a
    Ug~.                     @   st   d dl Z d dlZd dlZd dlmZ ddlmZ G dd deZG dd deZG d	d
 d
eZ	dd Z
dd ZdS )    N)mkstemp   )ConfigGeneratorc                   @   s   e Zd Zdddddddddddddd	d
dddddddZdddddddZdddddddZddddddd d!d"d#d$
Zd%d&d'Zd(d)d*d+d,d-d.d/Zd0d1d2d3d4d5d6d7d8d9d:
Z	d;d<d=d>d?d@dAdBdCdDd:
Z
edEdF ZdGS )HOpenSSHGeneratorzaes256-gcm@openssh.comz
aes256-ctr z
aes192-ctrzaes128-gcm@openssh.comz
aes128-ctrzchacha20-poly1305@openssh.comz
aes256-cbcz
aes192-cbcz
aes128-cbcz3des-cbc)zAES-256-GCMzAES-256-CTRzAES-192-GCMzAES-192-CTRzAES-128-GCMzAES-128-CTRzCHACHA20-POLY1305zCAMELLIA-256-GCMzAES-256-CCMzAES-192-CCMzAES-128-CCMzCAMELLIA-128-GCMzAES-256-CBCzAES-192-CBCzAES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-128-CBCzRC4-128zDES-CBCzCAMELLIA-128-CTSz3DES-CBCzhmac-md5-etm@openssh.comzumac-64-etm@openssh.comzumac-128-etm@openssh.comzhmac-sha1-etm@openssh.comzhmac-sha2-256-etm@openssh.comzhmac-sha2-512-etm@openssh.com)zHMAC-MD5zUMAC-64zUMAC-128z	HMAC-SHA1zHMAC-SHA2-256zHMAC-SHA2-512zhmac-md5zumac-64@openssh.comzumac-128@openssh.comz	hmac-sha1zhmac-sha2-256zhmac-sha2-512zecdh-sha2-nistp521zecdh-sha2-nistp384zecdh-sha2-nistp256z.curve25519-sha256,curve25519-sha256@libssh.orgzdiffie-hellman-group1-sha1zdiffie-hellman-group14-sha1zdiffie-hellman-group14-sha256zdiffie-hellman-group16-sha512zdiffie-hellman-group18-sha512z"sntrup761x25519-sha512@openssh.com)
zECDHE-SECP521R1-SHA2-512zECDHE-SECP384R1-SHA2-384zECDHE-SECP256R1-SHA2-256zECDHE-X25519-SHA2-256zDHE-FFDHE-1024-SHA1zDHE-FFDHE-2048-SHA1zDHE-FFDHE-2048-SHA2-256zDHE-FFDHE-4096-SHA2-512zDHE-FFDHE-8192-SHA2-512zSNTRUP-X25519-SHA2-512z"diffie-hellman-group-exchange-sha1z$diffie-hellman-group-exchange-sha256)zDHE-SHA1zDHE-SHA2-256zgss-gex-sha1-zgss-group1-sha1-zgss-group14-sha1-zgss-group14-sha256-zgss-nistp256-sha256-zgss-curve25519-sha256-zgss-group16-sha512-)zDHE-GSS-SHA1zDHE-GSS-FFDHE-1024-SHA1zDHE-GSS-FFDHE-2048-SHA1zDHE-GSS-FFDHE-2048-SHA2-256zECDHE-GSS-SECP256R1-SHA2-256zECDHE-GSS-X25519-SHA2-256zDHE-GSS-FFDHE-4096-SHA2-512zssh-rsazssh-dsszrsa-sha2-256zrsa-sha2-512zecdsa-sha2-nistp256z"sk-ecdsa-sha2-nistp256@openssh.comzecdsa-sha2-nistp384zecdsa-sha2-nistp521zssh-ed25519zsk-ssh-ed25519@openssh.com)
zRSA-SHA1zDSA-SHA1zRSA-SHA2-256zRSA-SHA2-512zECDSA-SHA2-256zECDSA-SHA2-256-FIDOzECDSA-SHA2-384zECDSA-SHA2-512zEDDSA-ED25519zEDDSA-ED25519-FIDOzssh-rsa-cert-v01@openssh.comzssh-dss-cert-v01@openssh.comz!rsa-sha2-256-cert-v01@openssh.comz!rsa-sha2-512-cert-v01@openssh.comz(ecdsa-sha2-nistp256-cert-v01@openssh.comz+sk-ecdsa-sha2-nistp256-cert-v01@openssh.comz(ecdsa-sha2-nistp384-cert-v01@openssh.comz(ecdsa-sha2-nistp521-cert-v01@openssh.comz ssh-ed25519-cert-v01@openssh.comz#sk-ssh-ed25519-cert-v01@openssh.comc                 C   s  |j }d}d}d}|d D ]0}	z| || j|	 |}W q tyH   Y q0 q|r`|d| d7 }d}|jd dkr|d D ]0}	z| || j|	 |}W qz ty   Y qz0 qz|jd d	kr|d D ]0}	z| || j|	 |}W q ty   Y q0 q|r
|d
| d7 }d}d}
|d D ]&}|d D ]}|jd rz$| j|d |  }| |||}W n tyr   Y n0 z"||d |  }| |
||}
W n ty   Y n0 |d D ]}z*||d | d |  }| |||}W n ty   Y n0 z*||d | d |  }| |
||}
W n ty6   Y n0 qq(q|
r\|d|
 d7 }n|d7 }|rz|d| d7 }d}|d D ]n}	z| || j	|	 |}W n ty   Y n0 |jd rz| || j
|	 |}W n ty   Y n0 q|r"|r|d| d7 }|d| d7 }d}|d D ]4}	z| || j	|	 |}W n ty^   Y n0 q.|rz|d| d7 }|jd dkrt }|d ur|| d|jd  d7 }|S )Nr   ,ZcipherzCiphers 
ZetmZDISABLE_ETMZmacZDISABLE_NON_ETMzMACs Zkey_exchangehashZarbitrary_dh_groups-groupzGSSAPIKexAlgorithms zGSSAPIKeyExchange no
zKexAlgorithms signZ	ssh_certszHostKeyAlgorithms zPubkeyAcceptedAlgorithms zCASignatureAlgorithms Zmin_rsa_sizer    )Zenabledappend
cipher_mapKeyErrorZenumsmac_map_etmmac_mapZintegersgx_mapsign_mapsign_map_certs_min_rsa_size_option)clspolicylocal_kx_maplocal_gss_kx_mapdo_host_keypZcfgsepsiZgssZkxhvalgZmin_rsa_optname r#   =/usr/share/crypto-policies/python/policygenerators/openssh.pygenerate_optionsr   s    


z!OpenSSHGenerator.generate_optionsN)__name__
__module____qualname__r   r   r   kx_mapr   
gss_kx_mapr   r   classmethodr%   r#   r#   r#   r$   r      s   

r   c                   @   s0   e Zd ZdZh dZedd Zedd ZdS )OpenSSHClientGeneratoropenssh>   zopenssh-clientsshr-   c                 C   s&   t | j}t | j}| j|||ddS )NFr   )dictr)   r*   r%   )r   r   r   r   r#   r#   r$   generate_config   s
    


z&OpenSSHClientGenerator.generate_configc              	   C   s
  t ddkrdS t dt js$dS t ddkrHtt  dd|}t \}}d}z~t |d	}|	| W d    n1 s0    Y  zt
jd
| ddd}W n t
jy   | d Y n0 W t | nt | 0 |r| d | d|  dS dS )NOLD_OPENSSH1T/usr/bin/sshOPENSSH_MIN_RSA_SIZE_FORCE.*r      wz/usr/bin/ssh -G -F z bogus654_server >/dev/nullshellz/usr/bin/ssh: Execution failed4There is an error in OpenSSH server generated policyPolicy:
F)osgetenvaccessX_OKresubr   r   fdopenwrite
subprocesscallCalledProcessErroreprintunlink)r   configfdpathretfr#   r#   r$   test_config   s.    
(

z"OpenSSHClientGenerator.test_configN)r&   r'   r(   CONFIG_NAMESCOPESr+   r1   rO   r#   r#   r#   r$   r,      s   
r,   c                   @   sL   e Zd ZdZh dZdZedd Zedd Zedd	 Z	ed
d Z
dS )OpenSSHServerGeneratorZopensshserver>   r.   r-   zopenssh-serverz4systemctl try-restart sshd.service 2>/dev/null || :
c                 C   s   | j || j| jddS )NTr/   )r%   r)   r*   )r   r   r#   r#   r$   r1     s    z&OpenSSHServerGenerator.generate_configc                 C   sh   t  \}}t| d}ztjd| ddd}W n tjyP   | d Y n0 |rd| d dS |S )	Nr7   z&/usr/bin/ssh-keygen -t rsa -b 3072 -f z -N "" >/dev/nullTr9   z%/usr/bin/ssh-keygen: Execution failedz4SSH Keygen failed when testing OpenSSH server policyr   )r   r=   rI   rE   rF   rG   rH   )r   Z_fdrL   rM   r#   r#   r$   _test_setup  s    



z"OpenSSHServerGenerator._test_setupc                 C   s   |rt | d S N)r=   rI   )r   rL   r#   r#   r$   _test_cleanup%  s    z$OpenSSHServerGenerator._test_cleanupc              	   C   s4  t ddkrdS t dt js$dS t ddkrHtt  dd|}|  }|sXdS t \}}d	}zt 	|d
}|
| W d    n1 s0    Y  z tjd| d| ddd}W n tjy   | d Y n0 W t | | | nt | | | 0 |r0| d | d|  dS dS )Nr2   r3   Tz/usr/sbin/sshdr5   r6   r   Fr7   r8   z/usr/sbin/sshd -T -h z -f z >/dev/nullr9   z /usr/sbin/sshd: Execution failedr;   r<   )r=   r>   r?   r@   rA   rB   r   rS   r   rC   rD   rE   rF   rG   rH   rI   rU   )r   rJ   Zhost_key_filenamerK   rL   rM   rN   r#   r#   r$   rO   *  sB    
(



z"OpenSSHServerGenerator.test_configN)r&   r'   r(   rP   rQ   Z
RELOAD_CMDr+   r1   rS   rU   rO   r#   r#   r#   r$   rR     s   


rR   c               	   C   sf   zHt jddgdt jdj } td| }|rFtdd | D W S W n t	t
fy`   Y d S 0 d S )Nr4   z-VF)checkstderrzOpenSSH_(\d+).(\d+)p.*c                 s   s   | ]}t |V  qd S rT   )int).0nr#   r#   r$   	<genexpr>V      z#_openssh_version.<locals>.<genexpr>)rE   runPIPErW   decoderA   matchtuplegroupsFileNotFoundErrorPermissionError)Zssh_versionZverr#   r#   r$   _openssh_versionP  s    re   c                  C   sB   d} t d| }|dkrd S |dkr>t }|r:|dkr:dS d S |S )Nz#RequiredRSASizeZOPENSSH_MIN_RSA_SIZEZnoneauto)	   r   ZRequiredRSASize)r=   r>   re   )ZMIN_RSA_DEFAULTZmin_rsa_size_forceZopenssh_versionr#   r#   r$   r   \  s    r   )r=   rA   rE   Ztempfiler   Zconfiggeneratorr   r   r,   rR   re   r   r#   r#   r#   r$   <module>   s    P+H