관리-도구
편집 파일: cryptopolicies.cpython-39.pyc
a � �goG � @ s. d dl Z d dlZd dlZd dlZd dlZd dlZddlmZmZ e � dd �ddiB Z ddd �Z d Z d Zd d hh d�h d�ddhh d�h d�h d�h d�h d�h d�d� ZG dd� d�ZG dd � d ej�Zd d � Ze �d d �Zd!d"� Zd0d$d%�ZG d&d'� d'e�Zd(d)� ZG d*d+� d+�Zd,d-� Z G d.d/� d/�Z dS )1� N� )� alg_lists� validation)Zarbitrary_dh_groupsZ min_dh_sizeZ min_dsa_sizeZ min_rsa_sizeZ sha1_in_certsZ ssh_certsZ min_ec_size� )�ANYZ DISABLE_ETMZDISABLE_NON_ETM)ZDEFAULTZENFORCEZRELAX)ZetmZ__ems�*)�tls�ssl�openssl�nss�gnutls�java-tls�ssh�openssh�openssh-server�openssh-client�libssh�ipsec�ike� libreswan�kerberos�krb5�dnssec�bindr r > r r r > r r r r r > r r r > r r r > r r r > r r r > r r r > r r r ) r r r r r r r r r r c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )� ScopeSelectorc C s� |� � | _}|�d� | _| jr&|n |dd� }tjj|| jd� tjj|| jd� |�d�rr|dd� �d�n|g| _ tjj | j t | jd� dS )a= Initialize a scope selector. An example would be `ssh` in `ciphers@ssh = -NULL`. When openssh backend will request the configuration, it'll offer (`{'ssh', 'openssh'}`) as scopes and the rule above will be taken into account. Both patterns and scopes are cast to lowercase. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ss = ScopeSelector('!{SSH,IPsec}') >>> ss.matches({'ipsec', 'libreswan'}) False >>> ss.matches({'tls', 'openssl'}) True �!r N)Zoriginal_pattern�{����,) �lower�pattern� startswith� _positiver �scopeZillegal_charactersZcurly_brackets�split�_globsZresulting_globs� ALL_SCOPES)�selfr �p� r) �B/usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py�__init__> s $ �zScopeSelector.__init__c C s d| j �d�S )Nz<ScopeSelector pattern=�>)r �r' r) r) r* �__str__Y s zScopeSelector.__str__c sh | j tkrdS dd� � D �� tdd� � D ��s2J �| jrPt� fdd�| jD ��S t� fdd�| jD ��S )aE Checks whether ScopeSelector matches one of the scopes. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'}) True >>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'}) False Tc S s g | ] }|� � �qS r) )r ��.0�sr) r) r* � <listcomp>g � z)ScopeSelector.matches.<locals>.<listcomp>c s s | ]}|t v V qd S �N)r& r/ r) r) r* � <genexpr>h r3 z(ScopeSelector.matches.<locals>.<genexpr>c 3 s | ]}t �� |�V qd S r4 ��fnmatch�filter�r0 �g��scopesr) r* r5 j r3 c 3 s | ]}t �� |� V qd S r4 r6 r9 r; r) r* r5 k r3 )r � SCOPE_ANY�allr" �anyr% �r' r< r) r; r* �matches\ s zScopeSelector.matchesN)�__name__� __module__� __qualname__r= r+ r. rA r) r) r) r* r = s r c @ s0 e Zd ZdZdZdZdZdZdZdZ dd � Z d S ) � OperationzCAn operation that comes with the right-hand value of the directive.r � � � � � c C s d| j � �S )Nz Operation.)�namer- r) r) r* �__repr__z s zOperation.__repr__N) rB rC rD �__doc__�RESET�PREPEND�APPEND�OMIT�SET_INT�SET_ENUMrL r) r) r) r* rE p s rE c s� dd� � | � � rx�tjvr2�tv r2tjt| �fgS �tjv sD�tv rPtj � ����tjvs^J ��tvsjJ ��tvs�J �nH�tv r�tj � ����tv r�| t� vr�tj � �| t� ��tj | fgS | �� }t� fdd�|D ���s �fdd�|D �}tjdfgdd� |D � S t� fd d�|D ���r�g }|D ]�}|�d ��rbtj�t�|d d� ��ddd � }n\|�d ��r�tj�t�|dd � ��ddd � }n*|�d ��s�J �tj�t�|d d� ��}|��fdd�|D �� �q,|S tj �| ��dS )ae Parses right-hand parts of the directives into lists of operation/value pairs. For more examples, refer to tests/unit/test_parsing.py >>> parse_rhs('', 'cipher') [(Operation.RESET, None)] >>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher') [(Operation.RESET, None), (Operation.APPEND, 'IDEA-CBC'), (Operation.APPEND, 'SEED-CBC')] >>> # 3DES-CBC gets prepended last for higher prio >>> parse_rhs('+*DES-CBC', 'cipher') [(Operation.PREPEND, 'DES-CBC'), (Operation.PREPEND, '3DES-CBC')] >>> parse_rhs('ENFORCE', '__ems') [(Operation.SET_ENUM, 'ENFORCE')] c S s | � d�p| �d�S )N)�+�-rT )r! �endswith)�vr) r) r* � differential� s z parse_rhs.<locals>.differentialc 3 s | ]}� |�V qd S r4 r) �r0 rW �rX r) r* r5 � r3 z parse_rhs.<locals>.<genexpr>c s" g | ]}t �|� �D ]}|�qqS r) )r �glob)r0 rW �x�� prop_namer) r* r2 � r3 z parse_rhs.<locals>.<listcomp>Nc S s g | ]}t j|f�qS r) )rE rP rY r) r) r* r2 � r3 c 3 s | ]}� |�V qd S r4 r) rY rZ r) r* r5 � r3 rT r r rU c s g | ] }� |f�qS r) r) rY )�opr) r* r2 � r3 )�isdigitr �ALL� INT_DEFAULTSrE rR �int�ENUMSr �rulesZNonIntPropertyIntValueErrorZIntPropertyNonIntValueErrorZBadEnumValueErrorrS r$ r? rN r> r! rO r[ rV rP rQ �extendZ%MixedDifferentialNonDifferentialError)�rhsr^ �valuesZ operations�valueZunglobr) )rX r_ r^ r* � parse_rhs~ sL � � rj � Directive�r^ r# � operationri c s� | � � s g S tj�| � | �d�\}}|� � |� � }}tj�|| � d|v rZ|�dd�n|tf\� �� �fdd�t|� �D �S )aQ Parses configuration lines into tuples of directives. For more examples, refer to tests/unit/test_parsing.py >>> parse_line('cipher@TLS = RC4* NULL') [Directive(prop_name='cipher', scope='tls', operation=Operation.RESET, value=None), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='RC4-40'), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='RC4-128'), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='NULL')] �=�@r c s$ g | ] \}}t � ��� ||d ��qS )rl )rk r )r0 rm ri �r^ r# r) r* r2 � s � �z parse_line.<locals>.<listcomp>)�stripr re Zcount_equals_signsr$ Z empty_lhsr= rj )�lineZlhsrg r) rp r* � parse_line� s �rs Fc C s\ z t | �}|D ]}t|j� qW n6 tjyV } z |s8� t�|� W Y d }~n d }~0 0 d S r4 )rs r r# r ZPolicySyntaxError�warnings�warn)rr ru �l�d�exr) r) r* �syntax_check_line� s ry c s e Zd Z� fdd�Z� ZS )� PolicySyntaxDeprecationWarningc s@ |� dd�}d|� d�}|d|� d�7 }|d7 }t� �|� d S )N� z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)�replace�superr+ )r' Z deprecatedZ replacement�msg�� __class__r) r* r+ � s z'PolicySyntaxDeprecationWarning.__init__)rB rC rD r+ � __classcell__r) r) r r* rz � s rz c C s� t �dd| �} | �dd�} d�dd� | �d�D ��} | �dd�} d�d d� | �d�D ��} d�d d� | �d�D ��} t �d d| ��� } t �d | �r�t�t d d�� ddddd�}|� � D ]`\}}d| d }t �|| �}|r�t�t ||�� t �|d| �} |D ]}| d|� d|� �7 } q�q�t �d d| ��� } ddddd d d �}|� � D ]x\}}d| d }i }t � || �D ] } t �||| �|| � d �< �qj|� � D ]\} } t�t | | �� �q�t �||| �} �qFt tjd d d!� �} | �r,d"�d#d� | d d!� D ��} t �d$| d! d | �rd%| � �nd| �} | �� �q�t �d&d| �} t tjd d d!� �}|�r�d"�d'd� |d d!� D ��} t �d(|d! d | �r�d%| � �nd| �} |�� �qNt �d)d| �S )*a Preprocesses text before parsing. Fixes line breaks, handles backwards compatibility. >>> preprocess_text('cipher = c1 \\ \nc2#x') 'cipher = c1 c2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('ike_protocol = IKEv2') 'protocol@IKE = IKEv2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('min_tls_version=TLS1.3') 'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2' z#.*� rn � = r{ c s s | ]}|� � V qd S r4 �rq �r0 rv r) r) r* r5 r3 z"preprocess_text.<locals>.<genexpr>z\ c s s | ]}|� � V qd S r4 r� r� r) r) r* r5 r3 c s s | ]}t �d d|�V qdS )z\s+� N)�re�subr� r) r) r* r5 r3 z +z\bprotocol\s*=�protocolz protocol@TLSz cipher@TLSz cipher@SSHz group@SSHz protocol@IKE)Z tls_cipherZ ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z z =z7hash@DNSSec = -SHA1 sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+ sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+zetm@SSH = DISABLE_ETMz etm@SSH = ANYzetm@\1 = DISABLE_ETMz etm@\1 = ANY)zsha1_in_dnssec = 0zsha1_in_dnssec = 1z ssh_etm = 0z ssh_etm = 1zssh_etm@([^= ]+) = 0zssh_etm@([^= ]+) = 1r Nr r� c s s | ]}d | V qdS �rU Nr) rY r) r) r* r5 8 r3 z\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bc s s | ]}d | V qdS r� r) rY r) r) r* r5 @ r3 z\bmin_tls_version = z\bmin_tls_version = 0\b)r� r� r| �joinr$ rq �findallrt ru rz �items�finditer�group�listr ZDTLS_PROTOCOLS�popZ TLS_PROTOCOLS)�textZPOSTFIX_REPLACEMENTS�fr�toZregex�ms�mZPLAIN_REPLACEMENTSrA �matchZmatch_frZmatch_toZ dtls_versions�negZ tls_versionsr) r) r* �preprocess_text� sp �� � � � r� c @ sJ e Zd ZdZd dd�Zedd� �Zedd� �Zed d � �Zed d � �Z dS )� ScopedPolicya� An entity constructing lists of what's `.enabled` and what's `.disabled` when the given scopes are active. >>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'}) >>> 'AES-192-GCM' in sp.disabled['cipher'] True >>> sp.enabled['cipher'] ['RC4-40', 'RC4-128', 'NULL'] >>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size'] 2048 Nc s� |pt � }t�� �_dd� t�� D ��_dd� tjD ��_ |D �]� t � j �}|� |�r>� j tjkrrg �j � j< q>� j tjkr��j � j }� j|vr�|�� j� q>� j tjkr�j � j }� j|v r�|�� j� |�d� j� q>� j tjk�r� fdd��j � j D ��j � j< q>� j tjk�r0� j�j� j< q>� j tjk�sBJ �� j�j� j< q>t�j �tt �j ��k�spJ ��fdd�tj�� D ��_d S )Nc S s i | ]\}}||d �qS )r r) )r0 �krW r) r) r* � <dictcomp>Y r3 z)ScopedPolicy.__init__.<locals>.<dictcomp>c S s i | ] }|g �qS r) r) )r0 r^ r) r) r* r� Z r3 r c s g | ]}|� j kr|�qS r) )ri �r0 �e)� directiver) r* r2 m s �z)ScopedPolicy.__init__.<locals>.<listcomp>c s& i | ] \� }� � �fd d�|D ��qS )c s g | ]}|�j � vr|�qS r) )�enabledr� )r^ r' r) r* r2 x s �z4ScopedPolicy.__init__.<locals>.<dictcomp>.<listcomp>r) )r0 Zalg_listr- r] r* r� x s �) �setrb �copy�integersrd r� �enumsr ra r� r r# rA rm rE rN r^ rP ri �appendrO �remove�insertrQ rR rS �lenZdisabled)r' � directivesZrelevant_scopes�ssr� r) )r� r' r* r+ V s< � �zScopedPolicy.__init__c C s t �| jd �S �Nr� )r �min_tls_versionr� r- r) r) r* r� | s z ScopedPolicy.min_tls_versionc C s t �| jd �S r� )r �max_tls_versionr� r- r) r) r* r� � s z ScopedPolicy.max_tls_versionc C s t �| jd �S r� )r �min_dtls_versionr� r- r) r) r* r� � s z ScopedPolicy.min_dtls_versionc C s t �| jd �S r� )r �max_dtls_versionr� r- r) r) r* r� � s z ScopedPolicy.max_dtls_version)N) rB rC rD rM r+ �propertyr� r� r� r� r) r) r) r* r� I s & r� c C s@ |D ](}t j�||�}t �|t j�r| S qt�| ||��d S r4 )�os�pathr� �access�R_OKr ZPolicyFileNotFoundError)� policyname�fname�pathsrw r( r) r) r* � lookup_file� s r� c @ sF e Zd ZdZdZdd�dd�Zdd� Zdd d �Zdd d �Zdd� Z dS )�UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN)� policydirc G sP || _ d�|g|�R �| _g | _| �|�}|D ]}|| j|dd�7 }q.|| _d S )N�:T)� subpolicy)r� r� r� �lines�read_policy_file� _directives)r' Z policy_namer� Zsubpolicy_namesr� Zsubpolicy_namer) r) r* r+ � s z UnscopedCryptoPolicy.__init__c C s | j S r4 )r� r- r) r) r* �is_empty� s z UnscopedCryptoPolicy.is_emptyc C s t | j|p i �S r4 )r� r� r@ r) r) r* �scoped� s zUnscopedCryptoPolicy.scopedFc C s� | j pd}|r tj�|d�}t|||s*dnd tjj|tj�| j|�tj�| j|�f�}t|dd��}|� � }W d � n1 s�0 Y t |�}|� d�}|D ]}t |dd � q�|D ] }t |� q�d d � |D �S ) NZpolicies�modulesz.polz.pmodzutf-8)�encodingr{ T)ru c S s g | ]}t |�D ]}|�qqS r) )rs )r0 rv r\ r) r) r* r2 � r3 z9UnscopedCryptoPolicy.read_policy_file.<locals>.<listcomp>) r� r� r� r� r� �curdir� CONFIG_DIR� SHARE_DIR�open�readr� r$ ry ) r' rK r� Zpdirr( �fr� r� rv r) r) r* r� � s( ��& z%UnscopedCryptoPolicy.read_policy_filec C s dd� }| � � }d| j� d�}|d7 }|d7 }|d7 }|d7 }|d7 }i |j�|j�|j�}|�� D ]\}}||||�7 }qdd }t�� D ]p\}} | j | d �} i | j�| j�| j�} | �� D ]<\}}||| kr�|s�|d 7 }d }|||� d |� �|�7 }q�q�|�s|d7 }|S )Nc S s2 t |t�rd�|�nt|�}| � d|� ��� d S )Nr� r� r{ )� isinstancer� r� �str�rstrip)�keyri r1 r) r) r* �fmt� s z)UnscopedCryptoPolicy.__str__.<locals>.fmtz # Policy z dump z# z?# Do not parse the contents of this file with automated tools, z.# it is provided for review convenience only. z"# Baseline values for all scopes: Fr; z9# Scope-specific properties derived for select backends: Tro z&# No scope-specific properties found. )r� r� r� r� r� r� �DUMPABLE_SCOPES) r' r� Zgeneric_scopedr1 Z generic_allr^ ri Zanything_scope_specificZ scope_nameZ scope_setZspecific_scopedZ specific_allr) r) r* r. � s@ �� �� z UnscopedCryptoPolicy.__str__)N)F) rB rC rD r� r� r+ r� r� r� r. r) r) r) r* r� � s r� )F) � collections�enumr7 r� r� rt r� r r �dict�fromkeysrb rd r= r& r� r �EnumrE rj � namedtuplerk rs ry � FutureWarningrz r� r� r� r� r) r) r) r* �<module> sL �� ��3B SF