관리-도구
편집 파일: openssl.cpython-39.opt-1.pyc
a � �gN* � @ sX d dl mZmZ ddlmZ dZdZG dd� de�ZG dd � d e�ZG d d � d e�Z d S ) � )�CalledProcessError� check_output� )�ConfigGeneratorz^ [openssl_init] alg_section = evp_properties [evp_properties] rh-allow-sha1-signatures = yes z2 [fips_sect] tls1-prf-ems-check = {} activate = 1 c @ s> e Zd ZdZh d�Zddddddddd d ddd d d dd�Zh d�ddhddhd�Zdddddddd d d � Zdddd d d!d"d#d$d%d&d'� Zd(d)d*�Z dhd+hd,d-hd.�dhd/hd,d-hd.�d0hd/hd,d-hd.�dhd/hd,d-hd.�d1hd/hd/hd,d-hd2�d1hd+hd+hd,d-hd2�d3�Z e d4d5� �Z e d6d7� �Z e d8d9� �Ze d:d;� �Zd<S )=�OpenSSLGenerator�openssl� r ZsslZtls� z-AES256z-AES128z-SHA256z -CHACHA20z-SEEDz!IDEAz!DESz-3DESz!RC4z!RC2z !eNULL:!aNULL)z AES-256-CTRz AES-128-CTR� AES-256-GCM� AES-128-GCM� AES-256-CBC� AES-128-CBC�CHACHA20-POLY1305�SEED-CBC�IDEA-CBC�DES-CBCzRC4-40z DES40-CBC�3DES-CBCzRC4-128�RC2-CBC�NULL> zCAMELLIA-128-CBCr zCAMELLIA-256-CBCr r r r r r z AES-128-CCMz AES-256-CCMr r )z-CBCz-AESCCMz-AESGCMZkRSAZkEECDHZkPSKZkDHEPSKZkEDHZ kECDHEPSKZkRSAPSKZkGOST) �RSA�ECDHE�PSK�DHE-PSK�DHE-RSA�DHE-DSS� ECDHE-PSK�RSA-PSKz VKO-GOST-2012z-kRSAz-kEECDHz-aRSAz-aDSSz-kPSKz-kDHEPSKz -kECDHEPSKz-kRSAPSK) ZANONZDHZECDHr r r r r r r r z!MD5z-SHA1)zHMAC-MD5z HMAC-SHA1zSHA2-384�TLS1.3zDTLS1.3)�cipher�hash�protocolzSHA2-256r r )r r �macr )ZTLS_AES_256_GCM_SHA384ZTLS_AES_128_GCM_SHA256Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_CCM_SHA256ZTLS_SHA256_SHA256ZTLS_SHA256_SHA384c s� d}|j }|j� |jd }|jd }|dk s4|dk rB| �|d�}nH|dk sR|dk r`| �|d�}n*|dk sp|dk r~| �|d �}n | �|d �}|d D ].}z| �|| j| �}W q� ty� Y q�0 q�� d D ].}z| �|| j| �}W q� ty� Y q�0 qʈ d D ]2}z| �|| j| �}W n t�y0 Y n0 �q| j� � D ].\}}t � fd d�|D ���r@| �||�}�q@� d D ]2}z| �|| j | �}W n t�y� Y n0 �qxdD ]} | �|| �}�q�|S )Nr � min_dh_size� min_rsa_sizei� z @SECLEVEL=0i z @SECLEVEL=1i z @SECLEVEL=2z @SECLEVEL=3Z key_exchanger c 3 s | ]}|� d v V qdS )r N� )�.0�c��ipr$ �=/usr/share/crypto-policies/python/policygenerators/openssl.py� <genexpr>� � z4OpenSSLGenerator.generate_ciphers.<locals>.<genexpr>r! )z-SHA384z -CAMELLIAz-ARIAz-AESCCM8) �enabledZdisabledZintegers�append�key_exchange_map�KeyError�key_exchange_not_map�cipher_not_map�cipher_notany_multimap�items�all� mac_not_map) �cls�policy�s�pr" r# �i�keywordZ ciphersetr& r$ r' r) �generate_ciphers� sL z!OpenSSLGenerator.generate_ciphersc sl d}|j ��d D ]T� � fdd�| j�� D �}|�� D ].\}}t�fdd�|�� D ��r6| �||�}q6q|S )Nr r c s$ i | ] \}}|d � hkr||�qS )r r$ )r% �name�spec)r& r$ r) � <dictcomp>� s �z:OpenSSLGenerator.generate_ciphersuites.<locals>.<dictcomp>c 3 s, | ]$\}� t � fd d��| D ��V qdS )c 3 s | ]}|� v V qd S )Nr$ )r% �val�Z algvaluesr$ r) r* � r+ zCOpenSSLGenerator.generate_ciphersuites.<locals>.<genexpr>.<genexpr>N)�any)r% Zalgclass)r9 rA r) r* � s �z9OpenSSLGenerator.generate_ciphersuites.<locals>.<genexpr>)r, �ciphersuite_mapr3 r4 r- )r6 r7 r8 Z cipher_submapZciphersuite_nameZciphersuite_specr$ )r& r9 r) �generate_ciphersuites� s � �z&OpenSSLGenerator.generate_ciphersuitesc C s | � |�d S )N� )r< �r6 r7 r$ r$ r) �generate_config� s z OpenSSLGenerator.generate_configc C s� d}zt dd|d d� g�}W n@ tyL | �d� | �d|� �� Y dS ty^ Y dS 0 d |v spd |v r�| �d � | �d|� �� dS dS ) Nr+ r Zciphers���z-There is an error in openssl generated policyzPolicy: FTs NULLs ADHz0There is NULL or ADH in openssl generated policy)r r Zeprint�OSError)r6 �config�outputr$ r$ r) � test_config� s � z OpenSSLGenerator.test_configN)�__name__� __module__� __qualname__� CONFIG_NAME�SCOPESr1 r2 r. r0 r5 rC � classmethodr< rD rG rL r$ r$ r$ r) r s� �� � ������ ���) 3 r c @ s� e Zd ZdZdddddddd d �Zd d d ddddddddddddddd d d d d d!d"�Zd#d$d%d&d'd(d)d*d+d,d-d.d/d0d1�Zed2d3� �Zed4d5� �Z d6S )7�OpenSSLConfigGeneratorZ opensslcnfZSSLv3ZTLSv1zTLSv1.1zTLSv1.2zTLSv1.3zDTLSv0.9ZDTLSv1zDTLSv1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2r zDTLS0.9zDTLS1.0zDTLS1.2zRSA+SHA1zDSA+SHA1z ECDSA+SHA1z RSA+SHA224z DSA+SHA224z ECDSA+SHA224z RSA+SHA256z DSA+SHA256z ECDSA+SHA256z RSA+SHA384z DSA+SHA384z ECDSA+SHA384z RSA+SHA512z DSA+SHA512z ECDSA+SHA512Zrsa_pss_pss_sha256Zrsa_pss_pss_sha384Zrsa_pss_pss_sha512Zrsa_pss_rsae_sha256Zrsa_pss_rsae_sha384Zrsa_pss_rsae_sha512Zed25519Zed448)zRSA-SHA1zDSA-SHA1z ECDSA-SHA1z RSA-SHA2-224z DSA-SHA2-224zECDSA-SHA2-224z RSA-SHA2-256z DSA-SHA2-256zECDSA-SHA2-256z RSA-SHA2-384z DSA-SHA2-384zECDSA-SHA2-384z RSA-SHA2-512z DSA-SHA2-512zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512z EDDSA-ED25519z EDDSA-ED448Z secp224r1Z secp256r1Z secp384r1Z secp521r1�X25519�X448Z ffdhe2048Z ffdhe3072Z ffdhe4096Z ffdhe6144Z ffdhe8192ZbrainpoolP256r1ZbrainpoolP384r1ZbrainpoolP512r1)Z SECP224R1Z SECP256R1Z SECP384R1Z SECP521R1rT rU z FFDHE-2048z FFDHE-3072z FFDHE-4096z FFDHE-6144z FFDHE-8192zBRAINPOOL-P256R1zBRAINPOOL-P384R1zBRAINPOOL-P512R1c sP |j }d� �|�� d�}|d� �|�� d�7 }|jrT|d7 }|d� j|j � d�7 }|jrz|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }� fd d �|d D �}|d d �|� d 7 }� fdd �|d D �}|dd �|� d 7 }|j d dk�r6|d7 }d|d v �rL|t 7 }|S )NzCipherString = rE zCiphersuites = zTLS.MinProtocol =� zTLS.MaxProtocol =zDTLS.MinProtocol =zDTLS.MaxProtocol =c s g | ]}|� j v r� j | �qS r$ )�sign_map�r% r: �r6 r$ r) � <listcomp>- r+ z:OpenSSLConfigGenerator.generate_config.<locals>.<listcomp>�signzSignatureAlgorithms = �:c s g | ]}|� j v r� j | �qS r$ )� group_maprX rY r$ r) rZ 0 r+ �groupz Groups = �__ems�RELAXz Options = RHNoEnforceEMSinFIPS ZSHA1r ) r, r< rD Zmin_tls_version� protocol_mapZmax_tls_versionZmin_dtls_versionZmax_dtls_version�join�enums� RH_ALLOW_SHA1)r6 r7 r9 r8 Zsig_algs�groupsr$ rY r) rG s0 z&OpenSSLConfigGenerator.generate_configc C s dS �NTr$ �r6 rJ r$ r$ r) rL ; s z"OpenSSLConfigGenerator.test_configN) rM rN rO rP ra rW r] rR rG rL r$ r$ r$ r) rS � sj � �� !rS c @ s0 e Zd ZdZh d�Zedd� �Zedd� �ZdS )�OpenSSLFIPSGeneratorZ openssl_fipsr c C s t �t|jd dk��S )Nr_ r` )�FIPS_MODULE_CONFIG�format�intrc rF r$ r$ r) rG D s z$OpenSSLFIPSGenerator.generate_configc C s dS rf r$ rg r$ r$ r) rL M s z OpenSSLFIPSGenerator.test_configN)rM rN rO rP rQ rR rG rL r$ r$ r$ r) rh @ s rh N) � subprocessr r Zconfiggeneratorr rd ri r rS rh r$ r$ r$ r) �<module> s Ga