a
    if"                     @   sX   d dl mZmZ ddlmZ dZdZG dd deZG dd	 d	eZG d
d deZ	dS )    )CalledProcessErrorcheck_output   )ConfigGeneratorz^
[openssl_init]
alg_section = evp_properties

[evp_properties]
rh-allow-sha1-signatures = yes
z2
[fips_sect]
tls1-prf-ems-check = {}
activate = 1
c                   @   s   e Zd ZdZh dZddddddddd	d
dddddddZdddddddddd	Zddddddddddd d!Zd"d#d$Zd%d&d'd(d)d*d+d,Z	e
d-d. Ze
d/d0 Ze
d1d2 Ze
d3d4 Zd5S )6OpenSSLGeneratoropenssl   r   ZsslZtls z-AES256z-AES128z-SHA256z	-CHACHA20z-SEEDz!IDEAz!DESz-3DESz!RC4z!RC2z!eNULL:!aNULL)zAES-256-CTRzAES-128-CTRAES-256-GCMAES-128-GCMzAES-256-CBCzAES-128-CBCCHACHA20-POLY1305zSEED-CBCzIDEA-CBCzDES-CBCzRC4-40z	DES40-CBCz3DES-CBCzRC4-128zRC2-CBCZNULLZkRSAZkEECDHZkPSKZkDHEPSKZkEDHZ	kECDHEPSKZkRSAPSKZkGOST)	RSAECDHEPSKDHE-PSKDHE-RSADHE-DSS	ECDHE-PSKRSA-PSKzVKO-GOST-2012z-kRSAz-kEECDHz-aRSAz-aDSSz-kPSKz-kDHEPSKz
-kECDHEPSKz-kRSAPSK)ZANONZDHZECDHr   r   r   r   r   r   r   r   z!MD5z-SHA1)zHMAC-MD5z	HMAC-SHA1ZTLS_AES_256_GCM_SHA384ZTLS_AES_128_GCM_SHA256ZTLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_CCM_SHA256ZTLS_AES_128_CCM_8_SHA256zGOST2012-GOST8912-GOST8912zGOST2001-GOST89-GOST89)r
   r   r   AES-128-CCMzAES-128-CCM8zGOST28147-TC26Z-CNTzGOST28147-CPA-CNTc           	   	   C   s  d}|j }|j}|jd }|jd }|dk s4|dk rB| |d}nH|dk sR|dk r`| |d}n*|dk sp|dk r~| |d	}n| |d
}|d D ].}z| || j| }W q ty   Y q0 q|d D ].}z| || j| }W q ty   Y q0 q|d D ]2}z| || j| }W n ty0   Y n0 qd|d v r^d|d v r^| |d}|d D ]2}z| || j| }W n ty   Y n0 qfdD ]}| ||}q|S )Nr	   min_dh_sizemin_rsa_sizei  z@SECLEVEL=0i   z@SECLEVEL=1i   z@SECLEVEL=2z@SECLEVEL=3Zkey_exchangecipherr   zAES-256-CCMz-AESCCMZmac)z-SHA384z	-CAMELLIAz-ARIAz-AESCCM8)	enabledZdisabledZintegersappendkey_exchange_mapKeyErrorkey_exchange_not_mapcipher_not_mapmac_not_map)	clspolicyspZipr   r   ic r&   =/usr/share/crypto-policies/python/policygenerators/openssl.pygenerate_ciphersY   sL    



z!OpenSSLGenerator.generate_ciphersc              	   C   sF   d}|j }|d D ].}z| || j| }W q ty>   Y q0 q|S )Nr	   r   )r   r   ciphersuite_mapr   )r    r!   r"   r#   r$   r&   r&   r'   generate_ciphersuites   s    z&OpenSSLGenerator.generate_ciphersuitesc                 C   s   |  |d S )N
)r(   r    r!   r&   r&   r'   generate_config   s    z OpenSSLGenerator.generate_configc                 C   s   d}| dsJ ztdd|d d g}W n@ tyZ   | d | d|  Y dS  tyl   Y d	S 0 d
|v s~d|v r| d | d|  dS d	S )N    r+   r   Zciphersz-There is an error in openssl generated policyzPolicy:
FTs   NULLs   ADHz0There is NULL or ADH in openssl generated policy)endswithr   r   ZeprintOSError)r    configoutputr&   r&   r'   test_config   s"    


zOpenSSLGenerator.test_configN)__name__
__module____qualname__CONFIG_NAMESCOPESr   r   r   r   r)   classmethodr(   r*   r-   r4   r&   r&   r&   r'   r      sx   

3

r   c                   @   s   e Zd ZdZdddddddd	d
Zdddddddddddddddddddddd d!d"Zd#d$d%d&d'd(d)d*d+d,d-d.d/d0d1Zed2d3 Zed4d5 Z	d6S )7OpenSSLConfigGeneratorZ
opensslcnfZSSLv3ZTLSv1zTLSv1.1zTLSv1.2zTLSv1.3zDTLSv0.9ZDTLSv1zDTLSv1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2zTLS1.3zDTLS0.9zDTLS1.0zDTLS1.2zRSA+SHA1zDSA+SHA1z
ECDSA+SHA1z
RSA+SHA224z
DSA+SHA224zECDSA+SHA224z
RSA+SHA256z
DSA+SHA256zECDSA+SHA256z
RSA+SHA384z
DSA+SHA384zECDSA+SHA384z
RSA+SHA512z
DSA+SHA512zECDSA+SHA512Zrsa_pss_pss_sha256Zrsa_pss_pss_sha384Zrsa_pss_pss_sha512Zrsa_pss_rsae_sha256Zrsa_pss_rsae_sha384Zrsa_pss_rsae_sha512Zed25519Zed448)zRSA-SHA1zDSA-SHA1z
ECDSA-SHA1zRSA-SHA2-224zDSA-SHA2-224zECDSA-SHA2-224zRSA-SHA2-256zDSA-SHA2-256zECDSA-SHA2-256zRSA-SHA2-384zDSA-SHA2-384zECDSA-SHA2-384zRSA-SHA2-512zDSA-SHA2-512zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512zEDDSA-ED25519zEDDSA-ED448Z	secp224r1Z	secp256r1Z	secp384r1Z	secp521r1X25519X448Z	ffdhe2048Z	ffdhe3072Z	ffdhe4096Z	ffdhe6144Z	ffdhe8192ZbrainpoolP256r1ZbrainpoolP384r1ZbrainpoolP512r1)Z	SECP224R1Z	SECP256R1Z	SECP384R1Z	SECP521R1r<   r=   z
FFDHE-2048z
FFDHE-3072z
FFDHE-4096z
FFDHE-6144z
FFDHE-8192zBRAINPOOL-P256R1zBRAINPOOL-P384R1zBRAINPOOL-P512R1c                    sP  |j }d | d}|d | d7 }|jrT|d7 }|d j|j  d7 }|jrz|d7 }|d j|j  d7 }|jr|d7 }|d j|j  d7 }|jr|d7 }|d j|j  d7 } fd	d
|d D }|dd| d 7 } fdd
|d D }|dd| d 7 }|j	d dkr6|d7 }d|d v rL|t
7 }|S )NzCipherString = r+   zCiphersuites = zTLS.MinProtocol = zTLS.MaxProtocol =zDTLS.MinProtocol =zDTLS.MaxProtocol =c                    s    g | ]}| j v r j | qS r&   )sign_map.0r$   r    r&   r'   
<listcomp>   r.   z:OpenSSLConfigGenerator.generate_config.<locals>.<listcomp>signzSignatureAlgorithms = :c                    s    g | ]}| j v r j | qS r&   )	group_mapr@   rB   r&   r'   rC     r.   groupz	Groups = __emsRELAXzOptions = RHNoEnforceEMSinFIPS
ZSHA1hash)r   r(   r*   Zmin_tls_versionprotocol_mapZmax_tls_versionZmin_dtls_versionZmax_dtls_versionjoinenumsRH_ALLOW_SHA1)r    r!   r#   r"   Zsig_algsgroupsr&   rB   r'   r-      s0    z&OpenSSLConfigGenerator.generate_configc                 C   s   dS NTr&   r    r2   r&   r&   r'   r4     s    z"OpenSSLConfigGenerator.test_configN)
r5   r6   r7   r8   rK   r?   rF   r:   r-   r4   r&   r&   r&   r'   r;      sj   
!r;   c                   @   s0   e Zd ZdZh dZedd Zedd ZdS )OpenSSLFIPSGeneratorZopenssl_fipsr   c                 C   s   t t|jd dkS )NrH   rI   )FIPS_MODULE_CONFIGformatintrM   r,   r&   r&   r'   r-     s    z$OpenSSLFIPSGenerator.generate_configc                 C   s   dS rP   r&   rQ   r&   r&   r'   r4      s    z OpenSSLFIPSGenerator.test_configN)r5   r6   r7   r8   r9   r:   r-   r4   r&   r&   r&   r'   rR     s   
rR   N)

subprocessr   r   Zconfiggeneratorr   rN   rS   r   r;   rR   r&   r&   r&   r'   <module>   s    a