/usr/share/crypto-policies/python/cryptopolicies/__pycache__
Edit: /usr/share/crypto-policies/python/cryptopolicies/__pycache__/cryptopolicies.cpython-39.pyc (17396B)
a
ԏiJ @ s4 d dl Z d dlZd dlZd dlZd dlZd dlZddlmZmZ e
dd ddiB Z ddd Z d
Z
d Zd d
hh dh dddhh dh dh dh dh dh dddhd ZG dd d ZG d d d ejZd d Ze d!d"Zd#d$ Zd2d&d'ZG d(d) d)eZd*d+ ZG d,d- d-Zd.d/ Z G d0d1 d1Z dS )3 N ) alg_lists
validation)Zarbitrary_dh_groupsZ min_dh_sizeZ min_dsa_sizeZ min_rsa_sizeZ
sha1_in_certsZ ssh_certsZ min_ec_size )ANYZ DISABLE_ETMZDISABLE_NON_ETM)ZDEFAULTZENFORCEZRELAX)ZetmZ__ems*)tlssslopensslnssgnutlsjava-tlssshopensshopenssh-serveropenssh-clientlibsshipsecike libreswankerberoskrb5dnssecbindrpm rpm-sequoiar r > r r r > r r r
r r > r r r > r r r > r r r > r r r > r r r > r
r r r r ) r r r
r r r r r r r
r c @ s( e Zd ZefddZdd Zdd ZdS )
ScopeSelectorc C s | | _}|d | _| jr&|n
|dd }tjj|| jd tjj|| jd |drr|dd dn|g| _ tjj
| j t | jd dS )a=
Initialize a scope selector.
An example would be `ssh` in `ciphers@ssh = -NULL`.
When openssh backend will request the configuration,
it'll offer (`{'ssh', 'openssh'}`) as scopes
and the rule above will be taken into account.
Both patterns and scopes are cast to lowercase.
For more examples, refer to tests/unit/parsing/test_scope_selector.py
>>> ss = ScopeSelector('!{SSH,IPsec}')
>>> ss.matches({'ipsec', 'libreswan'})
False
>>> ss.matches({'tls', 'openssl'})
True
!r N)Zoriginal_pattern{,) lowerpattern
startswith _positiver scopeZillegal_charactersZcurly_bracketssplit_globsZresulting_globs
ALL_SCOPES)selfr" p r+ B/usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py__init__A s $ zScopeSelector.__init__c C s d| j dS )Nz
)r" r) r+ r+ r, __str__\ s zScopeSelector.__str__c sh | j tkrdS dd D tdd D s2J | jrPt fdd| jD S t fdd| jD S )aE
Checks whether ScopeSelector matches one of the scopes.
For more examples, refer to tests/unit/parsing/test_scope_selector.py
>>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'})
True
>>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'})
False
Tc S s g | ] }| qS r+ )r! .0sr+ r+ r,
j z)ScopeSelector.matches..c s s | ]}|t v V qd S N)r( r1 r+ r+ r, k r5 z(ScopeSelector.matches..c 3 s | ]}t |V qd S r6 fnmatchfilterr2 gscopesr+ r, r7 m r5 c 3 s | ]}t | V qd S r6 r8 r; r= r+ r, r7 n r5 )r" SCOPE_ANYallr$ anyr' r) r> r+ r= r, matches_ s
zScopeSelector.matchesN)__name__
__module__ __qualname__r? r- r0 rC r+ r+ r+ r, r @ s r c @ s0 e Zd ZdZdZdZdZdZdZdZ dd Z
d
S ) OperationzCAn operation that comes with the right-hand value of the directive.r c C s d| j S )Nz
Operation.)namer/ r+ r+ r, __repr__} s zOperation.__repr__N) rD rE rF __doc__RESETPREPENDAPPENDOMITSET_INTSET_ENUMrN r+ r+ r+ r, rG s s rG c s dd | rxtjvr2tv r2tjt| fgS tjv sDtv rPtj
tjvs^J tvsjJ tvsJ nHtv rtj tv r| t vrtj | t tj
| fgS | }t fdd|D s fdd|D }tjdfgdd |D S t fd d|D rg }|D ]}|d
rbtjt|d d ddd }n\|d
rtjt|dd ddd }n*|d
sJ tjt|d d }|fdd|D q,|S tj | dS )ae
Parses right-hand parts of the directives
into lists of operation/value pairs.
For more examples, refer to tests/unit/test_parsing.py
>>> parse_rhs('', 'cipher')
[(Operation.RESET, None)]
>>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher')
[(Operation.RESET, None),
(Operation.APPEND, 'IDEA-CBC'),
(Operation.APPEND, 'SEED-CBC')]
>>> # 3DES-CBC gets prepended last for higher prio
>>> parse_rhs('+*DES-CBC', 'cipher')
[(Operation.PREPEND, 'DES-CBC'),
(Operation.PREPEND, '3DES-CBC')]
>>> parse_rhs('ENFORCE', '__ems')
[(Operation.SET_ENUM, 'ENFORCE')]
c S s | dp| dS )N)+-rV )r# endswith)vr+ r+ r, differential s z parse_rhs..differentialc 3 s | ]} |V qd S r6 r+ r2 rY rZ r+ r, r7 r5 z parse_rhs..c s" g | ]}t | D ]}|qqS r+ )r glob)r2 rY x prop_namer+ r, r4 r5 z parse_rhs..Nc S s g | ]}t j|fqS r+ )rG rR r[ r+ r+ r, r4 r5 c 3 s | ]} |V qd S r6 r+ r[ r\ r+ r, r7 r5 rV r r rW c s g | ] } |fqS r+ r+ r[ )opr+ r, r4 r5 )isdigitr ALL INT_DEFAULTSrG rT intENUMSr rulesZNonIntPropertyIntValueErrorZIntPropertyNonIntValueErrorZBadEnumValueErrorrU r& rA rP r@ r# rQ r] rX rR rS extendZ%MixedDifferentialNonDifferentialError)rhsr` valuesZ
operationsvalueZunglobr+ )rZ ra r` r, parse_rhs sL
rl Directiver` r% operationrk c s | s g S tj| | d\}}| | }}tj|| d|v rZ|ddn|tf\ fddt| D S )aQ
Parses configuration lines into tuples of directives.
For more examples, refer to tests/unit/test_parsing.py
>>> parse_line('cipher@TLS = RC4* NULL')
[Directive(prop_name='cipher', scope='tls',
operation=Operation.RESET, value=None),
Directive(prop_name='cipher', scope='tls',
operation=Operation.APPEND, value='RC4-40'),
Directive(prop_name='cipher', scope='tls',
operation=Operation.APPEND, value='RC4-128'),
Directive(prop_name='cipher', scope='tls',
operation=Operation.APPEND, value='NULL')]
=@r c s$ g | ] \}}t ||d qS )rn )rm r! )r2 ro rk r` r% r+ r, r4 s
z parse_line..)stripr rg Zcount_equals_signsr& Z empty_lhsr? rl )lineZlhsri r+ rr r,
parse_line s ru Fc
C s\ z t | }|D ]}t|j qW n6 tjyV } z |s8 t| W Y d }~n
d }~0 0 d S r6 )ru r r% r ZPolicySyntaxErrorwarningswarn)rt rw ldexr+ r+ r, syntax_check_line s r{ c s e Zd Zd fdd Z ZS ) PolicySyntaxDeprecationWarningoptionFc sF | dd}| d| d}|d| 7 }|s6|d7 }t | d S )N
z and z is deprecatedz", please rewrite your rules using z4; be advised that it is not always a 1-1 replacement)replacesuperr- )r) Z
deprecatedZ replacementwhatonetoonemsg __class__r+ r, r- s z'PolicySyntaxDeprecationWarning.__init__)r} F)rD rE rF r-
__classcell__r+ r+ r r, r| s r| c
C sJ t dd| } | dd} ddd | dD } | dd} dd d | dD } dd
d | dD } t d d| } t d | rtt d
d ddddd}|
D ]`\}}d| d }t || }|rtt || t |d| } |D ]}| d| d| 7 } qqt d d| } ddddd d d }|
D ]x\}}d| d }i }t || D ] } t ||| || d < qj|
D ]\}
} tt |
| qt ||| } qFd d!i} |
D ]\}}d| d }i }t || D ]$} t ||| d || d < q|
D ] \}
} tt |
| d"d#d$ q"t ||| } qt
tjd%d%d& }
|
rd'd(d |
d%d& D }t d)|
d& d |rd*| nd| } |
qjt d+d| } t
tjd%d%d& }|r>> preprocess_text('cipher = c1 \\ \nc2#x')
'cipher = c1 c2'
>>> with warnings.catch_warnings():
... warnings.simplefilter("ignore")
... preprocess_text('ike_protocol = IKEv2')
'protocol@IKE = IKEv2'
>>> with warnings.catch_warnings():
... warnings.simplefilter("ignore")
... preprocess_text('min_tls_version=TLS1.3')
'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2'
z#.* rp = r~ c s s | ]}| V qd S r6 rs r2 rx r+ r+ r, r7 r5 z"preprocess_text..z\
c s s | ]}| V qd S r6 r r r+ r+ r, r7
r5 c s s | ]}t d d|V qdS )z\s+r N)resubr r+ r+ r, r7 r5 z
+z\bprotocol\s*=protocolz protocol@TLSz
cipher@TLSz
cipher@SSHz group@SSHz protocol@IKE)Z
tls_cipherZ
ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z
z =z7hash@DNSSec = -SHA1
sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+
sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+zetm@SSH = DISABLE_ETMz
etm@SSH = ANYzetm@\1 = DISABLE_ETMz etm@\1 = ANY)zsha1_in_dnssec = 0zsha1_in_dnssec = 1z ssh_etm = 0z ssh_etm = 1zssh_etm@([^= ]+) = 0zssh_etm@([^= ]+) = 1r zX25519-MLKEM768zMLKEM768-X25519rk T)r r Nr r c s s | ]}d | V qdS rW Nr+ r[ r+ r+ r, r7 J r5 z\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bc s s | ]}d | V qdS r r+ r[ r+ r+ r, r7 R r5 z\bmin_tls_version = z\bmin_tls_version = 0\b)r r r joinr& rs findallrv rw r| itemsfinditergrouplistr ZDTLS_PROTOCOLSpopZ
TLS_PROTOCOLS)textZPOSTFIX_REPLACEMENTSfrtoZregexmsmZPLAIN_REPLACEMENTSrC matchZmatch_frZmatch_toZVALUE_REPLACEMENTSZ
dtls_versionsnegZ tls_versionsr+ r+ r, preprocess_text s "
r c @ sJ e Zd ZdZd
ddZedd Zedd Zed d
Zed d Z dS ) ScopedPolicya
An entity constructing lists of what's `.enabled` and what's `.disabled`
when the given scopes are active.
>>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'})
>>> 'AES-192-GCM' in sp.disabled['cipher']
True
>>> sp.enabled['cipher']
['RC4-40', 'RC4-128', 'NULL']
>>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size']
2048
Nc s |pt }t _dd t D _dd tjD _ |D ] t
j }| |r> j
tjkrrg j j< q> j
tjkrj j } j|vr| j q> j
tjkrj j } j|v r| j |d j q> j
tjkr fddj j D j j< q> j
tjkr0 jj j< q> j
tjksBJ jj j< q>tj tt j kspJ fddtj D _d S )Nc S s i | ]\}}||d qS )r r+ )r2 krY r+ r+ r,
k r5 z)ScopedPolicy.__init__..c S s i | ]
}|g qS r+ r+ )r2 r` r+ r+ r, r l r5 r c s g | ]}| j kr|qS r+ )rk r2 e) directiver+ r, r4 s
z)ScopedPolicy.__init__..c s& i | ] \ } fd d|D qS )c s g | ]}|j vr|qS r+ )enabledr )r` r) r+ r, r4 s z4ScopedPolicy.__init__...r+ )r2 Zalg_listr/ r_ r, r s ) setrd copyintegersrf r enumsr rc r r r% rC ro rG rP r` rR rk appendrQ removeinsertrS rT rU lenZdisabled)r)
directivesZrelevant_scopesssr r+ )r r) r, r- h s<
zScopedPolicy.__init__c C s t | jd S Nr )r min_tls_versionr r/ r+ r+ r, r s z ScopedPolicy.min_tls_versionc C s t | jd S r )r max_tls_versionr r/ r+ r+ r, r s z ScopedPolicy.max_tls_versionc C s t | jd S r )r min_dtls_versionr r/ r+ r+ r, r s z ScopedPolicy.min_dtls_versionc C s t | jd S r )r max_dtls_versionr r/ r+ r+ r, r s z ScopedPolicy.max_dtls_version)N)
rD rE rF rO r- propertyr r r r r+ r+ r+ r, r [ s
&
r c C s@ |D ](}t j||}t |t jr| S qt| ||d S r6 )ospathr accessR_OKr ZPolicyFileNotFoundError)
policynamefnamepathsry r* r+ r+ r, lookup_file s
r c @ sF e Zd ZdZdZddddZdd Zdd d
Zdd d
Zdd Z dS )UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN) policydirc G sP || _ d|g|R | _g | _| |}|D ]}|| j|dd7 }q.|| _d S )N:T) subpolicy)r r r linesread_policy_file _directives)r) Z policy_namer Zsubpolicy_namesr Zsubpolicy_namer+ r+ r, r- s
z UnscopedCryptoPolicy.__init__c C s | j S r6 )r r/ r+ r+ r, is_empty s z UnscopedCryptoPolicy.is_emptyc C s t | j|p i S r6 )r r rB r+ r+ r, scoped s zUnscopedCryptoPolicy.scopedFc
C s | j pd}|r tj|d}t|||s*dnd tjj|tj| j|tj| j|f}t|dd}| }W d n1 s0 Y t
|}| d}|D ]}t |dd q|D ] }t | qd
d |D S ) NZpoliciesmodulesz.polz.pmodzutf-8)encodingr~ T)rw c S s g | ]}t |D ]}|qqS r+ )ru )r2 rx r^ r+ r+ r, r4 r5 z9UnscopedCryptoPolicy.read_policy_file..)
r r r r r curdir
CONFIG_DIR SHARE_DIRopenreadr r& r{ ) r) rM r Zpdirr* fr r rx r+ r+ r, r s(
&
z%UnscopedCryptoPolicy.read_policy_filec C s dd }| }d| j d}|d7 }|d7 }|d7 }|d7 }|d7 }i |j|j|j}| D ]\}}||||7 }qdd }t D ]p\}} | j | d
}
i |
j|
j|
j} | D ]<\}}||| kr|s|d 7 }d }||| d
| |7 }qq|s|d7 }|S )Nc S s2 t |trd|nt|}| d| d S )Nr r r~ )
isinstancer r strrstrip)keyrk r3 r+ r+ r, fmt s z)UnscopedCryptoPolicy.__str__..fmtz # Policy z dump
z#
z?# Do not parse the contents of this file with automated tools,
z.# it is provided for review convenience only.
z"# Baseline values for all scopes:
Fr= z9# Scope-specific properties derived for select backends:
Trq z&# No scope-specific properties found.
)r r r r r r DUMPABLE_SCOPES) r) r Zgeneric_scopedr3 Z generic_allr` rk Zanything_scope_specificZ
scope_nameZ scope_setZspecific_scopedZ specific_allr+ r+ r, r0 s@ z UnscopedCryptoPolicy.__str__)N)F)
rD rE rF r r r- r r r r0 r+ r+ r+ r, r s
r )F) collectionsenumr9 r r rv r r r dictfromkeysrd rf r? r( r r EnumrG rl
namedtuplerm ru r{
FutureWarningr| r r r r r+ r+ r+ r, sN
3B
aF