관리-도구
편집 파일: cryptopolicies.cpython-39.opt-1.pyc
a � �goG � @ s. d dl Z d dlZd dlZd dlZd dlZd dlZddlmZmZ e � dd �ddiB Z ddd �Z d Z d Zd d hh d�h d�ddhh d�h d�h d�h d�h d�h d�d� ZG dd� d�ZG dd � d ej�Zd d � Ze �d d �Zd!d"� Zd0d$d%�ZG d&d'� d'e�Zd(d)� ZG d*d+� d+�Zd,d-� Z G d.d/� d/�Z dS )1� N� )� alg_lists� validation)Zarbitrary_dh_groupsZ min_dh_sizeZ min_dsa_sizeZ min_rsa_sizeZ sha1_in_certsZ ssh_certsZ min_ec_size� )�ANYZ DISABLE_ETMZDISABLE_NON_ETM)ZDEFAULTZENFORCEZRELAX)ZetmZ__ems�*)�tls�ssl�openssl�nss�gnutls�java-tls�ssh�openssh�openssh-server�openssh-client�libssh�ipsec�ike� libreswan�kerberos�krb5�dnssec�bindr r > r r r > r r r r r > r r r > r r r > r r r > r r r > r r r > r r r ) r r r r r r r r r r c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )� ScopeSelectorc C s� |� � | _}|�d� | _| jr&|n |dd� }tjj|| jd� tjj|| jd� |�d�rr|dd� �d�n|g| _ tjj | j t | jd� dS )a= Initialize a scope selector. An example would be `ssh` in `ciphers@ssh = -NULL`. When openssh backend will request the configuration, it'll offer (`{'ssh', 'openssh'}`) as scopes and the rule above will be taken into account. Both patterns and scopes are cast to lowercase. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ss = ScopeSelector('!{SSH,IPsec}') >>> ss.matches({'ipsec', 'libreswan'}) False >>> ss.matches({'tls', 'openssl'}) True �!r N)Zoriginal_pattern�{����,) �lower�pattern� startswith� _positiver �scopeZillegal_charactersZcurly_brackets�split�_globsZresulting_globs� ALL_SCOPES)�selfr �p� r) �B/usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py�__init__> s $ �zScopeSelector.__init__c C s d| j �d�S )Nz<ScopeSelector pattern=�>)r �r' r) r) r* �__str__Y s zScopeSelector.__str__c sR | j tkrdS dd� � D �� | jr:t� fdd�| jD ��S t� fdd�| jD ��S )aE Checks whether ScopeSelector matches one of the scopes. For more examples, refer to tests/unit/parsing/test_scope_selector.py >>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'}) True >>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'}) False Tc S s g | ] }|� � �qS r) )r )�.0�sr) r) r* � <listcomp>g � z)ScopeSelector.matches.<locals>.<listcomp>c 3 s | ]}t �� |�V qd S �N��fnmatch�filter�r/ �g��scopesr) r* � <genexpr>j r2 z(ScopeSelector.matches.<locals>.<genexpr>c 3 s | ]}t �� |� V qd S r3 r4 r7 r9 r) r* r; k r2 )r � SCOPE_ANYr" �anyr% �all�r' r: r) r9 r* �matches\ s zScopeSelector.matchesN)�__name__� __module__� __qualname__r< r+ r. r@ r) r) r) r* r = s r c @ s0 e Zd ZdZdZdZdZdZdZdZ dd � Z d S ) � OperationzCAn operation that comes with the right-hand value of the directive.r � � � � � c C s d| j � �S )Nz Operation.)�namer- r) r) r* �__repr__z s zOperation.__repr__N) rA rB rC �__doc__�RESET�PREPEND�APPEND�OMIT�SET_INT�SET_ENUMrK r) r) r) r* rD p s rD c s� dd� � | � � rR�tjvr2�tv r2tjt| �fgS �tjv sD�tv r�tj � ���nH�tv rftj � ����tv r�| t� vr�tj � �| t� ��tj | fgS | �� }t� fdd�|D ��s�fdd�|D �}tjdfgdd� |D � S t� fd d�|D ���r�g }|D ]�}|�d ��r:tj�t�|d d� ��ddd � }nL|�d ��rltj�t�|dd � ��ddd � }ntj�t�|d d� ��}|��fd d�|D �� �q|S tj �| ��dS )ae Parses right-hand parts of the directives into lists of operation/value pairs. For more examples, refer to tests/unit/test_parsing.py >>> parse_rhs('', 'cipher') [(Operation.RESET, None)] >>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher') [(Operation.RESET, None), (Operation.APPEND, 'IDEA-CBC'), (Operation.APPEND, 'SEED-CBC')] >>> # 3DES-CBC gets prepended last for higher prio >>> parse_rhs('+*DES-CBC', 'cipher') [(Operation.PREPEND, 'DES-CBC'), (Operation.PREPEND, '3DES-CBC')] >>> parse_rhs('ENFORCE', '__ems') [(Operation.SET_ENUM, 'ENFORCE')] c S s | � d�p| �d�S )N)�+�-rS )r! �endswith)�vr) r) r* � differential� s z parse_rhs.<locals>.differentialc 3 s | ]}� |�V qd S r3 r) �r/ rV �rW r) r* r; � r2 z parse_rhs.<locals>.<genexpr>c s" g | ]}t �|� �D ]}|�qqS r) )r �glob)r/ rV �x�� prop_namer) r* r1 � r2 z parse_rhs.<locals>.<listcomp>Nc S s g | ]}t j|f�qS r) )rD rO rX r) r) r* r1 � r2 c 3 s | ]}� |�V qd S r3 r) rX rY r) r* r; � r2 rS r r c s g | ] }� |f�qS r) r) rX )�opr) r* r1 � r2 )�isdigitr �ALL� INT_DEFAULTSrD rQ �int�ENUMSr �rulesZNonIntPropertyIntValueErrorZIntPropertyNonIntValueErrorZBadEnumValueErrorrR r$ r= rM r> r! rN rZ rU rO rP �extendZ%MixedDifferentialNonDifferentialError)�rhsr] �valuesZ operations�valueZunglobr) )rW r^ r] r* � parse_rhs~ sF � � ri � Directive�r] r# � operationrh c s� | � � s g S tj�| � | �d�\}}|� � |� � }}tj�|| � d|v rZ|�dd�n|tf\� �� �fdd�t|� �D �S )aQ Parses configuration lines into tuples of directives. For more examples, refer to tests/unit/test_parsing.py >>> parse_line('cipher@TLS = RC4* NULL') [Directive(prop_name='cipher', scope='tls', operation=Operation.RESET, value=None), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='RC4-40'), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='RC4-128'), Directive(prop_name='cipher', scope='tls', operation=Operation.APPEND, value='NULL')] �=�@r c s$ g | ] \}}t � ��� ||d ��qS )rk )rj r )r/ rl rh �r] r# r) r* r1 � s � �z parse_line.<locals>.<listcomp>)�stripr rd Zcount_equals_signsr$ Z empty_lhsr< ri )�lineZlhsrf r) ro r* � parse_line� s �rr Fc C s\ z t | �}|D ]}t|j� qW n6 tjyV } z |s8� t�|� W Y d }~n d }~0 0 d S r3 )rr r r# r ZPolicySyntaxError�warnings�warn)rq rt �l�d�exr) r) r* �syntax_check_line� s rx c s e Zd Z� fdd�Z� ZS )� PolicySyntaxDeprecationWarningc s@ |� dd�}d|� d�}|d|� d�7 }|d7 }t� �|� d S )N� z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)�replace�superr+ )r' Z deprecatedZ replacement�msg�� __class__r) r* r+ � s z'PolicySyntaxDeprecationWarning.__init__)rA rB rC r+ � __classcell__r) r) r~ r* ry � s ry c C s� t �dd| �} | �dd�} d�dd� | �d�D ��} | �dd�} d�d d� | �d�D ��} d�d d� | �d�D ��} t �d d| ��� } t �d | �r�t�t d d�� ddddd�}|� � D ]`\}}d| d }t �|| �}|r�t�t ||�� t �|d| �} |D ]}| d|� d|� �7 } q�q�t �d d| ��� } ddddd d d �}|� � D ]x\}}d| d }i }t � || �D ] } t �||| �|| � d �< �qj|� � D ]\} } t�t | | �� �q�t �||| �} �qFt tjd d d!� �} | �r,d"�d#d� | d d!� D ��} t �d$| d! d | �rd%| � �nd| �} | �� �q�t �d&d| �} t tjd d d!� �}|�r�d"�d'd� |d d!� D ��} t �d(|d! d | �r�d%| � �nd| �} |�� �qNt �d)d| �S )*a Preprocesses text before parsing. Fixes line breaks, handles backwards compatibility. >>> preprocess_text('cipher = c1 \\ \nc2#x') 'cipher = c1 c2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('ike_protocol = IKEv2') 'protocol@IKE = IKEv2' >>> with warnings.catch_warnings(): ... warnings.simplefilter("ignore") ... preprocess_text('min_tls_version=TLS1.3') 'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2' z#.*� rm � = rz c s s | ]}|� � V qd S r3 �rp �r/ ru r) r) r* r; r2 z"preprocess_text.<locals>.<genexpr>z\ c s s | ]}|� � V qd S r3 r� r� r) r) r* r; r2 c s s | ]}t �d d|�V qdS )z\s+� N)�re�subr� r) r) r* r; r2 z +z\bprotocol\s*=�protocolz protocol@TLSz cipher@TLSz cipher@SSHz group@SSHz protocol@IKE)Z tls_cipherZ ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z z =z7hash@DNSSec = -SHA1 sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+ sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+zetm@SSH = DISABLE_ETMz etm@SSH = ANYzetm@\1 = DISABLE_ETMz etm@\1 = ANY)zsha1_in_dnssec = 0zsha1_in_dnssec = 1z ssh_etm = 0z ssh_etm = 1zssh_etm@([^= ]+) = 0zssh_etm@([^= ]+) = 1r Nr r� c s s | ]}d | V qdS �rT Nr) rX r) r) r* r; 8 r2 z\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bc s s | ]}d | V qdS r� r) rX r) r) r* r; @ r2 z\bmin_tls_version = z\bmin_tls_version = 0\b)r� r� r{ �joinr$ rp �findallrs rt ry �items�finditer�group�listr ZDTLS_PROTOCOLS�popZ TLS_PROTOCOLS)�textZPOSTFIX_REPLACEMENTS�fr�toZregex�ms�mZPLAIN_REPLACEMENTSr@ �matchZmatch_frZmatch_toZ dtls_versions�negZ tls_versionsr) r) r* �preprocess_text� sp �� � � � r� c @ sJ e Zd ZdZd dd�Zedd� �Zedd� �Zed d � �Zed d � �Z dS )� ScopedPolicya� An entity constructing lists of what's `.enabled` and what's `.disabled` when the given scopes are active. >>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'}) >>> 'AES-192-GCM' in sp.disabled['cipher'] True >>> sp.enabled['cipher'] ['RC4-40', 'RC4-128', 'NULL'] >>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size'] 2048 Nc s^ |pt � }t�� �_dd� t�� D ��_dd� tjD ��_ |D � ]�� t � j �}|� |�r>� j tjkrrg �j � j< q>� j tjkr��j � j }� j|vr�|�� j� q>� j tjkr�j � j }� j|v r�|�� j� |�d� j� q>� j tjk�r� fdd��j � j D ��j � j< q>� j tjk�r0� j�j� j< q>� j�j� j< q>�fdd�tj�� D ��_d S )Nc S s i | ]\}}||d �qS )r r) )r/ �krV r) r) r* � <dictcomp>Y r2 z)ScopedPolicy.__init__.<locals>.<dictcomp>c S s i | ] }|g �qS r) r) )r/ r] r) r) r* r� Z r2 r c s g | ]}|� j kr|�qS r) )rh �r/ �e)� directiver) r* r1 m s �z)ScopedPolicy.__init__.<locals>.<listcomp>c s& i | ] \� }� � �fd d�|D ��qS )c s g | ]}|�j � vr|�qS r) )�enabledr� )r] r' r) r* r1 x s �z4ScopedPolicy.__init__.<locals>.<dictcomp>.<listcomp>r) )r/ Zalg_listr- r\ r* r� x s �)�setra �copy�integersrc r� �enumsr r` r� r r# r@ rl rD rM r] rO rh �appendrN �remove�insertrP rQ Zdisabled)r' � directivesZrelevant_scopes�ssr� r) )r� r' r* r+ V s8 � �zScopedPolicy.__init__c C s t �| jd �S �Nr� )r �min_tls_versionr� r- r) r) r* r� | s z ScopedPolicy.min_tls_versionc C s t �| jd �S r� )r �max_tls_versionr� r- r) r) r* r� � s z ScopedPolicy.max_tls_versionc C s t �| jd �S r� )r �min_dtls_versionr� r- r) r) r* r� � s z ScopedPolicy.min_dtls_versionc C s t �| jd �S r� )r �max_dtls_versionr� r- r) r) r* r� � s z ScopedPolicy.max_dtls_version)N) rA rB rC rL r+ �propertyr� r� r� r� r) r) r) r* r� I s & r� c C s@ |D ](}t j�||�}t �|t j�r| S qt�| ||��d S r3 )�os�pathr� �access�R_OKr ZPolicyFileNotFoundError)� policyname�fname�pathsrv r( r) r) r* � lookup_file� s r� c @ sF e Zd ZdZdZdd�dd�Zdd� Zdd d �Zdd d �Zdd� Z dS )�UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN)� policydirc G sP || _ d�|g|�R �| _g | _| �|�}|D ]}|| j|dd�7 }q.|| _d S )N�:T)� subpolicy)r� r� r� �lines�read_policy_file� _directives)r' Z policy_namer� Zsubpolicy_namesr� Zsubpolicy_namer) r) r* r+ � s z UnscopedCryptoPolicy.__init__c C s | j S r3 )r� r- r) r) r* �is_empty� s z UnscopedCryptoPolicy.is_emptyc C s t | j|p i �S r3 )r� r� r? r) r) r* �scoped� s zUnscopedCryptoPolicy.scopedFc C s� | j pd}|r tj�|d�}t|||s*dnd tjj|tj�| j|�tj�| j|�f�}t|dd��}|� � }W d � n1 s�0 Y t |�}|� d�}|D ]}t |dd � q�|D ] }t |� q�d d � |D �S ) NZpolicies�modulesz.polz.pmodzutf-8)�encodingrz T)rt c S s g | ]}t |�D ]}|�qqS r) )rr )r/ ru r[ r) r) r* r1 � r2 z9UnscopedCryptoPolicy.read_policy_file.<locals>.<listcomp>) r� r� r� r� r� �curdir� CONFIG_DIR� SHARE_DIR�open�readr� r$ rx ) r' rJ r� Zpdirr( �fr� r� ru r) r) r* r� � s( ��& z%UnscopedCryptoPolicy.read_policy_filec C s dd� }| � � }d| j� d�}|d7 }|d7 }|d7 }|d7 }|d7 }i |j�|j�|j�}|�� D ]\}}||||�7 }qdd }t�� D ]p\}} | j | d �} i | j�| j�| j�} | �� D ]<\}}||| kr�|s�|d 7 }d }|||� d |� �|�7 }q�q�|�s|d7 }|S )Nc S s2 t |t�rd�|�nt|�}| � d|� ��� d S )Nr� r� rz )� isinstancer� r� �str�rstrip)�keyrh r0 r) r) r* �fmt� s z)UnscopedCryptoPolicy.__str__.<locals>.fmtz # Policy z dump z# z?# Do not parse the contents of this file with automated tools, z.# it is provided for review convenience only. z"# Baseline values for all scopes: Fr9 z9# Scope-specific properties derived for select backends: Trn z&# No scope-specific properties found. )r� r� r� r� r� r� �DUMPABLE_SCOPES) r' r� Zgeneric_scopedr0 Z generic_allr] rh Zanything_scope_specificZ scope_nameZ scope_setZspecific_scopedZ specific_allr) r) r* r. � s@ �� �� z UnscopedCryptoPolicy.__str__)N)F) rA rB rC r� r� r+ r� r� r� r. r) r) r) r* r� � s r� )F) � collections�enumr5 r� r� rs r� r r �dict�fromkeysra rc r< r& r� r �EnumrD ri � namedtuplerj rr rx � FutureWarningry r� r� r� r� r) r) r) r* �<module> sL �� ��3B SF