[PATCH 10/12] SecureSocket: make cryptography import optional

[Ondrej Lichtner]

From: Ondrej Lichtner <olichtne(a)redhat.com&gt;

The cryptography library is imported only when authentication methods
that need it are requested. If the library is missing, the user will get
an error message explaining the problem. It's a pretty hackish way of
doing the imports but I'm not aware of a better solution... I'm open to
suggestions if there are any.

Signed-off-by: Ondrej Lichtner <olichtne(a)redhat.com&gt;
---
 lnst/Common/SecureSocket.py     | 72 ++++++++++++++++++++++++++++++++++-------
 lnst/Controller/CtlSecSocket.py | 40 +++++++++++++++++++----
 lnst/Slave/SlaveSecSocket.py    | 42 ++++++++++++++++++++----
 3 files changed, 131 insertions(+), 23 deletions(-)

diff --git a/lnst/Common/SecureSocket.py b/lnst/Common/SecureSocket.py
index d319c54..cd149c2 100644
--- a/lnst/Common/SecureSocket.py
+++ b/lnst/Common/SecureSocket.py
@@ -19,17 +19,6 @@ import os
 import cPickle
 import hashlib
 import hmac
-import cryptography.exceptions
-from cryptography.hazmat.primitives import hashes
-from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
-from cryptography.hazmat.primitives.asymmetric import padding, ec
-from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
-from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
-from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
-from cryptography.hazmat.primitives.asymmetric.dsa import DSAPrivateKey
-from cryptography.hazmat.primitives.asymmetric.dsa import DSAPublicKey
-from cryptography.hazmat.backends import default_backend
 
 DH_GROUP = {"p":
int("0xFFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD1"\
                      "29024E088A67CC74020BBEA63B139B22514A08798E3404DD"\
@@ -75,6 +64,58 @@ if SRP_GROUP["p"].bit_length()%8:
 class SecSocketException(Exception):
     pass
 
+cryptography = None
+hashes = None
+Cipher = None
+algorithms = None
+modes = None
+padding = None
+ec = None
+EllipticCurvePrivateKey = None
+EllipticCurvePublicKey = None
+RSAPrivateKey = None
+RSAPublicKey = None
+DSAPrivateKey = None
+DSAPublicKey = None
+default_backend = None
+cryptography_imported = False
+def cryptography_imports():
+    global cryptography_imported
+    if cryptography_imported:
+        return
+
+    global cryptography
+    global hashes
+    global Cipher
+    global algorithms
+    global modes
+    global padding
+    global ec
+    global EllipticCurvePrivateKey
+    global EllipticCurvePublicKey
+    global RSAPrivateKey
+    global RSAPublicKey
+    global DSAPrivateKey
+    global DSAPublicKey
+    global default_backend
+
+    try:
+        import cryptography.exceptions
+        from cryptography.hazmat.primitives import hashes
+        from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
+        from cryptography.hazmat.primitives.asymmetric import padding, ec
+        from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePrivateKey
+        from cryptography.hazmat.primitives.asymmetric.ec import EllipticCurvePublicKey
+        from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey
+        from cryptography.hazmat.primitives.asymmetric.rsa import RSAPublicKey
+        from cryptography.hazmat.primitives.asymmetric.dsa import DSAPrivateKey
+        from cryptography.hazmat.primitives.asymmetric.dsa import DSAPublicKey
+        from cryptography.hazmat.backends import default_backend
+        cryptography_imported = True
+    except ImportError:
+        raise SecSocketException("Library 'cryptography' missing "\
+                                 "can't establish secure channel.")
+
 class SecureSocket(object):
     def __init__(self, soc):
         self._role = None
@@ -112,6 +153,7 @@ class SecureSocket(object):
     def _add_mac_sign(self, data):
         if not self._current_write_spec["mac_key"]:
             return data
+        cryptography_imports()
 
         msg = str(self._current_write_spec["seq_num"]) + str(len(data)) + data
         signature = hmac.new(self._current_write_spec["mac_key"],
@@ -124,6 +166,7 @@ class SecureSocket(object):
     def _del_mac_sign(self, signed_data):
         if not self._current_read_spec["mac_key"]:
             return signed_data
+        cryptography_imports()
 
         signed_msg = cPickle.loads(signed_data)
         data = signed_msg["data"]
@@ -140,6 +183,7 @@ class SecureSocket(object):
     def _add_padding(self, data):
         if not self._current_write_spec["enc_key"]:
             return data
+        cryptography_imports()
 
         block_size = algorithms.AES.block_size/8
         pad_length = block_size - (len(data) % block_size)
@@ -152,6 +196,7 @@ class SecureSocket(object):
     def _del_padding(self, data):
         if not self._current_read_spec["enc_key"]:
             return data
+        cryptography_imports()
 
         pad_length = int(data[-1].encode("hex"), 16)
         for char in data[-pad_length]:
@@ -163,6 +208,7 @@ class SecureSocket(object):
     def _add_encrypt(self, data):
         if not self._current_write_spec["enc_key"]:
             return data
+        cryptography_imports()
 
         iv = os.urandom(algorithms.AES.block_size/8)
         mode = modes.CBC(iv)
@@ -180,6 +226,7 @@ class SecureSocket(object):
     def _del_encrypt(self, data):
         if not self._current_read_spec["enc_key"]:
             return data
+        cryptography_imports()
 
         encrypted_msg = cPickle.loads(data)
         encrypted_data = encrypted_msg["enc_data"]
@@ -313,6 +360,7 @@ class SecureSocket(object):
             server_spec = self._next_read_spec
         else:
             raise SecSocketException("Socket without a role!")
+        cryptography_imports()
 
         aes_keysize = max(algorithms.AES.key_sizes)/8
         mac_keysize = hashlib.sha256().block_size
@@ -334,6 +382,7 @@ class SecureSocket(object):
         return
 
     def _sign_data(self, data, privkey):
+        cryptography_imports()
         if isinstance(privkey, DSAPrivateKey):
             signer = privkey.signer(hashes.SHA256())
         elif isinstance(privkey, RSAPrivateKey):
@@ -349,6 +398,7 @@ class SecureSocket(object):
         return signer.finalize()
 
     def _verify_signature(self, pubkey, data, signature):
+        cryptography_imports()
         if isinstance(pubkey, DSAPublicKey):
             verifier = pubkey.verifier(signature, hashes.SHA256())
         elif isinstance(pubkey, RSAPublicKey):
diff --git a/lnst/Controller/CtlSecSocket.py b/lnst/Controller/CtlSecSocket.py
index b4c857a..1f16055 100644
--- a/lnst/Controller/CtlSecSocket.py
+++ b/lnst/Controller/CtlSecSocket.py
@@ -19,13 +19,37 @@ from lnst.Common.SecureSocket import SecureSocket
 from lnst.Common.SecureSocket import DH_GROUP, SRP_GROUP
 from lnst.Common.SecureSocket import SecSocketException
 from lnst.Common.Config import lnst_config
-from cryptography.hazmat.primitives import serialization as ser
-from cryptography.hazmat.primitives.serialization import load_pem_private_key
-from cryptography.hazmat.primitives.serialization import load_pem_public_key
-from cryptography.hazmat.primitives.serialization import load_ssh_public_key
-from cryptography.hazmat.backends import default_backend
 
-backend = default_backend()
+ser = None
+load_pem_private_key = None
+load_pem_public_key = None
+load_ssh_public_key = None
+backend = None
+cryptography_imported = False
+def cryptography_imports():
+    global cryptography_imported
+    if cryptography_imported:
+        return
+
+    global ser
+    global load_pem_private_key
+    global load_pem_public_key
+    global load_ssh_public_key
+    global backend
+
+    try:
+        import cryptography
+        import cryptography.hazmat.primitives.serialization as ser
+        from cryptography.hazmat.primitives.serialization import load_pem_private_key
+        from cryptography.hazmat.primitives.serialization import load_pem_public_key
+        from cryptography.hazmat.primitives.serialization import load_ssh_public_key
+        from cryptography.hazmat.backends import default_backend
+    except ImportError:
+        raise SecSocketException("Library 'cryptography' missing "\
+                                 "can't establish secure channel.")
+
+    backend = default_backend()
+    cryptography_imported = True
 
 class CtlSecSocket(SecureSocket):
     def __init__(self, soc):
@@ -57,10 +81,13 @@ class CtlSecSocket(SecureSocket):
             logging.warning("        NO AUTHENTICATION IN PLACE")
             logging.warning("SECURE CHANNEL IS VULNERABLE TO MIM ATTACKS")
             logging.warning("===========================================")
+            cryptography_imports()
             self._dh_handshake()
         elif sec_params["auth_type"] == "ssh":
+            cryptography_imports()
             self._ssh_handshake()
         elif sec_params["auth_type"] == "pubkey":
+            cryptography_imports()
             ctl_identity = sec_params["identity"]
             ctl_key_path = sec_params["privkey"]
             try:
@@ -81,6 +108,7 @@ class CtlSecSocket(SecureSocket):
 
             self._pubkey_handshake(ctl_identity, ctl_key, srv_key)
         elif sec_params["auth_type"] == "password":
+            cryptography_imports()
             self._passwd_handshake(sec_params["auth_passwd"])
         else:
             raise SecSocketException("Unknown authentication method.")
diff --git a/lnst/Slave/SlaveSecSocket.py b/lnst/Slave/SlaveSecSocket.py
index 9e3cd92..8810bac 100644
--- a/lnst/Slave/SlaveSecSocket.py
+++ b/lnst/Slave/SlaveSecSocket.py
@@ -19,13 +19,39 @@ import logging
 from lnst.Common.SecureSocket import SecureSocket
 from lnst.Common.SecureSocket import DH_GROUP, SRP_GROUP
 from lnst.Common.SecureSocket import SecSocketException
-from cryptography.hazmat.primitives import serialization as ser
-from cryptography.hazmat.primitives.serialization import load_pem_private_key
-from cryptography.hazmat.primitives.serialization import load_pem_public_key
-from cryptography.hazmat.primitives.serialization import load_ssh_public_key
-from cryptography.hazmat.backends import default_backend
 
-backend = default_backend()
+ser = None
+load_pem_private_key = None
+load_pem_public_key = None
+load_ssh_public_key = None
+backend = None
+cryptography_imported = False
+def cryptography_imports():
+    global cryptography_imported
+    if cryptography_imported:
+        return
+
+    global ser
+    global load_pem_private_key
+    global load_pem_public_key
+    global load_ssh_public_key
+    global backend
+
+    try:
+        import cryptography
+        import cryptography.hazmat.primitives.serialization as ser
+        from cryptography.hazmat.primitives.serialization import load_pem_private_key
+        from cryptography.hazmat.primitives.serialization import load_pem_public_key
+        from cryptography.hazmat.primitives.serialization import load_ssh_public_key
+        from cryptography.hazmat.backends import default_backend
+    except ImportError:
+        logging.error("Library 'cryptography' missing "\
+                      "can't establish secure channel.")
+        raise SecSocketException("Library 'cryptography' missing "\
+                                 "can't establish secure channel.")
+
+    backend = default_backend()
+    cryptography_imported = True
 
 class SlaveSecSocket(SecureSocket):
     def __init__(self, soc):
@@ -55,10 +81,13 @@ class SlaveSecSocket(SecureSocket):
             logging.warning("        NO AUTHENTICATION IN PLACE")
             logging.warning("SECURE CHANNEL IS VULNERABLE TO MIM ATTACKS")
             logging.warning("===========================================")
+            cryptography_imports()
             self._dh_handshake()
         elif sec_params["auth_types"] == "ssh":
+            cryptography_imports()
             self._ssh_handshake()
         elif sec_params["auth_types"] == "pubkey":
+            cryptography_imports()
             srv_key = None
             with open(sec_params["privkey"], 'r') as f:
                 srv_key = load_pem_private_key(f.read(), None, backend)
@@ -73,6 +102,7 @@ class SlaveSecSocket(SecureSocket):
 
             self._pubkey_handshake(srv_key, ctl_pubkeys)
         elif sec_params["auth_types"] == "password":
+            cryptography_imports()
             self._passwd_handshake(sec_params["auth_password"])
         else:
             raise SecSocketException("Unknown authentication method.")
-- 
2.7.2