Current File : //kunden/usr/share/crypto-policies/python/cryptopolicies/__pycache__/cryptopolicies.cpython-39.pyc
a

�
�goG�@s.ddlZddlZddlZddlZddlZddlZddlmZmZe	�
dd�ddiBZddd	�Zd
Z
dZdd
hhd�hd�ddhhd�hd�hd�hd�hd�hd�d�
ZGdd�d�ZGdd�dej�Zdd�Ze�dd �Zd!d"�Zd0d$d%�ZGd&d'�d'e�Zd(d)�ZGd*d+�d+�Zd,d-�ZGd.d/�d/�ZdS)1�N�)�	alg_lists�
validation)Zarbitrary_dh_groupsZmin_dh_sizeZmin_dsa_sizeZmin_rsa_sizeZ
sha1_in_certsZ	ssh_certsZmin_ec_size�)�ANYZDISABLE_ETMZDISABLE_NON_ETM)ZDEFAULTZENFORCEZRELAX)ZetmZ__ems�*)�tls�ssl�openssl�nss�gnutls�java-tls�ssh�openssh�openssh-server�openssh-client�libssh�ipsec�ike�	libreswan�kerberos�krb5�dnssec�bindrr>r	rr>r	rr
rr>rrr>rrr>rr	r>rrr>rrr>r
r	r)
rrr
rrrrrrr
c@s(eZdZefdd�Zdd�Zdd�ZdS)�
ScopeSelectorcCs�|��|_}|�d�|_|jr&|n
|dd�}tjj||jd�tjj||jd�|�d�rr|dd��d�n|g|_	tjj
|j	t|jd�dS)a=
        Initialize a scope selector.
        An example would be `ssh` in `ciphers@ssh = -NULL`.
        When openssh backend will request the configuration,
        it'll offer (`{'ssh', 'openssh'}`) as scopes
        and the rule above will be taken into account.
        Both patterns and scopes are cast to lowercase.
        For more examples, refer to tests/unit/parsing/test_scope_selector.py
        >>> ss = ScopeSelector('!{SSH,IPsec}')
        >>> ss.matches({'ipsec', 'libreswan'})
        False
        >>> ss.matches({'tls', 'openssl'})
        True
        �!rN)Zoriginal_pattern�{����,)�lower�pattern�
startswith�	_positiver�scopeZillegal_charactersZcurly_brackets�split�_globsZresulting_globs�
ALL_SCOPES)�selfr �p�r)�B/usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py�__init__>s$�zScopeSelector.__init__cCsd|j�d�S)Nz<ScopeSelector pattern=�>)r �r'r)r)r*�__str__YszScopeSelector.__str__csh|jtkrdSdd��D��tdd��D��s2J�|jrPt�fdd�|jD��St�fdd�|jD��S)aE
        Checks whether ScopeSelector matches one of the scopes.
        For more examples, refer to tests/unit/parsing/test_scope_selector.py
        >>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'})
        True
        >>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'})
        False
        TcSsg|]}|���qSr))r��.0�sr)r)r*�
<listcomp>g�z)ScopeSelector.matches.<locals>.<listcomp>css|]}|tvVqdS�N)r&r/r)r)r*�	<genexpr>hr3z(ScopeSelector.matches.<locals>.<genexpr>c3s|]}t��|�VqdSr4��fnmatch�filter�r0�g��scopesr)r*r5jr3c3s|]}t��|�VqdSr4r6r9r;r)r*r5kr3)r �	SCOPE_ANY�allr"�anyr%�r'r<r)r;r*�matches\s	
zScopeSelector.matchesN)�__name__�
__module__�__qualname__r=r+r.rAr)r)r)r*r=src@s0eZdZdZdZdZdZdZdZdZ	dd	�Z
d
S)�	OperationzCAn operation that comes with the right-hand value of the directive.r�����cCsd|j��S)Nz
Operation.)�namer-r)r)r*�__repr__zszOperation.__repr__N)rBrCrD�__doc__�RESET�PREPEND�APPEND�OMIT�SET_INT�SET_ENUMrLr)r)r)r*rEpsrEcs�dd��|��rx�tjvr2�tvr2tjt|�fgS�tjvsD�tvrPtj	�
����tjvs^J��tvsjJ��tvs�J�nH�tvr�tj	�����tvr�|t�vr�tj	��|t���tj
|fgS|��}t�fdd�|D���s�fdd�|D�}tjdfgdd�|D�St�fd	d�|D���r�g}|D]�}|�d
��rbtj�t�|dd���ddd�}n\|�d
��r�tj�t�|dd���ddd�}n*|�d
��s�J�tj�t�|dd���}|��fdd�|D���q,|Stj	�|��dS)ae
    Parses right-hand parts of the directives
    into lists of operation/value pairs.
    For more examples, refer to tests/unit/test_parsing.py
    >>> parse_rhs('', 'cipher')
    [(Operation.RESET, None)]
    >>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher')
    [(Operation.RESET, None),
     (Operation.APPEND, 'IDEA-CBC'),
     (Operation.APPEND, 'SEED-CBC')]
    >>> # 3DES-CBC gets prepended last for higher prio
    >>> parse_rhs('+*DES-CBC', 'cipher')
    [(Operation.PREPEND, 'DES-CBC'),
     (Operation.PREPEND, '3DES-CBC')]
    >>> parse_rhs('ENFORCE', '__ems')
    [(Operation.SET_ENUM, 'ENFORCE')]
    cSs|�d�p|�d�S)N)�+�-rT)r!�endswith)�vr)r)r*�differential�szparse_rhs.<locals>.differentialc3s|]}�|�VqdSr4r)�r0rW�rXr)r*r5�r3zparse_rhs.<locals>.<genexpr>cs"g|]}t�|��D]}|�qqSr))r�glob)r0rW�x��	prop_namer)r*r2�r3zparse_rhs.<locals>.<listcomp>NcSsg|]}tj|f�qSr))rErPrYr)r)r*r2�r3c3s|]}�|�VqdSr4r)rYrZr)r*r5�r3rTrrrUcsg|]}�|f�qSr)r)rY)�opr)r*r2�r3)�isdigitr�ALL�INT_DEFAULTSrErR�int�ENUMSr�rulesZNonIntPropertyIntValueErrorZIntPropertyNonIntValueErrorZBadEnumValueErrorrSr$r?rNr>r!rOr[rVrPrQ�extendZ%MixedDifferentialNonDifferentialError)�rhsr^�valuesZ
operations�valueZunglobr))rXr_r^r*�	parse_rhs~sL
�
�  rj�	Directive�r^r#�	operationrics�|��sgStj�|�|�d�\}}|��|��}}tj�||�d|vrZ|�dd�n|tf\����fdd�t|��D�S)aQ
    Parses configuration lines into tuples of directives.
    For more examples, refer to tests/unit/test_parsing.py
    >>> parse_line('cipher@TLS = RC4* NULL')
    [Directive(prop_name='cipher', scope='tls',
               operation=Operation.RESET, value=None),
     Directive(prop_name='cipher', scope='tls',
               operation=Operation.APPEND, value='RC4-40'),
     Directive(prop_name='cipher', scope='tls',
               operation=Operation.APPEND, value='RC4-128'),
     Directive(prop_name='cipher', scope='tls',
               operation=Operation.APPEND, value='NULL')]
    �=�@rcs$g|]\}}t����||d��qS)rl)rkr)r0rmri�r^r#r)r*r2�s�
�zparse_line.<locals>.<listcomp>)�striprreZcount_equals_signsr$Z	empty_lhsr=rj)�lineZlhsrgr)rpr*�
parse_line�s �rsFc
Cs\z t|�}|D]}t|j�qWn6tjyV}z|s8�t�|�WYd}~n
d}~00dSr4)rsrr#rZPolicySyntaxError�warnings�warn)rrru�l�d�exr)r)r*�syntax_check_line�srycseZdZ�fdd�Z�ZS)�PolicySyntaxDeprecationWarningcs@|�dd�}d|�d�}|d|�d�7}|d7}t��|�dS)N�
z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)�replace�superr+)r'Z
deprecatedZreplacement�msg��	__class__r)r*r+�s
z'PolicySyntaxDeprecationWarning.__init__)rBrCrDr+�
__classcell__r)r)rr*rz�srzcCs�t�dd|�}|�dd�}d�dd�|�d�D��}|�dd�}d�d	d�|�d�D��}d�d
d�|�d�D��}t�dd|���}t�d|�r�t�t	d
d��ddddd�}|�
�D]`\}}d|d}t�||�}|r�t�t	||��t�|d|�}|D]}|d|�d|��7}q�q�t�dd|���}ddddddd�}|�
�D]x\}}d|d}i}t�||�D]}	t�|||�||	�d�<�qj|�
�D]\}
}t�t	|
|���q�t�|||�}�qFt
tjd d d!��}|�r,d"�d#d�|d d!�D��}
t�d$|d!d|
�rd%|
��nd|�}|���q�t�d&d|�}t
tjd d d!��}|�r�d"�d'd�|d d!�D��}
t�d(|d!d|
�r�d%|
��nd|�}|���qNt�d)d|�S)*a
    Preprocesses text before parsing.
    Fixes line breaks, handles backwards compatibility.
    >>> preprocess_text('cipher = c1 \\ \nc2#x')
    'cipher = c1 c2'
    >>> with warnings.catch_warnings():
    ...     warnings.simplefilter("ignore")
    ...     preprocess_text('ike_protocol = IKEv2')
    'protocol@IKE = IKEv2'
    >>> with warnings.catch_warnings():
    ...     warnings.simplefilter("ignore")
    ...     preprocess_text('min_tls_version=TLS1.3')
    'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2'
    z#.*�rn� = r{css|]}|��VqdSr4�rq�r0rvr)r)r*r5r3z"preprocess_text.<locals>.<genexpr>z\
css|]}|��VqdSr4r�r�r)r)r*r5	r3css|]}t�dd|�VqdS)z\s+� N)�re�subr�r)r)r*r5
r3z
+z\bprotocol\s*=�protocolzprotocol@TLSz
cipher@TLSz
cipher@SSHz	group@SSHzprotocol@IKE)Z
tls_cipherZ
ssh_cipherZ	ssh_groupZike_protocolz\bz\s*=(.*)z

z =z7hash@DNSSec = -SHA1
sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+
sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+zetm@SSH = DISABLE_ETMz
etm@SSH = ANYzetm@\1 = DISABLE_ETMzetm@\1 = ANY)zsha1_in_dnssec = 0zsha1_in_dnssec = 1zssh_etm = 0zssh_etm = 1zssh_etm@([^= ]+) = 0zssh_etm@([^= ]+) = 1rNrr�css|]}d|VqdS�rUNr)rYr)r)r*r58r3z\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bcss|]}d|VqdSr�r)rYr)r)r*r5@r3z\bmin_tls_version = z\bmin_tls_version = 0\b)r�r�r|�joinr$rq�findallrtrurz�items�finditer�group�listrZDTLS_PROTOCOLS�popZ
TLS_PROTOCOLS)�textZPOSTFIX_REPLACEMENTS�fr�toZregex�ms�mZPLAIN_REPLACEMENTSrA�matchZmatch_frZmatch_toZ
dtls_versions�negZtls_versionsr)r)r*�preprocess_text�sp�����r�c@sJeZdZdZd
dd�Zedd��Zedd��Zed	d
��Zedd��Z	dS)�ScopedPolicya�
    An entity constructing lists of what's `.enabled` and what's `.disabled`
    when the given scopes are active.
    >>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'})
    >>> 'AES-192-GCM' in sp.disabled['cipher']
    True
    >>> sp.enabled['cipher']
    ['RC4-40', 'RC4-128', 'NULL']
    >>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size']
    2048
    Ncs�|pt�}t���_dd�t��D��_dd�tjD��_	|D�]�t
�j�}|�|�r>�j
tjkrrg�j	�j<q>�j
tjkr��j	�j}�j|vr�|��j�q>�j
tjkr�j	�j}�j|vr�|��j�|�d�j�q>�j
tjk�r�fdd��j	�jD��j	�j<q>�j
tjk�r0�j�j�j<q>�j
tjk�sBJ��j�j�j<q>t�j	�tt�j	��k�spJ��fdd�tj��D��_dS)NcSsi|]\}}||d�qS)rr))r0�krWr)r)r*�
<dictcomp>Yr3z)ScopedPolicy.__init__.<locals>.<dictcomp>cSsi|]
}|g�qSr)r))r0r^r)r)r*r�Zr3rcsg|]}|�jkr|�qSr))ri�r0�e)�	directiver)r*r2ms
�z)ScopedPolicy.__init__.<locals>.<listcomp>cs&i|]\�}���fdd�|D��qS)csg|]}|�j�vr|�qSr))�enabledr�)r^r'r)r*r2xs�z4ScopedPolicy.__init__.<locals>.<dictcomp>.<listcomp>r))r0Zalg_listr-r]r*r�xs�)�setrb�copy�integersrdr��enumsrrar�rr#rArmrErNr^rPri�appendrO�remove�insertrQrRrS�lenZdisabled)r'�
directivesZrelevant_scopes�ssr�r))r�r'r*r+Vs<








�
�zScopedPolicy.__init__cCst�|jd�S�Nr�)r�min_tls_versionr�r-r)r)r*r�|szScopedPolicy.min_tls_versioncCst�|jd�Sr�)r�max_tls_versionr�r-r)r)r*r��szScopedPolicy.max_tls_versioncCst�|jd�Sr�)r�min_dtls_versionr�r-r)r)r*r��szScopedPolicy.min_dtls_versioncCst�|jd�Sr�)r�max_dtls_versionr�r-r)r)r*r��szScopedPolicy.max_dtls_version)N)
rBrCrDrMr+�propertyr�r�r�r�r)r)r)r*r�Is
&


r�cCs@|D](}tj�||�}t�|tj�r|Sqt�|||��dSr4)�os�pathr��access�R_OKrZPolicyFileNotFoundError)�
policyname�fname�pathsrwr(r)r)r*�lookup_file�s

r�c@sFeZdZdZdZdd�dd�Zdd�Zdd	d
�Zddd
�Zdd�Z	dS)�UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN)�	policydircGsP||_d�|g|�R�|_g|_|�|�}|D]}||j|dd�7}q.||_dS)N�:T)�	subpolicy)r�r�r��lines�read_policy_file�_directives)r'Zpolicy_namer�Zsubpolicy_namesr�Zsubpolicy_namer)r)r*r+�s
zUnscopedCryptoPolicy.__init__cCs|jSr4)r�r-r)r)r*�is_empty�szUnscopedCryptoPolicy.is_emptycCst|j|pi�Sr4)r�r�r@r)r)r*�scoped�szUnscopedCryptoPolicy.scopedFc	
Cs�|jpd}|rtj�|d�}t|||s*dndtjj|tj�|j|�tj�|j|�f�}t|dd��}|�	�}Wd�n1s�0Yt
|�}|�d�}|D]}t|dd	�q�|D]}t|�q�d
d�|D�S)NZpolicies�modulesz.polz.pmodzutf-8)�encodingr{T)rucSsg|]}t|�D]}|�qqSr))rs)r0rvr\r)r)r*r2�r3z9UnscopedCryptoPolicy.read_policy_file.<locals>.<listcomp>)
r�r�r�r�r��curdir�
CONFIG_DIR�	SHARE_DIR�open�readr�r$ry)	r'rKr�Zpdirr(�fr�r�rvr)r)r*r��s(
��&

z%UnscopedCryptoPolicy.read_policy_filecCsdd�}|��}d|j�d�}|d7}|d7}|d7}|d7}|d7}i|j�|j�|j�}|��D]\}}||||�7}qdd	}t��D]p\}}	|j|	d
�}
i|
j�|
j�|
j�}|��D]<\}}|||kr�|s�|d7}d}|||�d
|��|�7}q�q�|�s|d7}|S)NcSs2t|t�rd�|�nt|�}|�d|����dS)Nr�r�r{)�
isinstancer�r��str�rstrip)�keyrir1r)r)r*�fmt�sz)UnscopedCryptoPolicy.__str__.<locals>.fmtz	# Policy z dump
z#
z?# Do not parse the contents of this file with automated tools,
z.# it is provided for review convenience only.
z"# Baseline values for all scopes:
Fr;z9# Scope-specific properties derived for select backends:
Troz&# No scope-specific properties found.
)r�r�r�r�r�r��DUMPABLE_SCOPES)r'r�Zgeneric_scopedr1Zgeneric_allr^riZanything_scope_specificZ
scope_nameZ	scope_setZspecific_scopedZspecific_allr)r)r*r.�s@����zUnscopedCryptoPolicy.__str__)N)F)
rBrCrDr�r�r+r�r�r�r.r)r)r)r*r��s

r�)F)�collections�enumr7r�r�rtr�rr�dict�fromkeysrbrdr=r&r�r�EnumrErj�
namedtuplerkrsry�
FutureWarningrzr�r�r�r�r)r)r)r*�<module>sL����3B
	SF