a
    if'                     @   sL   d dl Z d dlZd dlmZmZ d dlmZ ddlmZ G dd deZ	dS )    N)CalledProcessErrorcall)mkstemp   )ConfigGeneratorc                %   @   s|  e Zd ZdZh dZdddddddZdddd	d
dddddddddZddddddddddd
Zddd d!d"d#d$Zd%d&d'Z	d(gd)gd*gd+gd,gd-gd.gd/gd0gd1d2gd3gd4gd5d6gd7gd8gd9d:gd;gd<gd=gd>gd?gd@gdAgdBgdCgdDgdEgdFgdGgdHgdIgdJgdKgdLgdMgdNgdO$Z
dPdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^Zd_d`dadbdcZdddedfdgdhdidjdkdlZedmdn Zedodp ZdS )qGnuTLSGeneratorgnutls>   ZsslZtlsr   AEADSHA1MD5NZSHA512)r	   z	HMAC-SHA1zHMAC-MD5zHMAC-SHA2-256zHMAC-SHA2-384zHMAC-SHA2-512ZSHA224ZSHA256ZSHA384SHA3-224SHA3-256SHA3-384SHA3-512	SHAKE-128	SHAKE-256)r	   r
   r   zSHA2-224zSHA2-256zSHA2-384zSHA2-512r   r   r   r   r   r   z
GROUP-X448zGROUP-X25519zGROUP-SECP256R1zGROUP-SECP384R1zGROUP-SECP521R1zGROUP-FFDHE6144zGROUP-FFDHE2048zGROUP-FFDHE3072zGROUP-FFDHE4096zGROUP-FFDHE8192)
X448X25519	SECP256R1	SECP384R1	SECP521R1z
FFDHE-6144z
FFDHE-2048z
FFDHE-3072z
FFDHE-4096z
FFDHE-8192r   r   	SECP224R1r   r   r   )r   r   r   r   r   r   ZEd448ZEd25519)EDDSA-ED448EDDSA-ED25519RSA-MD5RSA-SHA1DSA-SHA1
ECDSA-SHA1z
RSA-SHA224z
DSA-SHA224zECDSA-SHA224z
RSA-SHA256z
DSA-SHA256zECDSA-SHA256zECDSA-SECP256R1-SHA256z
RSA-SHA384z
DSA-SHA384zECDSA-SHA384zECDSA-SECP384R1-SHA384z
RSA-SHA512z
DSA-SHA512zECDSA-SHA512zECDSA-SECP521R1-SHA512zRSA-PSS-SHA256zRSA-PSS-SHA384zRSA-PSS-SHA512zRSA-PSS-RSAE-SHA256zRSA-PSS-RSAE-SHA384zRSA-PSS-RSAE-SHA512RSA-SHA3-224DSA-SHA3-224ECDSA-SHA3-224RSA-SHA3-256DSA-SHA3-256ECDSA-SHA3-256RSA-SHA3-384DSA-SHA3-384ECDSA-SHA3-384RSA-SHA3-512DSA-SHA3-512ECDSA-SHA3-512zEdDSA-Ed448zEdDSA-Ed25519)$r   r   r   r   zRSA-SHA2-224zDSA-SHA2-224zECDSA-SHA2-224zRSA-SHA2-256zDSA-SHA2-256zECDSA-SHA2-256zRSA-SHA2-384zDSA-SHA2-384zECDSA-SHA2-384zRSA-SHA2-512zDSA-SHA2-512zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512r   r   r    r!   r"   r#   r$   r%   r&   r'   r(   r)   r   r    AES-256-GCMAES-128-GCMAES-256-CCMAES-128-CCMAES-256-CBCAES-128-CBCCAMELLIA-256-GCMCAMELLIA-128-GCMCAMELLIA-256-CBCCAMELLIA-128-CBCCHACHA20-POLY13053DES-CBCzARCFOUR-128)zAES-256-CTRzAES-128-CTRr+   r,   r-   r.   r/   r0   r1   r2   r3   r4   r5   r6   zRC4-128)z	ECDHE-RSAzECDHE-ECDSA)RSA)DHE-RSA)DHE-DSS)ZECDHEr7   r8   r9   SSL3.0TLS1.0TLS1.1TLS1.2TLS1.3DTLS0.9DTLS1.0DTLS1.2)r:   r;   r<   r=   r>   r?   r@   rA   c              	      s  |j }td }|d rj|d D ]D}z, j| rR|d7 }| j| 7 }|d7 }W q$ tyf   Y q$0 q$|d r|d D ]D}z, j| r|d7 }| j| 7 }|d7 }W qz ty   Y qz0 qz|d D ]$}| jv r|d j|  d7 }qȇ fd	d
|d D }|D ]"}|D ]}|d| d7 }qq|D ]"}|D ]}|d| d7 }q8q0|jd rx|d7 }|d7 }|d7 }|d D ](}| j	v r|d j	|  d7 }q|d D ](}| j
v r|d j
|  d7 }q|d r:|d D ]J}z. j| r|d7 }| j| 7 }|d7 }W n ty4   Y n0 q|d D ]4}| jv rB j| D ]}|d| d7 }q\qB|d D ](}| jv r|d j|  d7 }qtdddk}|s|jd dkr|d7 }n*|jd dkr|d 7 }n|jd d!kr|jd" }	|jd# }
|	d$ks,|
d$kr6|d%7 }n|	d&ksJ|
d&krT|d'7 }nb|	d(ksh|
d(krr|d)7 }nD|	d*ks|
d*kr|d+7 }n&|	d,ks|
d,kr|d-7 }n|d.7 }|d/7 }|S )0Nz]
            [global]
            override-mode = allowlist

            [overrides]
        hashzsecure-hash = 
Zmacztls-enabled-mac = groupztls-enabled-group = c                    s    g | ]}| j v r j | qS  )sign_map).0iclsrE   </usr/share/crypto-policies/python/policygenerators/gnutls.py
<listcomp>       z3GnuTLSGenerator.generate_config.<locals>.<listcomp>signzsecure-sig = zsecure-sig-for-cert = Zsha1_in_certszsecure-sig-for-cert = rsa-sha1
zsecure-sig-for-cert = dsa-sha1
z!secure-sig-for-cert = ecdsa-sha1
zenabled-curve = Zcipherztls-enabled-cipher = Zkey_exchangeztls-enabled-kx = Zprotocolzenabled-version = ZGNUTLS_NO_TLS_SESSION_HASH01Z__emsZENFORCEztls-session-hash = require
ZRELAXztls-session-hash = request
ZDEFAULTmin_dh_sizemin_rsa_sizei   z$min-verification-profile = very_weaki   zmin-verification-profile = lowi   z!min-verification-profile = mediumi   zmin-verification-profile = highi    z min-verification-profile = ultraz!min-verification-profile = futurez

[priorities]
SYSTEM=NONE
)Zenabledtextwrapdedentlstriphash_mapKeyErrormac_map	group_mapZintegersgroup_curve_mapsign_curve_map
cipher_mapkey_exchange_mapprotocol_maposgetenvZenums)rJ   ZpolicypsrH   ZsigsjZkxZno_tls_session_hashrQ   rR   rE   rI   rK   generate_config   s    













zGnuTLSGenerator.generate_configc              	   C   s(  t ddkrdS t dt js$dS t \}}d}zt |d}|| W d    n1 s`0    Y  z.|t jd< dt jd	< dt jd
< tddd}W n t	y   | 
d Y n0 W t jd= t jd	= t jd
= t | n$t jd= t jd	= t jd
= t | 0 |r$| 
d | 
d|  dS dS )NZ
OLD_GNUTLSrP   Tz/usr/bin/gnutls-cli   wZGNUTLS_SYSTEM_PRIORITY_FILE3ZGNUTLS_DEBUG_LEVELZ&GNUTLS_SYSTEM_PRIORITY_FAIL_ON_INVALIDz!/usr/bin/gnutls-cli -l >/dev/null)shellz%/usr/bin/gnutls-cli: Execution failedz,There is an error in gnutls generated policyzPolicy:
F)r_   r`   accessX_OKr   fdopenwriteenvironr   r   Zeprintunlink)rJ   ZconfigfdpathretfrE   rE   rK   test_config  s>    
(




zGnuTLSGenerator.test_config)__name__
__module____qualname__ZCONFIG_NAMEZSCOPESrX   rV   rY   rZ   r[   rF   r\   r]   r^   classmethodrd   rs   rE   rE   rE   rK   r      s   
,
ir   )
r_   rS   
subprocessr   r   Ztempfiler   Zconfiggeneratorr   r   rE   rE   rE   rK   <module>   s
   