| Server IP : 3.96.16.70 / Your IP : 216.73.216.15 Web Server : Apache System : Linux ip-172-31-26-103.ca-central-1.compute.internal 6.1.163-186.299.amzn2023.x86_64 #1 SMP PREEMPT_DYNAMIC Tue Feb 24 16:35:42 UTC 2026 x86_64 User : ec2-user ( 1000) PHP Version : 8.4.18 Disable Function : NONE MySQL : OFF | cURL : ON | WGET : ON | Perl : ON | Python : OFF | Sudo : ON | Pkexec : OFF Directory : /usr/share/crypto-policies/python/policygenerators/__pycache__/ |
Upload File : |
a
i�f�" � @ sX d dl mZmZ ddlmZ dZdZG dd� de�ZG dd � d e�ZG d
d � d e�Z d S )
� )�CalledProcessError� check_output� )�ConfigGeneratorz^
[openssl_init]
alg_section = evp_properties
[evp_properties]
rh-allow-sha1-signatures = yes
z2
[fips_sect]
tls1-prf-ems-check = {}
activate = 1
c @ s� e Zd ZdZh d�Zddddddddd d
ddd d d
dd�Zdddddddddd� Zddddddd d d d d d!� Zd"d#d$�Zd%d&d'd(d)d*d+d,�Z e
d-d.� �Z e
d/d0� �Z e
d1d2� �Z
e
d3d4� �Zd5S )6�OpenSSLGenerator�openssl� r ZsslZtls� z-AES256z-AES128z-SHA256z -CHACHA20z-SEEDz!IDEAz!DESz-3DESz!RC4z!RC2z
!eNULL:!aNULL)z AES-256-CTRz AES-128-CTR� AES-256-GCM� AES-128-GCMz AES-256-CBCz AES-128-CBC�CHACHA20-POLY1305zSEED-CBCzIDEA-CBCzDES-CBCzRC4-40z DES40-CBCz3DES-CBCzRC4-128zRC2-CBCZNULLZkRSAZkEECDHZkPSKZkDHEPSKZkEDHZ kECDHEPSKZkRSAPSKZkGOST) �RSA�ECDHE�PSK�DHE-PSK�DHE-RSA�DHE-DSS� ECDHE-PSK�RSA-PSKz
VKO-GOST-2012z-kRSAz-kEECDHz-aRSAz-aDSSz-kPSKz-kDHEPSKz
-kECDHEPSKz-kRSAPSK) ZANONZDHZECDHr
r r r r r r r z!MD5z-SHA1)zHMAC-MD5z HMAC-SHA1ZTLS_AES_256_GCM_SHA384ZTLS_AES_128_GCM_SHA256Z TLS_CHACHA20_POLY1305_SHA256ZTLS_AES_128_CCM_SHA256ZTLS_AES_128_CCM_8_SHA256zGOST2012-GOST8912-GOST8912zGOST2001-GOST89-GOST89)r
r r � AES-128-CCMz AES-128-CCM8zGOST28147-TC26Z-CNTzGOST28147-CPA-CNTc C s� d}|j }|j}|jd }|jd }|dk s4|dk rB| �|d�}nH|dk sR|dk r`| �|d�}n*|dk sp|dk r~| �|d �}n | �|d
�}|d D ].}z| �|| j| �}W q� ty� Y q�0 q�|d D ].}z| �|| j| �}W q� ty� Y q�0 q�|d D ]2}z| �|| j| �}W n t�y0 Y n0 �qd
|d v �r^d|d v �r^| �|d�}|d D ]2}z| �|| j| �}W n t�y� Y n0 �qfdD ]}| �||�}�q�|S )Nr � min_dh_size� min_rsa_sizei� z @SECLEVEL=0i z @SECLEVEL=1i z @SECLEVEL=2z @SECLEVEL=3Z key_exchange�cipherr z AES-256-CCMz-AESCCMZmac)z-SHA384z -CAMELLIAz-ARIAz-AESCCM8) �enabledZdisabledZintegers�append�key_exchange_map�KeyError�key_exchange_not_map�cipher_not_map� mac_not_map) �cls�policy�s�pZipr r �i�c� r& �=/usr/share/crypto-policies/python/policygenerators/openssl.py�generate_ciphersY sL
z!OpenSSLGenerator.generate_ciphersc C sF d}|j }|d D ].}z| �|| j| �}W q ty> Y q0 q|S )Nr r )r r �ciphersuite_mapr )r r! r" r# r$ r& r& r' �generate_ciphersuites� s z&OpenSSLGenerator.generate_ciphersuitesc C s | � |�d S )N�
)r( �r r! r& r& r' �generate_config� s z OpenSSLGenerator.generate_configc C s� d}|� d�sJ �ztdd|d d� g�}W n@ tyZ | �d� | �d|� �� Y dS tyl Y d S 0 d
|v s~d |v r�| �d � | �d|� �� dS d S )
N� r+ r Zciphers���z-There is an error in openssl generated policyzPolicy:
FTs NULLs ADHz0There is NULL or ADH in openssl generated policy)�endswithr r Zeprint�OSError)r �config�outputr& r& r' � test_config� s" �
z OpenSSLGenerator.test_configN)�__name__�
__module__� __qualname__� CONFIG_NAME�SCOPESr r r r r) � classmethodr( r* r- r4 r& r& r& r' r sx ��
���
3
r c @ s� e Zd ZdZdddddddd d
�Zd d d
ddddddddddddddd d d d d d!d"�Zd#d$d%d&d'd(d)d*d+d,d-d.d/d0d1�Zed2d3� �Zed4d5� �Z d6S )7�OpenSSLConfigGeneratorZ
opensslcnfZSSLv3ZTLSv1zTLSv1.1zTLSv1.2zTLSv1.3zDTLSv0.9ZDTLSv1zDTLSv1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2zTLS1.3zDTLS0.9zDTLS1.0zDTLS1.2zRSA+SHA1zDSA+SHA1z
ECDSA+SHA1z
RSA+SHA224z
DSA+SHA224z ECDSA+SHA224z
RSA+SHA256z
DSA+SHA256z ECDSA+SHA256z
RSA+SHA384z
DSA+SHA384z ECDSA+SHA384z
RSA+SHA512z
DSA+SHA512z ECDSA+SHA512Zrsa_pss_pss_sha256Zrsa_pss_pss_sha384Zrsa_pss_pss_sha512Zrsa_pss_rsae_sha256Zrsa_pss_rsae_sha384Zrsa_pss_rsae_sha512Zed25519Zed448)zRSA-SHA1zDSA-SHA1z
ECDSA-SHA1z RSA-SHA2-224z DSA-SHA2-224zECDSA-SHA2-224z RSA-SHA2-256z DSA-SHA2-256zECDSA-SHA2-256z RSA-SHA2-384z DSA-SHA2-384zECDSA-SHA2-384z RSA-SHA2-512z DSA-SHA2-512zECDSA-SHA2-512zRSA-PSS-SHA2-256zRSA-PSS-SHA2-384zRSA-PSS-SHA2-512zRSA-PSS-RSAE-SHA2-256zRSA-PSS-RSAE-SHA2-384zRSA-PSS-RSAE-SHA2-512z
EDDSA-ED25519z EDDSA-ED448Z secp224r1Z secp256r1Z secp384r1Z secp521r1�X25519�X448Z ffdhe2048Z ffdhe3072Z ffdhe4096Z ffdhe6144Z ffdhe8192ZbrainpoolP256r1ZbrainpoolP384r1ZbrainpoolP512r1)Z SECP224R1Z SECP256R1Z SECP384R1Z SECP521R1r< r= z
FFDHE-2048z
FFDHE-3072z
FFDHE-4096z
FFDHE-6144z
FFDHE-8192zBRAINPOOL-P256R1zBRAINPOOL-P384R1zBRAINPOOL-P512R1c sP |j }d� �|�� d�}|d� �|�� d�7 }|jrT|d7 }|d� j|j � d�7 }|jrz|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }|jr�|d7 }|d� j|j � d�7 }� fd d
�|d D �}|d d
�|� d 7 }� fdd
�|d D �}|dd
�|� d 7 }|j d dk�r6|d7 }d|d v �rL|t
7 }|S )NzCipherString = r+ zCiphersuites = zTLS.MinProtocol =� zTLS.MaxProtocol =zDTLS.MinProtocol =zDTLS.MaxProtocol =c s g | ]}|� j v r� j | �qS r& )�sign_map��.0r$ �r r& r' �
<listcomp> r. z:OpenSSLConfigGenerator.generate_config.<locals>.<listcomp>�signzSignatureAlgorithms = �:c s g | ]}|� j v r� j | �qS r& )� group_mapr@ rB r& r' rC r. �groupz Groups = �__ems�RELAXz Options = RHNoEnforceEMSinFIPS
ZSHA1�hash) r r( r* Zmin_tls_version� protocol_mapZmax_tls_versionZmin_dtls_versionZmax_dtls_version�join�enums�
RH_ALLOW_SHA1)r r! r# r" Zsig_algs�groupsr& rB r' r- � s0 z&OpenSSLConfigGenerator.generate_configc C s dS �NTr& �r r2 r& r& r' r4 s z"OpenSSLConfigGenerator.test_configN)
r5 r6 r7 r8 rK r? rF r: r- r4 r& r& r& r' r; � sj � ��
!r; c @ s0 e Zd ZdZh d�Zedd� �Zedd� �ZdS )�OpenSSLFIPSGeneratorZ openssl_fipsr c C s t �t|jd dk��S )NrH rI )�FIPS_MODULE_CONFIG�format�intrM r, r& r& r' r- s z$OpenSSLFIPSGenerator.generate_configc C s dS rP r& rQ r& r& r' r4 s z OpenSSLFIPSGenerator.test_configN)r5 r6 r7 r8 r9 r: r- r4 r& r& r& r' rR s
rR N)
�
subprocessr r Zconfiggeneratorr rN rS r r; rR r& r& r& r' �<module> s a