­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ."dCB@s6ddlZddlZddlZddlZddlZddlZddlmZddlmZdddZd-d.Zd?d0d1ZGd2d3d3eZd4d5ZGd6d7d7Zd8d9ZGd:d;d;ZdS)@N) alg_lists) validationcCsi|] }d|qS)r).0krrC./usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py sr arbitrary_dh_groups min_dh_size min_dsa_size min_rsa_size sha1_in_certs ssh_certsssh_etm*tlssslopensslnssgnutlsjava-tlssshopensshopenssh-serveropenssh-clientlibsshipsecike libreswankerberoskrb5dnssecbind) r#rzjava-tlsr!rrrzopenssh-clientzopenssh-serverrc@s(eZdZefddZddZddZdS) ScopeSelectorcCs|j|_}|jd |_|jr&|n |dd}tjj||jdtjj||jd|jdrr|ddjdn|g|_ tjj |j t |jddS)a= Initialize a scope selector. An example would be `ssh` in `ciphers@ssh = -NULL`. When openssh backend will request the configuration, it'll offer (`{'ssh', 'openssh'}`) as scopes and the rule above will be taken into account. Both patterns and scopes are cast to lowercase. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ss = ScopeSelector('!{SSH,IPsec}') >>> ss.matches({'ipsec', 'libreswan'}) False >>> ss.matches({'tls', 'openssl'}) True !rN)Zoriginal_pattern{,) lowerpattern startswith _positiverscopeZillegal_charactersZcurly_bracketssplit_globsZresulting_globs ALL_SCOPES)selfr*prrr__init__5s$ zScopeSelector.__init__cCsdt|jdS)Nz)reprr*)r1rrr__str__PszScopeSelector.__str__csR|jtkrdSddD|jr:tfdd|jDStfdd|jDS)aE Checks whether ScopeSelector matches one of the scopes. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'}) True >>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'}) False TcSsg|] }|jqSr)r))rsrrr ^sz)ScopeSelector.matches..c3s|]}tj|VqdS)N)fnmatchfilter)rg)scopesrr asz(ScopeSelector.matches..c3s|]}tj| VqdS)N)r9r:)rr;)r<rrr=bs)r* SCOPE_ANYr,anyr/all)r1r<r)r<rmatchesSs zScopeSelector.matchesN)__name__ __module__ __qualname__r>r3r6rArrrrr$4s r$c@s$eZdZdZdZdZdZdZdZdS) OperationzM An operation that comes with the right-hand value of the directive. rN) rBrCrD__doc__RESETPREPENDAPPENDOMITSET_INTrrrrrEgs rEcsdd|jrLtjkr2tkr2tjt|fgStjkr`tjj q`ntkr`tjj |j }t fdd|Dst fdd|Dg}tjdfgdd|DStfd d|Drtg}x|D]}|jd rtjtj|d dddd }nL|jd r:tjtj|ddddd}ntjtj|d d}|jfd d|DqW|Stjj|dS)a7 Parses right-hand parts of the directives into lists of operation/value pairs. For more examples, refer to tests/unit/test_parsing.py >>> parse_rhs('', 'cipher') [(, None)] >>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher') [(, None), (, 'IDEA-CBC'), (, 'SEED-CBC')] >>> # 3DES-CBC gets prepended last for higher prio >>> parse_rhs('+*DES-CBC', 'cipher') [(, 'DES-CBC'), (, '3DES-CBC')] cSs|jdp|jdp|jdS)N+-)r+endswith)vrrr differentialszparse_rhs..differentialc3s|]}|VqdS)Nr)rrS)rTrrr=szparse_rhs..csg|]}tj|qSr)rglob)rrS) prop_namerrr8szparse_rhs..NcSsg|]}tj|fqSr)rErM)rrSrrrr8sc3s|]}|VqdS)Nr)rrS)rTrrr=srPrcsg|] }|fqSrr)rrS)oprrr8sr(r(r()isdigitrALL INT_DEFAULTSrErOintrrulesZNonIntPropertyIntValueErrorZIntPropertyNonIntValueErrorr.r?sumrKr@r+rLrUrRrMrNextendZ%MixedDifferentialNonDifferentialError)rhsrVvaluesZ operationsvalueZunglobr)rTrWrVr parse_rhsrs8        rb DirectiverVr- operationracs|js gStjj||jd\}}|j|j}}tjj||d|krZ|jddn|tf\fddt|DS)ae Parses configuration lines into tuples of directives. For more examples, refer to tests/unit/test_parsing.py >>> parse_line('cipher@TLS = RC4* NULL') [Directive(prop_name='cipher', scope='tls', operation=, value=None), Directive(prop_name='cipher', scope='tls', operation=, value='RC4-40'), Directive(prop_name='cipher', scope='tls', operation=, value='RC4-128'), Directive(prop_name='cipher', scope='tls', operation=, value='NULL')] =@rcs$g|]\}}tj||dqS))rVr-rdra)rcr))rrdra)rVr-rrr8szparse_line..)striprr\Zcount_equals_signsr.Z empty_lhsr>rb)lineZlhsr_r)rVr-r parse_lines   riFcCs^y$t|}x|D]}t|jqWWn4tjk rX}z|s>tj|WYdd}~XnXdS)N)rir$r-rZPolicySyntaxErrorwarningswarn)rhrkldexrrrsyntax_check_lines rocseZdZfddZZS)PolicySyntaxDeprecationWarningcs@|jdd}d|d}|d|d7}|d7}tj|dS)N z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)replacesuperr3)r1Z deprecatedZ replacementmsg) __class__rrr3s   z'PolicySyntaxDeprecationWarning.__init__)rBrCrDr3 __classcell__rr)rurrpsrpc Cstjdd|}|jdd}djdd|jdD}|jdd}djd d|jdD}djd d|jdD}tjd d|j}tjd |rtjt d dddddd}xr|j D]f\}}d|d}tj||}|rtjt ||tj|d|}x"|D]}|d|d|7}qWqWtjd d|j}ddd}xN|j D]B\}}d|d}tj ||r|tjt ||tj|||}qJWt t jddd%}xZ|rdjdd|dd&D} tjd|d'd| rd | nd|}|jqWtjd!d|}t t jddd(} xZ| r|djd"d| dd)D} tjd#| d*d| rhd | nd|}| jq$Wtjd$d|}|S)+a Preprocesses text before parsing. Fixes line breaks, handles backwards compatibility. >>> preprocess_text('cipher = c1 \\ \nc2#x') 'cipher = c1 c2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('ike_protocol = IKEv2') 'protocol@IKE = IKEv2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('min_tls_version=TLS1.3') 'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2' z#.*rez = rqcss|]}|jVqdS)N)rg)rrlrrrr=sz"preprocess_text..z\ css|]}|jVqdS)N)rg)rrlrrrr=scss|]}tjdd|VqdS)z\s+ N)resub)rrlrrrr=sz +z\bprotocol\s*=protocolz protocol@TLSz cipher@TLSz cipher@SSHz group@SSHz protocol@IKE)Z tls_cipherZ ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z z =z7hash@DNSSec = -SHA1 sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+ sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+)zsha1_in_dnssec = 0zsha1_in_dnssec = 1Nrrxcss|]}d|VqdS)rQNr)rrSrrrr=sz\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bcss|]}d|VqdS)rQNr)rrSrrrr=$sz\bmin_tls_version = z\bmin_tls_version = 0\br(r(r(r(r(r()ryrzrrjoinr.rgfindallrjrkrpitemssearchlistrZDTLS_PROTOCOLSpopZ TLS_PROTOCOLS) textZPOSTFIX_REPLACEMENTSfrZtoZregexZmsmZPLAIN_REPLACEMENTSZ dtls_versionsnegZ tls_versionsrrrpreprocess_textsZ       rc@sJeZdZdZd ddZeddZeddZed d Zed d Z dS) ScopedPolicya An entity constructing lists of what's `.enabled` and what's `.disabled` when the given scopes are active. >>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'}) >>> 'AES-256-GCM' in sp.disabled['cipher'] True >>> sp.enabled['cipher'] ['RC4-40', 'RC4-128', 'NULL'] >>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size'] 2048 Ncs(|pt}tj_ddtjD_x|D]މtj}|j |r,j t j kr^gjj <q,j t jkrjj }j|kr|jjq,j t jkr̈jj }j|kr|jj|jdjq,j t jkrfddjj Djj <q,jjj <q,WfddtjD_dS)NcSsi|] }g|qSrr)rrVrrrr >sz)ScopedPolicy.__init__..rcsg|]}|jkr|qSr)ra)re) directiverrr8Rsz)ScopedPolicy.__init__..cs(i|] fddtjDqS)csg|]}|jkr|qSr)enabled)rr)rVr1rrr8Zsz4ScopedPolicy.__init__...)rrY)r)r1)rVrr Zs)setrZcopyintegersrrYrr$r-rArdrErKrVrMraappendrLremoveinsertrNZdisabled)r1 directivesZrelevant_scopesZssrr)rr1rr3;s,              $ zScopedPolicy.__init__cCstj|jdS)Nr{)rmin_tls_versionr)r1rrrr^szScopedPolicy.min_tls_versioncCstj|jdS)Nr{)rmax_tls_versionr)r1rrrrbszScopedPolicy.max_tls_versioncCstj|jdS)Nr{)rmin_dtls_versionr)r1rrrrfszScopedPolicy.min_dtls_versioncCstj|jdS)Nr{)rmax_dtls_versionr)r1rrrrjszScopedPolicy.max_dtls_version)N) rBrCrDrJr3propertyrrrrrrrrr/s   #   rcCs@x,|D]$}tjj||}tj|tjr|SqWtj|||dS)N)ospathr|accessR_OKrZPolicyFileNotFoundError) policynamefnamepathsrmr2rrr lookup_fileqs  rc@sFeZdZdZdZddddZddZdd d Zdd d ZddZ dS)UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN) policydircGsR||_dj|f||_g|_|j|}x|D]}||j|dd7}q.W||_dS)N:T) subpolicy)rr|rlinesread_policy_file _directives)r1Z policy_namerZsubpolicy_namesrZsubpolicy_namerrrr3s  zUnscopedCryptoPolicy.__init__cCs|j S)N)r)r1rrris_emptyszUnscopedCryptoPolicy.is_emptycCst|j|p iS)N)rr)r1r<rrrscopedszUnscopedCryptoPolicy.scopedFc Cs|jpd}|rtjj|d}t|||s*dndtjj|tjj|j|tjj|j|f}t|}|j }WdQRXt |}|j d}x|D]}t |ddqWx|D] }t |qWt dd |DgS) NZpoliciesmodulesz.polz.pmodrqT)rkcSsg|] }t|qSr)ri)rrlrrrr8sz9UnscopedCryptoPolicy.read_policy_file..)rrrr|rcurdir CONFIG_DIR SHARE_DIRopenreadrr.ror]) r1namerZpdirr2frrrlrrrrs$      z%UnscopedCryptoPolicy.read_policy_filec Csdd}|j}d|jd}|d7}|d7}|d7}|d7}|d7}|j|j}x"|jD]\}}||||7}q\Wd }xvtjD]j\}} |j| d } | j| j} xH| jD]<\}}|||kr|s|d 7}d }|||d ||7}qWqW|s|d7}|S)NcSs2t|trdj|nt|}|d|jdS)Nrxz = rq) isinstancerr|strrstrip)keyrar7rrrfmtsz)UnscopedCryptoPolicy.__str__..fmtz # Policy z dump z# z?# Do not parse the contents of this file with automated tools, z.# it is provided for review convenience only. z"# Baseline values for all scopes: F)r<z9# Scope-specific properties derived for select backends: Trfz&# No scope-specific properties found. )rrrrr~DUMPABLE_SCOPES) r1rZgeneric_scopedr7Z generic_allrVraZanything_scope_specificZ scope_nameZ scope_setZspecific_scopedZ specific_allrrrr6s2    zUnscopedCryptoPolicy.__str__)N)F) rBrCrDrrr3rrrr6rrrrr{s   r)r r r r rrr)rrrrrrrrrrrrrrr r!r"r#)rVr-rdra)F) collectionsenumr9rryrjrwrrrZr>r0rr$EnumrErb namedtuplercriro FutureWarningrprrrrrrrrsP  3 ;  LB