­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ ­ 3 ."dCB@s6ddlZddlZddlZddlZddlZddlZddlmZddlmZdddZd-d.Zd?d0d1ZGd2d3d3eZd4d5ZGd6d7d7Zd8d9ZGd:d;d;ZdS)@N) alg_lists) validationcCsi|] }d|qS)r).0krrC./usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py sr arbitrary_dh_groups min_dh_size min_dsa_size min_rsa_size sha1_in_certs ssh_certsssh_etm*tlssslopensslnssgnutlsjava-tlssshopensshopenssh-serveropenssh-clientlibsshipsecike libreswankerberoskrb5dnssecbind) r#rzjava-tlsr!rrrzopenssh-clientzopenssh-serverrc@s(eZdZefddZddZddZdS) ScopeSelectorcCs|j|_}|jd |_|jr&|n |dd}tjj||jdtjj||jd|jdrr|ddjdn|g|_ tjj |j t |jddS)a= Initialize a scope selector. An example would be `ssh` in `ciphers@ssh = -NULL`. When openssh backend will request the configuration, it'll offer (`{'ssh', 'openssh'}`) as scopes and the rule above will be taken into account. Both patterns and scopes are cast to lowercase. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ss = ScopeSelector('!{SSH,IPsec}') >>> ss.matches({'ipsec', 'libreswan'}) False >>> ss.matches({'tls', 'openssl'}) True !rN)Zoriginal_pattern{,) lowerpattern startswith _positiverscopeZillegal_charactersZcurly_bracketssplit_globsZresulting_globs ALL_SCOPES)selfr*prrr__init__5s$ zScopeSelector.__init__cCsdt|jdS)Nz)reprr*)r1rrr__str__PszScopeSelector.__str__csh|jtkrdSddDtddDs2t|jrPtfdd|jDStfdd|jDS)aE Checks whether ScopeSelector matches one of the scopes. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'}) True >>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'}) False TcSsg|] }|jqSr)r))rsrrr ^sz)ScopeSelector.matches..css|]}|tkVqdS)N)r0)rr7rrr _sz(ScopeSelector.matches..c3s|]}tj|VqdS)N)fnmatchfilter)rg)scopesrrr9asc3s|]}tj| VqdS)N)r:r;)rr<)r=rrr9bs)r* SCOPE_ANYallAssertionErrorr,anyr/)r1r=r)r=rmatchesSs zScopeSelector.matchesN)__name__ __module__ __qualname__r>r3r6rBrrrrr$4s r$c@s$eZdZdZdZdZdZdZdZdS) OperationzM An operation that comes with the right-hand value of the directive. rN) rCrDrE__doc__RESETPREPENDAPPENDOMITSET_INTrrrrrFgs rFcsdd|jrftjkr2tkr2tjt|fgStjkrJtjj qztjksXt tkszt ntkrztjj |j }t fdd|Dstfdd|Dg}tjdfgdd|DStfd d|Drg}x|D]}|jd r"tjtj|d dddd}n\|jd rTtjtj|ddddd}n*|jd sdt tjtj|d d}|jfd d|DqW|Stjj|dS)a7 Parses right-hand parts of the directives into lists of operation/value pairs. For more examples, refer to tests/unit/test_parsing.py >>> parse_rhs('', 'cipher') [(, None)] >>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher') [(, None), (, 'IDEA-CBC'), (, 'SEED-CBC')] >>> # 3DES-CBC gets prepended last for higher prio >>> parse_rhs('+*DES-CBC', 'cipher') [(, 'DES-CBC'), (, '3DES-CBC')] cSs|jdp|jdp|jdS)N+-)r+endswith)vrrr differentialszparse_rhs..differentialc3s|]}|VqdS)Nr)rrT)rUrrr9szparse_rhs..csg|]}tj|qSr)rglob)rrT) prop_namerrr8szparse_rhs..NcSsg|]}tj|fqSr)rFrN)rrTrrrr8sc3s|]}|VqdS)Nr)rrT)rUrrr9srQrrRcsg|] }|fqSrr)rrT)oprrr8sr(r(r()isdigitrALL INT_DEFAULTSrFrPintrrulesZNonIntPropertyIntValueErrorr@ZIntPropertyNonIntValueErrorr.rAsumrLr?r+rMrVrSrNrOextendZ%MixedDifferentialNonDifferentialError)rhsrWvaluesZ operationsvalueZunglobr)rUrXrWr parse_rhsrs<        rc DirectiverWr- operationrbcs|js gStjj||jd\}}|j|j}}tjj||d|krZ|jddn|tf\fddt|DS)ae Parses configuration lines into tuples of directives. For more examples, refer to tests/unit/test_parsing.py >>> parse_line('cipher@TLS = RC4* NULL') [Directive(prop_name='cipher', scope='tls', operation=, value=None), Directive(prop_name='cipher', scope='tls', operation=, value='RC4-40'), Directive(prop_name='cipher', scope='tls', operation=, value='RC4-128'), Directive(prop_name='cipher', scope='tls', operation=, value='NULL')] =@rcs$g|]\}}tj||dqS))rWr-rerb)rdr))rrerb)rWr-rrr8szparse_line..)striprr]Zcount_equals_signsr.Z empty_lhsr>rc)lineZlhsr`r)rWr-r parse_lines   rjFcCs^y$t|}x|D]}t|jqWWn4tjk rX}z|s>tj|WYdd}~XnXdS)N)rjr$r-rZPolicySyntaxErrorwarningswarn)rirlldexrrrsyntax_check_lines rpcseZdZfddZZS)PolicySyntaxDeprecationWarningcs@|jdd}d|d}|d|d7}|d7}tj|dS)N z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)replacesuperr3)r1Z deprecatedZ replacementmsg) __class__rrr3s   z'PolicySyntaxDeprecationWarning.__init__)rCrDrEr3 __classcell__rr)rvrrqsrqc Cstjdd|}|jdd}djdd|jdD}|jdd}djd d|jdD}djd d|jdD}tjd d|j}tjd |rtjt d dddddd}xr|j D]f\}}d|d}tj||}|rtjt ||tj|d|}x"|D]}|d|d|7}qWqWtjd d|j}ddd}xN|j D]B\}}d|d}tj ||r|tjt ||tj|||}qJWt t jddd%}xZ|rdjdd|dd&D} tjd|d'd| rd | nd|}|jqWtjd!d|}t t jddd(} xZ| r|djd"d| dd)D} tjd#| d*d| rhd | nd|}| jq$Wtjd$d|}|S)+a Preprocesses text before parsing. Fixes line breaks, handles backwards compatibility. >>> preprocess_text('cipher = c1 \\ \nc2#x') 'cipher = c1 c2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('ike_protocol = IKEv2') 'protocol@IKE = IKEv2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('min_tls_version=TLS1.3') 'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2' z#.*rfz = rrcss|]}|jVqdS)N)rh)rrmrrrr9sz"preprocess_text..z\ css|]}|jVqdS)N)rh)rrmrrrr9scss|]}tjdd|VqdS)z\s+ N)resub)rrmrrrr9sz +z\bprotocol\s*=protocolz protocol@TLSz cipher@TLSz cipher@SSHz group@SSHz protocol@IKE)Z tls_cipherZ ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z z =z7hash@DNSSec = -SHA1 sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+ sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+)zsha1_in_dnssec = 0zsha1_in_dnssec = 1Nrrycss|]}d|VqdS)rRNr)rrTrrrr9sz\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bcss|]}d|VqdS)rRNr)rrTrrrr9$sz\bmin_tls_version = z\bmin_tls_version = 0\br(r(r(r(r(r()rzr{rsjoinr.rhfindallrkrlrqitemssearchlistrZDTLS_PROTOCOLSpopZ TLS_PROTOCOLS) textZPOSTFIX_REPLACEMENTSfrZtoZregexZmsmZPLAIN_REPLACEMENTSZ dtls_versionsnegZ tls_versionsrrrpreprocess_textsZ       rc@sJeZdZdZd ddZeddZeddZed d Zed d Z dS) ScopedPolicya An entity constructing lists of what's `.enabled` and what's `.disabled` when the given scopes are active. >>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'}) >>> 'AES-256-GCM' in sp.disabled['cipher'] True >>> sp.enabled['cipher'] ['RC4-40', 'RC4-128', 'NULL'] >>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size'] 2048 NcsX|pt}tj_ddtjD_x|D]tj}|j |r,j t j kr^gjj <q,j t jkrjj }j|kr|jjq,j t jkr̈jj }j|kr|jj|jdjq,j t jkrfddjj Djj <q,j t jkstjjj <q,Wtjttjks>tfddtjD_dS)NcSsi|] }g|qSrr)rrWrrrr >sz)ScopedPolicy.__init__..rcsg|]}|jkr|qSr)rb)re) directiverrr8Rsz)ScopedPolicy.__init__..cs(i|] fddtjDqS)csg|]}|jkr|qSr)enabled)rr)rWr1rrr8Zsz4ScopedPolicy.__init__...)rrZ)r)r1)rWrr Zs)setr[copyintegersrrZrr$r-rBrerFrLrWrNrbappendrMremoveinsertrOrPr@lenZdisabled)r1 directivesZrelevant_scopesZssrr)rr1rr3;s0              $ zScopedPolicy.__init__cCstj|jdS)Nr|)rmin_tls_versionr)r1rrrr^szScopedPolicy.min_tls_versioncCstj|jdS)Nr|)rmax_tls_versionr)r1rrrrbszScopedPolicy.max_tls_versioncCstj|jdS)Nr|)rmin_dtls_versionr)r1rrrrfszScopedPolicy.min_dtls_versioncCstj|jdS)Nr|)rmax_dtls_versionr)r1rrrrjszScopedPolicy.max_dtls_version)N) rCrDrErKr3propertyrrrrrrrrr/s   #   rcCs@x,|D]$}tjj||}tj|tjr|SqWtj|||dS)N)ospathr}accessR_OKrZPolicyFileNotFoundError) policynamefnamepathsrnr2rrr lookup_fileqs  rc@sFeZdZdZdZddddZddZdd d Zdd d ZddZ dS)UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN) policydircGsR||_dj|f||_g|_|j|}x|D]}||j|dd7}q.W||_dS)N:T) subpolicy)rr}rlinesread_policy_file _directives)r1Z policy_namerZsubpolicy_namesrZsubpolicy_namerrrr3s  zUnscopedCryptoPolicy.__init__cCs|j S)N)r)r1rrris_emptyszUnscopedCryptoPolicy.is_emptycCst|j|p iS)N)rr)r1r=rrrscopedszUnscopedCryptoPolicy.scopedFc Cs|jpd}|rtjj|d}t|||s*dndtjj|tjj|j|tjj|j|f}t|}|j }WdQRXt |}|j d}x|D]}t |ddqWx|D] }t |qWt dd |DgS) NZpoliciesmodulesz.polz.pmodrrT)rlcSsg|] }t|qSr)rj)rrmrrrr8sz9UnscopedCryptoPolicy.read_policy_file..)rrrr}rcurdir CONFIG_DIR SHARE_DIRopenreadrr.rpr^) r1namerZpdirr2frrrmrrrrs$      z%UnscopedCryptoPolicy.read_policy_filec Csdd}|j}d|jd}|d7}|d7}|d7}|d7}|d7}|j|j}x"|jD]\}}||||7}q\Wd }xvtjD]j\}} |j| d } | j| j} xH| jD]<\}}|||kr|s|d 7}d }|||d ||7}qWqW|s|d7}|S)NcSs2t|trdj|nt|}|d|jdS)Nryz = rr) isinstancerr}strrstrip)keyrbr7rrrfmtsz)UnscopedCryptoPolicy.__str__..fmtz # Policy z dump z# z?# Do not parse the contents of this file with automated tools, z.# it is provided for review convenience only. z"# Baseline values for all scopes: F)r=z9# Scope-specific properties derived for select backends: Trgz&# No scope-specific properties found. )rrrrrDUMPABLE_SCOPES) r1rZgeneric_scopedr7Z generic_allrWrbZanything_scope_specificZ scope_nameZ scope_setZspecific_scopedZ specific_allrrrr6s2    zUnscopedCryptoPolicy.__str__)N)F) rCrDrErrr3rrrr6rrrrr{s   r)r r r r rrr)rrrrrrrrrrrrrrr r!r"r#)rWr-rerb)F) collectionsenumr:rrzrkrxrrr[r>r0rr$EnumrFrc namedtuplerdrjrp FutureWarningrqrrrrrrrrsP  3 ;  LB