(userpath):