shell bypass 403
a
�
�g� � @ sT d dl Z d dlZ d dlZd dlmZmZ d dlmZ ddlm Z G dd� de �Z
dS )� N)�CalledProcessError�call)�mkstemp� )�ConfigGeneratorc @ s� e Zd ZdZh d�Zddddddd �Zd
d d d
ddddddddd� Zdddddd�Zddddddddd d ddddd d d �Zddddd!d"d#d$d%d&d'�
Z d(d)d*d+d,d-d.d/�Z
d0d1d2d3d4�Z e d5d6� �Z
e d7d8� �Zd9S ):� NSSGenerator�nss> r ZsslZtls� � HMAC-SHA1�HMAC-MD5z HMAC-SHA256z HMAC-SHA384z HMAC-SHA512)ZAEADr
r z
HMAC-SHA2-256z
HMAC-SHA2-384z
HMAC-SHA2-512�SHA1�MD5ZSHA224ZSHA256ZSHA384ZSHA512) r r
zSHA2-224zSHA2-256zSHA2-384zSHA2-512zSHA3-256zSHA3-384zSHA3-512z SHAKE-128z SHAKE-256ZGOSTR94Z
CURVE25519� SECP256R1� SECP384R1� SECP521R1)ZX25519ZX448r r r Zrc2Zrc4z
aes256-gcmz
aes128-gcmz
aes256-cbcz
aes128-cbczcamellia256-cbczcamellia128-cbczchacha20-poly1305z des-ede3-cbc)z AES-256-CTRz AES-128-CTRzRC2-CBCzRC4-128z AES-256-GCMz AES-128-GCMz AES-256-CBCz AES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-128-CBCzCAMELLIA-256-GCMzCAMELLIA-128-GCMz AES-256-CCMz AES-128-CCMzCHACHA20-POLY1305z3DES-CBC�RSA�DHE-RSA�DHE-DSSzECDHE-RSA:ECDHE-ECDSAzECDH-RSA:ECDH-ECDSAz
DH-RSA:DH-DSS)
ZPSKzDHE-PSKz ECDHE-PSKzRSA-PSKr r r ZECDHEZECDHZDHzssl3.0ztls1.0ztls1.1ztls1.2ztls1.3zdtls1.0zdtls1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2zTLS1.3zDTLS1.0zDTLS1.2zRSA-PSSzRSA-PKCSZECDSAZDSA)zRSA-PSS-zRSA-zECDSA-zDSA-c C s� |j }d}|d7 }|d7 }|d7 }d}|d D ].}z| �|| j| �}W q. tyZ Y q.0 q.|d D ].}z| �|| j| �}W qf ty� Y qf0 qf|d D ].}z| �|| j| �}W q� ty� Y q�0 q�|d D ]0}z| �|| j| �}W q� t�y Y q�0 q�|d
D ]2}z| �|| j| �}W n t�y> Y n0 �qt� d d �d
k}|j
d dk�rv|�sv| �|d�}t � }|d D ]N}| j �
� D ]<\}} |�|��r�| |v�r�|�| � | �|| �} �q��q��q�|j�r�| j|j }
| �|d|
�}n | �|d�}|j�r,| j|j }
| �|d|
�}n | �|d�}| �|dt|jd � �}| �|dt|jd � �}| �|dt|jd � �}||d 7 }|S ) Nz library=
z name=Policy
z NSS=flags=policyOnly,moduleDB
zconfig="disallow=ALL allow=r Zmac�groupZcipher�hashZ key_exchangeZNSS_NO_TLS_REQUIRE_EMS�0�1Z__emsZENFORCEzTLS-REQUIRE-EMS�signztls-version-min=ztls-version-min=0zdtls-version-min=zdtls-version-min=0zDH-MIN=Z min_dh_sizezDSA-MIN=Z min_dsa_sizezRSA-MIN=Z min_rsa_sizez"
)Zenabled�append�mac_map�KeyError� curve_map�
cipher_map�hash_map�key_exchange_map�os�getenvZenums�set�sign_prefix_ordmap�items�
startswith�addZmin_tls_version� protocol_mapZmin_dtls_version�strZintegers) �clsZpolicy�pZcfg�s�iZno_tls_require_emsZenabled_sigalgs�prefixZsigalgZminver� r. �9/usr/share/crypto-policies/python/policygenerators/nss.py�generate_configf sn
z NSSGenerator.generate_configc C sV t j�d�}t �|�}t�dd�dk}d}z|�d�s:d}W n tyX | �d� Y n0 |rf|sfd nd
}t � \}}d } z�t�
|d ��}
|
� |� W d � n1 s�0 Y z t d
|� d|� d�dd�} W n t
y� | �d� Y n0 W t�|� n t�|� 0 | dk�r.| �d� | �d|� �� dS | �rR| �d� | �d|� �� dS dS )NZnss3ZNSS_LAXr r Ts 3.80Fz9Cannot determine nss version with ctypes, assuming >=3.80z-f value -f identifierr � �wz/usr/bin/nss-policy-check � z
>/dev/null)�shellz+/usr/bin/nss-policy-check: Execution failed� z*There is a warning in NSS generated policyzPolicy:
z)There is an error in NSS generated policy)�ctypes�utilZ find_libraryZCDLLr r! ZNSS_VersionCheck�AttributeErrorZeprintr �fdopen�writer r �unlink) r) ZconfigZnss_pathZnss_libZnss_laxZnss_is_lax_by_default�options�fd�path�ret�fr. r. r/ � test_config� sH
���
(�
zNSSGenerator.test_configN)�__name__�
__module__� __qualname__Z CONFIG_NAMEZSCOPESr r r r r r' r# � classmethodr0 rA r. r. r. r/ r s� �
�� ���
�
Gr ) r6 Z ctypes.utilr �
subprocessr r Ztempfiler Zconfiggeneratorr r r. r. r. r/ �<module> s