shell bypass 403
a
�
�gN* � @ sX d dl mZmZ ddlmZ dZdZG dd� de�ZG dd � d e�ZG d
d � d e�Z d S )
� )�CalledProcessError� check_output� )�ConfigGeneratorz^
[openssl_init]
alg_section = evp_properties
[evp_properties]
rh-allow-sha1-signatures = yes
z2
[fips_sect]
tls1-prf-ems-check = {}
activate = 1
c @ s> e Zd ZdZh d�Zddddddddd d
ddd d d
dd�Zh d�ddhddhd�Zdddddddd d d � Zdddd d d!d"d#d$d%d&d'� Zd(d)d*�Z dhd+hd,d-hd.�dhd/hd,d-hd.�d0hd/hd,d-hd.�dhd/hd,d-hd.�d1hd/hd/hd,d-hd2�d1hd+hd+hd,d-hd2�d3�Z
e d4d5� �Z e d6d7� �Z
e d8d9� �Ze d:d;� �Zd<S )=�OpenSSLGenerator�openssl� r ZsslZtls� z-AES256z-AES128z-SHA256z -CHACHA20z-SEEDz!IDEAz!DESz-3DESz!RC4z!RC2z
!eNULL:!aNULL)z AES-256-CTRz AES-128-CTR� AES-256-GCM� AES-128-GCM� AES-256-CBC� AES-128-CBC�CHACHA20-POLY1305�SEED-CBC�IDEA-CBC�DES-CBCzRC4-40z DES40-CBC�3DES-CBCzRC4-128�RC2-CBC�NULL> zCAMELLIA-128-CBCr zCAMELLIA-256-CBCr r r r r r
z AES-128-CCMz AES-256-CCMr r
)z-CBCz-AESCCMz-AESGCMZkRSAZkEECDHZkPSKZkDHEPSKZkEDHZ kECDHEPSKZkRSAPSKZkGOST) �RSA�ECDHE�PSK�DHE-PSK�DHE-RSA�DHE-DSS� ECDHE-PSK�RSA-PSKz
VKO-GOST-2012z-kRSAz-kEECDHz-aRSAz-aDSSz-kPSKz-kDHEPSKz
-kECDHEPSKz-kRSAPSK) ZANONZDHZECDHr r r r r r r r z!MD5z-SHA1)zHMAC-MD5z HMAC-SHA1zSHA2-384�TLS1.3zDTLS1.3)�cipher�hash�protocolzSHA2-256r r )r r �macr )ZTLS_AES_256_GCM_SHA384ZTLS_AES_128_GCM_SHA256Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_CCM_SHA256ZTLS_SHA256_SHA256ZTLS_SHA256_SHA384c
s� d}|j }|j� |jd }|jd }|dk s4|dk rB| �|d�}nH|dk sR|dk r`| �|d�}n*|dk sp|dk r~| �|d �}n | �|d
�}|d D ].}z| �|| j| �}W q� ty� Y q�0 q�� d D ].}z| �|| j| �}W q� ty� Y q�0 qʈ d D ]2}z| �|| j| �}W n t�y0 Y n0 �q| j� � D ].\}}t
� fd
d�|D ���r@| �||�}�q@� d D ]2}z| �|| j | �}W n t�y� Y n0 �qxdD ]} | �|| �}�q�|S )Nr � min_dh_size� min_rsa_sizei� z @SECLEVEL=0i z @SECLEVEL=1i z @SECLEVEL=2z @SECLEVEL=3Z key_exchanger c 3 s | ]}|� d v V qdS )r N� )�.0�c��ipr$ �=/usr/share/crypto-policies/python/policygenerators/openssl.py� <genexpr>� � z4OpenSSLGenerator.generate_ciphers.<locals>.<genexpr>r! )z-SHA384z -CAMELLIAz-ARIAz-AESCCM8) �enabledZdisabledZintegers�append�key_exchange_map�KeyError�key_exchange_not_map�cipher_not_map�cipher_notany_multimap�items�all� mac_not_map)
�cls�policy�s�pr" r# �i�keywordZ ciphersetr& r$ r' r) �generate_ciphers� sL
z!OpenSSLGenerator.generate_ciphersc sl d}|j ��d D ]T� � fdd�| j�� D �}|�� D ].\}}t�fdd�|�� D ��r6| �||�}q6q|S )Nr r c s$ i | ] \}}|d � hkr||�qS )r r$ )r% �name�spec)r& r$ r) �
<dictcomp>� s �z:OpenSSLGenerator.generate_ciphersuites.<locals>.<dictcomp>c 3 s, | ]$\}� t � fd d��| D ��V qdS )c 3 s | ]}|� v V qd S )Nr$ )r% �val�Z algvaluesr$ r) r* � r+ zCOpenSSLGenerator.generate_ciphersuites.<locals>.<genexpr>.<genexpr>N)�any)r% Zalgclass)r9 rA r) r* � s �z9OpenSSLGenerator.generate_ciphersuites.<locals>.<genexpr>)r, �ciphersuite_mapr3 r4 r- )r6 r7 r8 Z
cipher_submapZciphersuite_nameZciphersuite_specr$ )r& r9 r) �generate_ciphersuites� s
� �z&OpenSSLGenerator.generate_ciphersuitesc C s | � |�d S )N�
)r< �r6 r7 r$ r$ r) �generate_config� s z OpenSSLGenerator.generate_configc C s� d}|� d�sJ �ztdd|d d� g�}W n@ tyZ | �d� | �d|� �� Y dS tyl Y d S 0 d
|v s~d |v r�| �d � | �d|� �� dS d S )
Nr+ rE r Zciphers���z-There is an error in openssl generated policyzPolicy:
FTs NULLs ADHz0There is NULL or ADH in openssl generated policy)�endswithr r Zeprint�OSError)r6 �config�outputr$ r$ r) � test_config� s" �
z OpenSSLGenerator.test_configN)�__name__�
__module__� __qualname__� CONFIG_NAME�SCOPESr1 r2 r. r0 r5 rC � classmethodr< rD rG rM r$ r$ r$ r) r s� �� �
������ ���)
3
r c @ s� e Zd ZdZdddddddd d
�Zd d d
ddddddddddddddd d d d d d!d"�Zd#d$d%d&d'd(d)d*d+d,d-d.d/d0d1�Zed2d3� �Zed4d5� �Z d6S )7�OpenSSLConfigGeneratorZ
opensslcnfZSSLv3ZTLSv1zTLSv1.1zTLSv1.2zTLSv1.3zDTLSv0.9ZDTLSv1zDTLSv1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2r zDTLS0.9zDTLS1.0zDTLS1.2zRSA+SHA1zDSA+SHA1z
ECDSA+SHA1z
RSA+SHA224z
DSA+SHA224z ECDSA+SHA224z
RSA+SHA256z
DSA+SHA256z ECDSA+SHA256z
RSA+SHA384z
DSA+SHA384z ECDSA+SHA384z
RSA+SHA512z
DSA+SHA512z ECDSA+SHA512Zrsa_pss_pss_sha256Zrsa_pss_pss_sha384Zrsa_pss_pss_sha512Zrsa_pss_rsae_sha256Zrsa_pss_rsae_sha384Zrsa_pss_rsae_sha512Zed25519Zed448)zRSA-SHA1zDSA-SHA1z
ECDSA-SHA1z RSA-SHA2-224z DSA-SHA2-224zECDSA-SHA2-224z RSA-SHA2-256z DSA-SHA2-256zECDSA-SHA2-256z RSA-SHA2-384z DSA-SHA2-384zECDSA-SHA2-384z RSA-SHA2-512z DSA-SHA2-512zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512z
EDDSA-ED25519z EDDSA-ED448Z secp224r1Z secp256r1Z secp384r1Z secp521r1�X25519�X448Z ffdhe2048Z ffdhe3072Z ffdhe4096Z ffdhe6144Z ffdhe8192ZbrainpoolP256r1ZbrainpoolP384r1ZbrainpoolP512r1)Z SECP224R1Z SECP256R1Z SECP384R1Z SECP521R1rU rV z
FFDHE-2048z
FFDHE-3072z
FFDHE-4096z
FFDHE-6144z
FFDHE-8192zBRAINPOOL-P256R1zBRAINPOOL-P384R1zBRAINPOOL-P512R1c sP |j }d� �|�� d�}|d� �|�� d�7 }|jrT|d7 }|d� j|j � d�7 }|jrz|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }� fd d
�|d D �}|d d
�|� d 7 }� fdd
�|d D �}|dd
�|� d 7 }|j d dk�r6|d7 }d|d v �rL|t
7 }|S )NzCipherString = rE zCiphersuites = zTLS.MinProtocol =� zTLS.MaxProtocol =zDTLS.MinProtocol =zDTLS.MaxProtocol =c s g | ]}|� j v r� j | �qS r$ )�sign_map�r% r: �r6 r$ r) �
<listcomp>- r+ z:OpenSSLConfigGenerator.generate_config.<locals>.<listcomp>�signzSignatureAlgorithms = �:c s g | ]}|� j v r� j | �qS r$ )� group_maprY rZ r$ r) r[ 0 r+ �groupz Groups = �__ems�RELAXz Options = RHNoEnforceEMSinFIPS
ZSHA1r ) r, r< rD Zmin_tls_version� protocol_mapZmax_tls_versionZmin_dtls_versionZmax_dtls_version�join�enums�
RH_ALLOW_SHA1)r6 r7 r9 r8 Zsig_algs�groupsr$ rZ r) rG s0 z&OpenSSLConfigGenerator.generate_configc C s dS �NTr$ �r6 rK r$ r$ r) rM ; s z"OpenSSLConfigGenerator.test_configN)
rN rO rP rQ rb rX r^ rS rG rM r$ r$ r$ r) rT � sj � ��
!rT c @ s0 e Zd ZdZh d�Zedd� �Zedd� �ZdS )�OpenSSLFIPSGeneratorZ openssl_fipsr c C s t �t|jd dk��S )Nr` ra )�FIPS_MODULE_CONFIG�format�intrd rF r$ r$ r) rG D s z$OpenSSLFIPSGenerator.generate_configc C s dS rg r$ rh r$ r$ r) rM M s z OpenSSLFIPSGenerator.test_configN)rN rO rP rQ rR rS rG rM r$ r$ r$ r) ri @ s
ri N)
�
subprocessr r Zconfiggeneratorr re rj r rT ri r$ r$ r$ r) �<module> s Ga