[v9r0] Use SSL/cryptography instead of M2Crypto/pyasn1

docs/source/AdministratorGuide/ServerInstallations/environment_variable_configuration.rst

@@ -43,13 +43,21 @@ DIRAC_HTTPS_SSL_METHOD_MIN
   If set, overrides the lowest supported TLS version when using HTTPS. It should be a valid value of :py:class:`ssl.TLSVersion`.
 
 DIRAC_M2CRYPTO_SPLIT_HANDSHAKE
-  If ``true`` or ``yes`` the SSL handshake is done in a new thread (default Yes)
+  Only relevant with ``DIRAC_USE_M2CRYPTO``. If ``true`` or ``yes`` the SSL handshake is done in a new thread (default Yes)
 
 DIRAC_M2CRYPTO_SSL_CIPHERS
-  If set, overwrites the default SSL ciphers accepted. It should be a colon separated list. See :py:mod:`DIRAC.Core.DISET`
+  Only relevant with ``DIRAC_USE_M2CRYPTO`` (but also accepted as an alias of ``DIRAC_SSL_CIPHERS`` by the default implementation). If set, overwrites the default SSL ciphers accepted. It should be a colon separated list. See :py:mod:`DIRAC.Core.DISET`
 
 DIRAC_M2CRYPTO_SSL_METHODS
-  If set, overwrites the default SSL methods accepted. It should be a colon separated list. See :py:mod:`DIRAC.Core.DISET`
+  Only relevant with ``DIRAC_USE_M2CRYPTO``. If set, overwrites the default SSL methods accepted. It should be a colon separated list. See :py:mod:`DIRAC.Core.DISET`
+
+DIRAC_SSL_CIPHERS
+  If set, overwrites the default SSL ciphers accepted by the DISET protocol. It should be an OpenSSL style colon separated list.
+
+DIRAC_USE_M2CRYPTO
+  If ``true`` or ``yes``, use the legacy M2Crypto/pyasn1 based implementation of the X509 layer and of the TLS transports (DISET and HTTPS) instead of the default one, based on pyca/cryptography and the :py:mod:`ssl` module of the standard library (default No).
+  The implementation is selected once, at import time, so it must be set consistently for all the components of an installation.
+  The optional dependencies M2Crypto, pyasn1, pyasn1-modules and (for HTTPS services) tornado-m2crypto with the patched DIRACGrid tornado fork must be installed.
 
 DIRAC_MYSQL_OPTIMIZER_TRACES_PATH
   If set, it should point to an existing directory, where MySQL Optimizer traces will be stored. See :py:func:`DIRAC.Core.Utilities.MySQL.captureOptimizerTraces`

docs/source/DeveloperGuide/TornadoServices/index.rst

@@ -313,7 +313,12 @@ How to install Tornado
 Requirements
 ************
 
-Two special python packages are needed:
+The standard tornado package is used: the TLS layer (including grid proxy
+support) relies on the ``ssl`` module of the python standard library
+(python >= 3.13 is required on the server side).
+
+When the legacy M2Crypto implementation is enabled (``DIRAC_USE_M2CRYPTO=Yes``),
+two special python packages are needed instead:
 
 * git+https://github.com/DIRACGrid/tornado.git@iostreamConfigurable : in place of the standard tornado. This adds configurable feature to tornado
 * git+https://github.com/DIRACGrid/tornado_m2crypto.git: this allows to use tornado with M2Crypto

environment.yml

@@ -22,16 +22,19 @@ dependencies:
   - fts3
   - gitpython >=2.1.0
   - invoke
+  - cryptography >=47.0.0
+  # m2crypto, pyasn1 and pyasn1-modules are only needed for the legacy
+  # M2Crypto based implementation (DIRAC_USE_M2CRYPTO=Yes)
   - m2crypto >=0.38.0
+  - pyasn1 >0.4.1
+  - pyasn1-modules
   - matplotlib
   - numpy
   - paramiko
   - pexpect >=4.0.1
   - pillow
   - prompt-toolkit >=3,<4
   - psutil >=4.2.0
-  - pyasn1 >0.4.1
-  - pyasn1-modules
   - pydantic >=2
   - python-json-logger >=0.1.8
   - pytz >=2015.7
@@ -89,7 +92,10 @@ dependencies:
   - uritemplate
   # - readline >=6.2.4 in the standard library
   - simplejson >=3.8.1
-  #- tornado >=5.0.0,<6.0.0
+  # tornado is installed with pip below: the DIRACGrid fork is needed for the
+  # legacy M2Crypto based implementation (DIRAC_USE_M2CRYPTO=Yes) and behaves
+  # as the standard tornado >=5.1.1,<6.0.0 otherwise
+  #- tornado >=5.1.1,<6.0.0
   - typing >=3.6.6
   - rucio-clients >=34.4.2
   # For mypy
@@ -105,6 +111,8 @@ dependencies:
     - Authlib >=1.0.0
     - dominate
     - pyjwt
+    # The following two packages are only needed for the legacy M2Crypto
+    # based implementation (DIRAC_USE_M2CRYPTO=Yes)
     # This is a fork of tornado with a patch to allow for configurable iostream
     - git+https://github.com/DIRACGrid/tornado.git@iostreamConfigurable
     # This is an extension of Tornado to use M2Crypto

setup.cfg

@@ -29,6 +29,7 @@ install_requires =
     cachetools
     certifi
     cwltool
+    cryptography >=47.0.0
     diraccfg
     DIRACCommon
     diracx-client >=v0.0.1
@@ -41,14 +42,11 @@ install_requires =
     importlib_metadata >=4.4
     importlib_resources
     invoke
-    M2Crypto >=0.36
     packaging
     paramiko
     pexpect
     prompt-toolkit >=3
     psutil
-    pyasn1
-    pyasn1-modules
     pydantic >=2.4
     pyparsing
     python-dateutil
@@ -93,7 +91,6 @@ server =
     stomp.py
     suds
     tornado ~=5.1.1
-    tornado-m2crypto
     importlib_resources
 testing =
     hypothesis
@@ -104,6 +101,12 @@ testing =
     pytest-mock
     pytest-rerunfailures
     pycodestyle
+# Only needed for the legacy M2Crypto based implementation (DIRAC_USE_M2CRYPTO=Yes)
+m2crypto =
+    M2Crypto >=0.36
+    pyasn1
+    pyasn1-modules
+    tornado-m2crypto
 
 [options.entry_points]
 dirac =

src/DIRAC/Core/DISET/__init__.py

@@ -5,6 +5,9 @@
 #: Default timeout to establish a connection
 DEFAULT_CONNECTION_TIMEOUT = 10
 
+# The following constants are only used by the M2Crypto based SSL
+# implementation (DIRAC_USE_M2CRYPTO=Yes)
+
 #: Default SSL Ciher accepted. Current default is for pyGSI/M2crypto compatibility
 #: Can be changed with DIRAC_M2CRYPTO_SSL_CIPHERS
 #: Recommandation (incompatible with pyGSI)

src/DIRAC/Core/DISET/private/Transports/SSLTransport.py

@@ -1,3 +1,13 @@
+"""SSL Transport selector.
+
+Two implementations of the SSL transport are available: the default one,
+based on the standard library ssl module (:py:mod:`.StdSSLTransport`), and
+the legacy one, based on M2Crypto (:py:mod:`.M2SSLTransport`). The
+implementation is selected once, at import time, with the DIRAC_USE_M2CRYPTO
+environment variable (default No).
+
+The helpers defined here (delegate, checkSanity) are implementation agnostic.
+"""
 import os
 
 from DIRAC import gLogger
@@ -7,9 +17,19 @@
 from DIRAC.Core.Security.X509Certificate import X509Certificate  # pylint: disable=import-error
 
 
-# Eventhough SSLTransport is not used in this file, it is imported in other module from there,
-# so do not remove these imports !
-from DIRAC.Core.DISET.private.Transports.M2SSLTransport import SSLTransport
+# Even though SSLTransport, getSSLContext and getPeerInfo are not all used in
+# this file, they are imported from here by other modules, so do not remove
+# these imports!
+if os.getenv("DIRAC_USE_M2CRYPTO", "No").lower() in ("yes", "true"):
+    from DIRAC.Core.DISET.private.Transports.M2SSLTransport import SSLTransport
+    from DIRAC.Core.DISET.private.Transports.SSL.M2Utils import getM2SSLContext as getSSLContext
+    from DIRAC.Core.DISET.private.Transports.SSL.M2Utils import getM2PeerInfo as getPeerInfo
+else:
+    from DIRAC.Core.DISET.private.Transports.StdSSLTransport import (
+        SSLTransport,
+        getSSLContext,
+        getPeerInfo,
+    )
 
 
 def delegate(delegationRequest, kwargs):