Sindbad~EG File Manager
3
."�dCB � @ s6 d dl Z d dlZd dlZd dlZd dlZd dlZddlmZ ddlmZ dd� d<D �Z dZ
d=Z d d hdddhdddhd d hddd hdddhdddhdddhdddhdddhd!�
Z G d"d#� d#�Z
G d$d%� d%ej�Zd&d'� Ze jd(d>�Zd-d.� Zd?d0d1�ZG d2d3� d3e�Zd4d5� ZG d6d7� d7�Zd8d9� ZG d:d;� d;�ZdS )@� N� )� alg_lists)�
validationc C s i | ]
}d |�qS )r � )�.0�kr r �C./usr/share/crypto-policies/python/cryptopolicies/cryptopolicies.py�
<dictcomp> s r �arbitrary_dh_groups� min_dh_size� min_dsa_size� min_rsa_size�
sha1_in_certs� ssh_certs�ssh_etm�*�tls�ssl�openssl�nss�gnutls�java-tls�ssh�openssh�openssh-server�openssh-client�libssh�ipsec�ike� libreswan�kerberos�krb5�dnssec�bind)
r# r zjava-tlsr! r r r zopenssh-clientzopenssh-serverr c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )�
ScopeSelectorc C s� |j � | _}|jd� | _| jr&|n
|dd� }tjj|| jd� tjj|| jd� |jd�rr|dd� jd�n|g| _ tjj
| j t | jd� dS )a=
Initialize a scope selector.
An example would be `ssh` in `ciphers@ssh = -NULL`.
When openssh backend will request the configuration,
it'll offer (`{'ssh', 'openssh'}`) as scopes
and the rule above will be taken into account.
Both patterns and scopes are cast to lowercase.
For more examples, refer to tests/unit/parsing/test_scope_selector.py
>>> ss = ScopeSelector('!{SSH,IPsec}')
>>> ss.matches({'ipsec', 'libreswan'})
False
>>> ss.matches({'tls', 'openssl'})
True
�!r N)Zoriginal_pattern�{�,���) �lower�pattern�
startswith� _positiver �scopeZillegal_charactersZcurly_brackets�split�_globsZresulting_globs�
ALL_SCOPES)�selfr* �pr r r �__init__5 s $ zScopeSelector.__init__c C s dt | j�� d�S )Nz<ScopeSelector pattern=�>)�reprr* )r1 r r r �__str__P s zScopeSelector.__str__c sh | j tkrdS dd� � D �� tdd� � D ��s2t�| jrPt� fdd�| jD ��S t� fdd�| jD ��S )aE
Checks whether ScopeSelector matches one of the scopes.
For more examples, refer to tests/unit/parsing/test_scope_selector.py
>>> ScopeSelector('{SSH,IPsec}').matches({'ipsec', 'libreswan'})
True
>>> ScopeSelector('!{SSH,IPsec}').matches({'ipsec', 'libreswan'})
False
Tc S s g | ] }|j � �qS r )r) )r �sr r r �
<listcomp>^ s z)ScopeSelector.matches.<locals>.<listcomp>c s s | ]}|t kV qd S )N)r0 )r r7 r r r � <genexpr>_ s z(ScopeSelector.matches.<locals>.<genexpr>c 3 s | ]}t j� |�V qd S )N)�fnmatch�filter)r �g)�scopesr r r9 a s c 3 s | ]}t j� |� V qd S )N)r: r; )r r< )r= r r r9 b s )r* � SCOPE_ANY�all�AssertionErrorr, �anyr/ )r1 r= r )r= r �matchesS s
zScopeSelector.matchesN)�__name__�
__module__� __qualname__r> r3 r6 rB r r r r r$ 4 s r$ c @ s$ e Zd ZdZdZdZdZdZdZdS )� OperationzM
An operation that comes with the right-hand value of the directive.
r � � � � N) rC rD rE �__doc__�RESET�PREPEND�APPEND�OMIT�SET_INTr r r r rF g s rF c s� dd� � | j � rf�tjkr2�tkr2tjt| �fgS �tjkrJtjj ���qz�tjksXt
��tkszt
�n�tkrztjj ���| j � }t
� fdd�|D ��s�t�fdd�|D �g �}tjdfgdd� |D � S t� fd d�|D ���r�g }x�|D ]�}|jd
��r"tj�tj|d d� ��ddd� }n\|jd
��rTtj�tj|dd� ��ddd� }n*|jd ��sdt
�tj�tj|d d� ��}|j�fd
d�|D �� q�W |S tjj| ��dS )a7
Parses right-hand parts of the directives
into lists of operation/value pairs.
For more examples, refer to tests/unit/test_parsing.py
>>> parse_rhs('', 'cipher')
[(<Operation.RESET: 1>, None)]
>>> parse_rhs('IDEA-CBC SEED-CBC', 'cipher')
[(<Operation.RESET: 1>, None),
(<Operation.APPEND: 3>, 'IDEA-CBC'),
(<Operation.APPEND: 3>, 'SEED-CBC')]
>>> # 3DES-CBC gets prepended last for higher prio
>>> parse_rhs('+*DES-CBC', 'cipher')
[(<Operation.PREPEND: 2>, 'DES-CBC'),
(<Operation.PREPEND: 2>, '3DES-CBC')]
c S s | j d�p | jd�p | j d�S )N�+�-)r+ �endswith)�vr r r � differential� s z parse_rhs.<locals>.differentialc 3 s | ]}� |�V qd S )Nr )r rT )rU r r r9 � s z parse_rhs.<locals>.<genexpr>c s g | ]}t j|� ��qS r )r �glob)r rT )� prop_namer r r8 � s z parse_rhs.<locals>.<listcomp>Nc S s g | ]}t j|f�qS r )rF rN )r rT r r r r8 � s c 3 s | ]}� |�V qd S )Nr )r rT )rU r r r9 � s rQ r rR c s g | ] }� |f�qS r r )r rT )�opr r r8 � s r( r( r( )�isdigitr �ALL� INT_DEFAULTSrF rP �intr �rulesZNonIntPropertyIntValueErrorr@ ZIntPropertyNonIntValueErrorr. rA �sumrL r? r+ rM rV rS rN rO �extendZ%MixedDifferentialNonDifferentialError)�rhsrW �valuesZ
operations�valueZunglobr )rU rX rW r � parse_rhsr s<
rc � DirectiverW r- � operationrb c s� | j � s g S tjj| � | jd�\}}|j � |j � }}tjj|| � d|krZ|jdd�n|tf\� �� �fdd�t|� �D �S )ae
Parses configuration lines into tuples of directives.
For more examples, refer to tests/unit/test_parsing.py
>>> parse_line('cipher@TLS = RC4* NULL')
[Directive(prop_name='cipher', scope='tls',
operation=<Operation.RESET: 1>, value=None),
Directive(prop_name='cipher', scope='tls',
operation=<Operation.APPEND: 3>, value='RC4-40'),
Directive(prop_name='cipher', scope='tls',
operation=<Operation.APPEND: 3>, value='RC4-128'),
Directive(prop_name='cipher', scope='tls',
operation=<Operation.APPEND: 3>, value='NULL')]
�=�@r c s$ g | ] \}}t � �j� ||d ��qS ))rW r- re rb )rd r) )r re rb )rW r- r r r8 � s z parse_line.<locals>.<listcomp>)�stripr r] Zcount_equals_signsr. Z empty_lhsr> rc )�lineZlhsr` r )rW r- r �
parse_line� s rj Fc C s^ y$t | �}x|D ]}t|j� qW W n4 tjk
rX } z|s>� tj|� W Y d d }~X nX d S )N)rj r$ r- r ZPolicySyntaxError�warnings�warn)ri rl �l�d�exr r r �syntax_check_line� s
rp c s e Zd Z� fdd�Z� ZS )� PolicySyntaxDeprecationWarningc s@ |j dd�}d|� d�}|d|� d�7 }|d7 }t� j|� d S )N�
z and zoption z is deprecatedz", please rewrite your rules using z; z2be advised that it is not always a 1-1 replacement)�replace�superr3 )r1 Z
deprecatedZ replacement�msg)� __class__r r r3 � s
z'PolicySyntaxDeprecationWarning.__init__)rC rD rE r3 �
__classcell__r r )rv r rq � s rq c C s� t jdd| �} | jdd�} djdd� | jd�D ��} | jdd�} djd d� | jd�D ��} djd
d� | jd�D ��} t jd d| �j� } t jd | �r�tjt d
d�� ddddd�}xr|j
� D ]f\}}d| d }t j|| �}|r�tjt ||�� t j|d| �} x"|D ]}| d|� d|� �7 } �qW q�W t jd d| �j� } ddd�}xN|j
� D ]B\}}d| d }t j || ��r|tjt ||�� t j||| �} �qJW t t
jddd%� �}xZ|�r�d jd d� |dd&� D ��} t jd |d' d | �r�d | � �nd| �} |j� �q�W t jd!d| �} t t
jddd(� �}
xZ|
�r|d jd"d� |
dd)� D ��} t jd#|
d* d | �rhd | � �nd| �} |
j� �q$W t jd$d| �} | S )+a
Preprocesses text before parsing.
Fixes line breaks, handles backwards compatibility.
>>> preprocess_text('cipher = c1 \\ \nc2#x')
'cipher = c1 c2'
>>> with warnings.catch_warnings():
... warnings.simplefilter("ignore")
... preprocess_text('ike_protocol = IKEv2')
'protocol@IKE = IKEv2'
>>> with warnings.catch_warnings():
... warnings.simplefilter("ignore")
... preprocess_text('min_tls_version=TLS1.3')
'protocol@TLS = -SSL2.0 -SSL3.0 -TLS1.0 -TLS1.1 -TLS1.2'
z#.*� rf z = rr c s s | ]}|j � V qd S )N)rh )r rm r r r r9 � s z"preprocess_text.<locals>.<genexpr>z\
c s s | ]}|j � V qd S )N)rh )r rm r r r r9 � s c s s | ]}t jd d|�V qdS )z\s+� N)�re�sub)r rm r r r r9 � s z
+z\bprotocol\s*=�protocolz protocol@TLSz
cipher@TLSz
cipher@SSHz group@SSHz protocol@IKE)Z
tls_cipherZ
ssh_cipherZ ssh_groupZ ike_protocolz\bz\s*=(.*)z
z =z7hash@DNSSec = -SHA1
sign@DNSSec = -RSA-SHA1 -ECDSA-SHA1z7hash@DNSSec = SHA1+
sign@DNSSec = RSA-SHA1+ ECDSA-SHA1+)zsha1_in_dnssec = 0zsha1_in_dnssec = 1Nr ry c s s | ]}d | V qdS )rR Nr )r rT r r r r9 s z\bmin_dtls_version = zprotocol@TLS = z\bmin_dtls_version = 0\bc s s | ]}d | V qdS )rR Nr )r rT r r r r9 $ s z\bmin_tls_version = z\bmin_tls_version = 0\br( r( r( r( r( r( )rz r{ rs �joinr. rh �findallrk rl rq �items�search�listr ZDTLS_PROTOCOLS�popZ
TLS_PROTOCOLS) �textZPOSTFIX_REPLACEMENTS�frZtoZregexZms�mZPLAIN_REPLACEMENTSZ
dtls_versions�negZ tls_versionsr r r �preprocess_text� sZ
r� c @ sJ e Zd ZdZd
dd�Zedd� �Zedd� �Zed d
� �Zed d � �Z dS )� ScopedPolicya�
An entity constructing lists of what's `.enabled` and what's `.disabled`
when the given scopes are active.
>>> sp = ScopedPolicy(parse_line('cipher@TLS = RC4* NULL'), {'tls'})
>>> 'AES-256-GCM' in sp.disabled['cipher']
True
>>> sp.enabled['cipher']
['RC4-40', 'RC4-128', 'NULL']
>>> ScopedPolicy(parse_line('min_dh_size=2048')).integers['min_dh_size']
2048
Nc sX |pt � }tj� �_dd� tjD ��_x�|D ]� t� j�}|j |�r,� j
t j kr^g �j� j
< q,� j
t jkr��j� j
}� j|kr�|j� j� q,� j
t jkr̈j� j
}� j|kr�|j� j� |jd� j� q,� j
t jkr�� fdd��j� j
D ��j� j
< q,� j
t jk�st�� j�j� j
< q,W t�j�tt �j��k�s>t��fdd�tjD ��_d S )Nc S s i | ]
}g |�qS r r )r rW r r r r > s z)ScopedPolicy.__init__.<locals>.<dictcomp>r c s g | ]}|� j kr|�qS r )rb )r �e)� directiver r r8 R s z)ScopedPolicy.__init__.<locals>.<listcomp>c s( i | ] � � �fd d�t j� D �� �qS )c s g | ]}|�j � kr|�qS r )�enabled)r r� )rW r1 r r r8 Z s z4ScopedPolicy.__init__.<locals>.<dictcomp>.<listcomp>)r rZ )r )r1 )rW r r Z s )�setr[ �copy�integersr rZ r� r$ r- rB re rF rL rW rN rb �appendrM �remove�insertrO rP r@ �lenZdisabled)r1 �
directivesZrelevant_scopesZssr� r )r� r1 r r3 ; s0
$
zScopedPolicy.__init__c C s t j| jd �S )Nr| )r �min_tls_versionr� )r1 r r r r� ^ s z ScopedPolicy.min_tls_versionc C s t j| jd �S )Nr| )r �max_tls_versionr� )r1 r r r r� b s z ScopedPolicy.max_tls_versionc C s t j| jd �S )Nr| )r �min_dtls_versionr� )r1 r r r r� f s z ScopedPolicy.min_dtls_versionc C s t j| jd �S )Nr| )r �max_dtls_versionr� )r1 r r r r� j s z ScopedPolicy.max_dtls_version)N)
rC rD rE rK r3 �propertyr� r� r� r� r r r r r� / s
# r� c C s@ x,|D ]$}t jj||�}t j|t j�r|S qW tj| ||��d S )N)�os�pathr} �access�R_OKr ZPolicyFileNotFoundError)�
policyname�fname�pathsrn r2 r r r � lookup_fileq s
r� c @ sF e Zd ZdZdZdd�dd�Zdd� Zdd d
�Zdd d
�Zdd� Z dS )�UnscopedCryptoPolicyz/etc/crypto-policiesz/usr/share/crypto-policiesN)� policydirc G sR || _ dj|f| �| _g | _| j|�}x |D ]}|| j|dd�7 }q.W || _d S )N�:T)� subpolicy)r� r} r� �lines�read_policy_file� _directives)r1 Z policy_namer� Zsubpolicy_namesr� Zsubpolicy_namer r r r3 � s
z UnscopedCryptoPolicy.__init__c C s | j S )N)r� )r1 r r r �is_empty� s z UnscopedCryptoPolicy.is_emptyc C s t | j|p i �S )N)r� r� )r1 r= r r r �scoped� s zUnscopedCryptoPolicy.scopedFc C s� | j pd}|r tjj|d�}t|||s*dnd tjj|tjj| j|�tjj| j|�f�}t|��}|j � }W d Q R X t
|�}|j d�}x|D ]}t |dd� q�W x|D ] }t |� q�W t
dd � |D �g �S )
NZpolicies�modulesz.polz.pmodrr T)rl c S s g | ] }t |��qS r )rj )r rm r r r r8 � s z9UnscopedCryptoPolicy.read_policy_file.<locals>.<listcomp>)r� r� r� r} r� �curdir�
CONFIG_DIR� SHARE_DIR�open�readr� r. rp r^ ) r1 �namer� Zpdirr2 �fr� r� rm r r r r� � s$
z%UnscopedCryptoPolicy.read_policy_filec C s dd� }| j � }d| j� d�}|d7 }|d7 }|d7 }|d7 }|d7 }|j|j�}x"|j� D ]\}}||||�7 }q\W d }xvtj� D ]j\}} | j | d
�}
|
j|
j�} xH| j� D ]<\}}||| kr�|s�|d 7 }d }|||� d
|� �|�7 }q�W q�W |�s |d7 }|S )Nc S s2 t |t�rdj|�nt|�}| � d|� �j� d S )Nry z = rr )�
isinstancer� r} �str�rstrip)�keyrb r7 r r r �fmt� s z)UnscopedCryptoPolicy.__str__.<locals>.fmtz # Policy z dump
z#
z?# Do not parse the contents of this file with automated tools,
z.# it is provided for review convenience only.
z"# Baseline values for all scopes:
F)r= z9# Scope-specific properties derived for select backends:
Trg z&# No scope-specific properties found.
)r� r� r� r� r �DUMPABLE_SCOPES) r1 r� Zgeneric_scopedr7 Z generic_allrW rb Zanything_scope_specificZ
scope_nameZ scope_setZspecific_scopedZ specific_allr r r r6 � s2 z UnscopedCryptoPolicy.__str__)N)F)
rC rD rE r� r� r3 r� r� r� r6 r r r r r� { s
r� )r
r r r
r r r )r r r r r r r r r r r r r r r r! r" r# )rW r- re rb )F)� collections�enumr: r� rz rk rx r r r[ r> r0 r� r$ �EnumrF rc �
namedtuplerd rj rp �
FutureWarningrq r� r� r� r� r r r r �<module> sP 3 ;
LB
Sindbad File Manager Version 1.0, Coded By Sindbad EG ~ The Terrorists