a
    if                     @   sD   d dl Z d dlmZmZ d dlmZ ddlmZ G dd deZdS )    N)CalledProcessErrorcall)mkstemp   )ConfigGeneratorc                   @   s  e Zd ZdZh dZdZddddddd	d
ddddZddddddddZddddddddddddddZdddddddddddddZ	ddddd d!d"d d!d"d#
Z
d$d%d&d'd(Zd$d%d&d'd)Zd$d%d*Zed+d, Zed-d. Zed/d0 Zed1d2 Zed3d4 Zd5S )6LibreswanGenerator	libreswan>   ZipsecZiker   z5systemctl try-restart ipsec.service 2>/dev/null || :
 Zdh31Zdh19Zdh20Zdh21Zdh5Zdh14Zdh15Zdh16Zdh18)ZX448ZX25519	SECP256R1Z	SECP384R1Z	SECP521R1z
FFDHE-6144z
FFDHE-1536
FFDHE-2048z
FFDHE-3072z
FFDHE-4096z
FFDHE-8192Zaes256Zaes192Zaes128Z
aes_gcm256Z
aes_gcm192Z
aes_gcm128Zchacha20_poly1305)zAES-256-CBCzAES-192-CBCzAES-128-CBCzAES-256-GCMzAES-192-GCMzAES-128-GCMzCHACHA20-POLY1305Zsha2_512Zsha2_256)AES-256-CBC-HMAC-SHA2-512AES-256-CBC-HMAC-SHA2-256AES-192-CBC-HMAC-SHA2-512AES-192-CBC-HMAC-SHA2-256AES-128-CBC-HMAC-SHA2-256zAES-256-GCM-HMAC-SHA2-512zAES-256-GCM-HMAC-SHA2-256zAES-192-GCM-HMAC-SHA2-512zAES-192-GCM-HMAC-SHA2-256zAES-128-GCM-HMAC-SHA2-512zAES-128-GCM-HMAC-SHA2-256zCHACHA20-POLY1305-HMAC-SHA2-512zCHACHA20-POLY1305-HMAC-SHA2-256Zsha1)r   r   r   r   r   zAES-256-CBC-HMAC-SHA1zAES-192-CBC-HMAC-SHA1zAES-128-CBC-HMAC-SHA1zAES-256-GCM-AEADzAES-192-GCM-AEADzAES-128-GCM-AEADzCHACHA20-POLY1305-AEADzrsa-sha1zecdsa-sha2_256zecdsa-sha2_384zecdsa-sha2_512zrsa-sha2_256zrsa-sha2_384zrsa-sha2_512)
zRSA-SHA1zECDSA-SHA2-256zECDSA-SHA2-384zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512r   r         )AEADHMAC-SHA2-512HMAC-SHA2-256	HMAC-SHA1)r   r   r   r   )r
   r   c                 C   s   || j vrdS | j | S Nc   )mac_ike_prio_mapclskey r   ?/usr/share/crypto-policies/python/policygenerators/libreswan.pyZ__get_ike_prios   s    
z!LibreswanGenerator.__get_ike_prioc                 C   s   || j vrdS | j | S r   )mac_esp_prio_mapr   r   r   r   Z__get_esp_prioz   s    
z!LibreswanGenerator.__get_esp_prioc                 C   s   || j vrdS | j | S r   )group_prio_mapr   r   r   r   Z__get_group_prio   s    
z#LibreswanGenerator.__get_group_prioc              
   C   s  d}d}|j }d}dd |d D }d|v r2d}nd	|v r>d
}|rR|d| d 7 }|d7 }t|d | jd}t|d | jd}d}	|d D ]}
z| j|
 }W n ty   Y qY n0 |d }d}|D ]@}z| j|
d |  }W n ty   Y qY n0 | ||d}q|sq||7 }d}|D ]>}z| j| }W n tyJ   Y qY n0 | ||d}q| ||d}| |	||}	q|	r|d|	 d 7 }t|d | j	d}d}	|d D ]}
z| j|
 }W n ty   Y qY n0 |d }d}|D ]V}z| j
|
d |  }W n ty"   Y qY n0 |s4|} qF| ||d}q||7 }|dd  dkrdq| |	||}	q|	r|d|	 d 7 }d}	t }|d D ]R}z| j| }W n ty   Y qY n0 ||vr|| | |	||}	q|	r|d|	 d 7 }|S )Nzconn %default
,r	   c                 S   s   g | ]}| d r|qS )ZIKE)
startswith).0xr   r   r   
<listcomp>       z6LibreswanGenerator.generate_config.<locals>.<listcomp>ZprotocolZIKEv2zikev2=insistZIKEv1zikev2=never	
z		pfs=yes
mac)r   groupcipher-+z	ike=z	esp=signz	authby=)Zenabledsorted!_LibreswanGenerator__get_ike_prio#_LibreswanGenerator__get_group_prio
cipher_mapKeyErrorcipher_prf_mapappend	group_map!_LibreswanGenerator__get_esp_priocipher_mac_mapsetsign_mapadd)r   ZpolicyZcfgseppsprotoZsorted_macsZsorted_groupstmpr+   cmZcombor)   Zmmir*   Zsigalgsr/   Zsmr   r   r   generate_config   s    



z"LibreswanGenerator.generate_configc              	   C   s   t dt jsdS t \}}d}zzt |d}|| W d    n1 sN0    Y  ztd| ddd}W n ty   | d Y n0 W t 	| nt 	| 0 |r| d	 | d
|  dS dS )Nz/usr/sbin/ipsecT   wz'/usr/sbin/ipsec readwriteconf --config z >/dev/null)shellz!/usr/sbin/ipsec: Execution failedz/There is an error in libreswan generated policyzPolicy:
F)
osaccessX_OKr   fdopenwriter   r   Zeprintunlink)r   Zconfigfdpathretfr   r   r   test_config   s&    
(

zLibreswanGenerator.test_configN)__name__
__module____qualname__ZCONFIG_NAMEZSCOPESZ
RELOAD_CMDr7   r3   r5   r9   r;   r   r   r    classmethodr1   r8   r2   rD   rR   r   r   r   r   r      s   




_r   )	rH   
subprocessr   r   Ztempfiler   Zconfiggeneratorr   r   r   r   r   r   <module>   s   