MOON
Server: Apache
System: Linux s5.yayogua.com.py 6.12.0-124.55.3.el10_1.x86_64 #1 SMP PREEMPT_DYNAMIC Thu May 7 16:54:02 EDT 2026 x86_64
User: sanbercountryclu (1012)
PHP: 8.2.32
Disabled: NONE
Upload Files
File: //usr/share/crypto-policies/python/policygenerators/__pycache__/nss.cpython-312.opt-1.pyc
�

��i�J��r�ddlZddlZddlZddlZddlZddlmZddlmZdZ	Gd�d�Z
Gd�d	e�Zy)
�N)�mkstemp�)�ConfigGeneratorz-
library=p11-kit-proxy.so
name=p11-kit-proxy
c�8�eZdZdZd�Zd�Zed��Zd�Zd�Z	y)�PurposeDeduplicatoraShorten the list of enabled algorithm/purpose pairs.

    For example, given a rule set of
    * ('pkcs12', 'pkcs12-legacy') -> 'pkcs12'
    * ('ssl', 'pkcs12') -> 'all'
    it'll shorten
      ('hmac-md5', 'pkcs12'), ('hmac-md5', 'pkcs12-legacy'), 'hmac-md5', 'ssl')
    to just 'hmac-md5'.
    The order of the first insertion is preserved.

    It was decided to be OK to merge all currently known purposes into '/all',
    even though in the future there could be more purposes added, since:
    1. the list of purposes doesn't change often, and then we should update c-p
    2. this will only result in overenablement for algorithms
       that the administrator already trusts for all currently known purposes,
       and it's likely that they trust it for the new purpose as well
    c�N�tjt�|_||_y�N)�collections�defaultdict�list�_alg_purpose_map�_rulemap)�self�rulemaps  �9/usr/share/crypto-policies/python/policygenerators/nss.py�__init__zPurposeDeduplicator.__init__Fs�� +� 7� 7�� =�����
�c�@�|j|j|�yr	)r
�append)r�alg�purposes   r�addzPurposeDeduplicator.addJs�����c�"�)�)�'�2rc���g}�D]P}d|vr�||vr�
||vxrt�fd�|D��}|r||vr�.|j|��@|j|��R|S)N�allc3�&�K�|]}|�v���
y�wr	�)�.0�p�purpose_lists  �r�	<genexpr>z?PurposeDeduplicator._deduplicate_single_rule.<locals>.<genexpr>Ws�����J�8I�1�Q�,�.�8I�s�)rr)r�purposes_separate�purpose_combined�new_purpose_listr�matchs`     r�_deduplicate_single_rulez,PurposeDeduplicator._deduplicate_single_ruleMs������#�G��(�(���*�*��� 1�1�K��J�8I�J�J�
��#�'7�7�� �'�'�(8�9� �'�'��0�$� �rc��d}||k7r=|jj�D]\}}|j|||�}�|}||k7r�=|Sr	)r�itemsr%)rr�prev_purpose_listr!r"s     r�_deduplicate_purpose_listz-PurposeDeduplicator._deduplicate_purpose_list`sd�� ���/�/�7;�}�}�7J�7J�7L�3�!�#3�#�<�<�\�=N�=M� O��8M�!-���/�/��rc��|jj�D��cic]\}}||j|���}}}d�|j�D�Scc}}w)Nc3�^K�|]%\}}|dgk7r|�ddj|���n|���'y�w)r�/�,N)�join)rr�purposess   rr z3PurposeDeduplicator.deduplicated.<locals>.<genexpr>os@����K�%I�M�C��2:�e�W�1D�3�%�q����(�+�,�-�#�M�%I�s�+-)r
r'r))rrr�deduplicated_alg_purpose_maps    r�deduplicatedz PurposeDeduplicator.deduplicatedjsk��&*�%:�%:�%@�%@�%B�(
�%B�!��\�
��/�/��=�=�%B�	%�(
�K�%A�%G�%G�%I�K�	K��	(
s�AN)
�__name__�
__module__�__qualname__�__doc__rr�staticmethodr%r)r1rrrrr3s0���$ �3�� �� �$�Krrc�V�eZdZdZdddddddd	d
dd�
Zd
dddddddddddddd�Zddddddd d!d"�Zid#d$�d%d&�d'd(�d)d*�d+d,�d-d.�d/d0�d1d2�d3d4�d5d6�d7d8�d9d:�d;d<�d=d>�d?d@�dAdB�dCdD�dEdFi�ZdGdHdIdJdKdLdM�ZdNdOdPdQ�Z	dRdSdTdUdVdWdXdY�Z
dZd[d\d]d^d_d`dadb�Zdddddddddddc�
Ze
dd��Ze
de��Zy)f�NSSGenerator�nss�	HMAC-SHA1�HMAC-MD5zHMAC-SHA224zHMAC-SHA256zHMAC-SHA384zHMAC-SHA512�
HMAC-SHA3-224�
HMAC-SHA3-256�
HMAC-SHA3-384�
HMAC-SHA3-512)
r:r;z
HMAC-SHA2-224z
HMAC-SHA2-256z
HMAC-SHA2-384z
HMAC-SHA2-512r<r=r>r?�MD2�MD4�MD5�SHA1�SHA224�SHA256�SHA384�SHA512�SHA3-224�SHA3-256�SHA3-384�SHA3-512N)r@rArBrCzSHA2-224zSHA2-256zSHA2-384zSHA2-512rHrIrJrKz	SHAKE-128z	SHAKE-256�
CURVE25519�	SECP256R1�	SECP384R1�	SECP521R1�mlkem768x25519�secp256r1mlkem768�secp384r1mlkem1024)�X25519�X448rMrNrOzMLKEM768-X25519z
P256-MLKEM768zP384-MLKEM1024zAES-256-GCM)z
aes256-gcmzAES-192-GCM)z
aes192-gcmzAES-128-GCM)z
aes128-gcmzAES-256-CBC)z
aes256-cbczAES-192-CBC)z
aes192-cbczAES-128-CBC)z
aes128-cbczCAMELLIA-256-CBC)zcamellia256-cbczCAMELLIA-192-CBC)zcamellia192-cbczCAMELLIA-128-CBC)zcamellia128-cbczCHACHA20-POLY1305)zchacha20-poly1305zSEED-CBC)zseed-cbcz3DES-CBC)zdes-ede3-cbcz	DES40-CBC)z
des-40-cbczDES-CBC)zdes-cbczRC4-128)�rc4zRC2-CBC)�rc2z
rc2-40-cbcz
rc2-64-cbczrc2-128-cbc�IDEA)�idea�NULLr)�RSA)�DHE-RSA)�DHE-DSS)z	ECDHE-RSAzECDHE-ECDSA)zECDH-RSAz
ECDH-ECDSA)zDH-RSAzDH-DSS)rZr[r\�ECDHE�ECDH�DH)�RSA-PKCSzRSA-OAEP)r^)r_)rZr^r_zssl3.0ztls1.0ztls1.1ztls1.2ztls1.3zdtls1.0zdtls1.2)zSSL3.0zTLS1.0zTLS1.1zTLS1.2zTLS1.3zDTLS1.0zDTLS1.2zRSA-PSSr`�ECDSA�DSA�ED25519z	ML-DSA-44z	ML-DSA-65z	ML-DSA-87)zRSA-PSS-zRSA-zECDSA-zDSA-z
EDDSA-ED25519�MLDSA44�MLDSA65�MLDSA87)
z-MD5z-SHA1z	-SHA2-224z	-SHA2-256z	-SHA2-384z	-SHA2-512z	-SHA3-224z	-SHA3-256z	-SHA3-384z	-SHA3-512c�\�|jhd��}|jhd��}|jhd��}|jhd��}|jhd��}tj�dz}|dz
}|dz
}|d	z
}|d
z
}g}tddd
��}	|jdD]2}
|j
j
|
�x}��!|	j|d��4|jdD]2}
|j
j
|
�x}��!|	j|d��4|jdD]2}
|j
j
|
�x}��!|	j|d��4|j|	j��tddi�}|jdD]V}
|jj
|
�x}
��!|j|
d�|j|
d�|j|
d��X|j|j��tdddd��}|jdD]5}
|jj
|
d�D]}|j|d���7|jdD]5}
|jj
|
d�D]}|j|d���7|jdD]5}
|jj
|
d�D]}|j|d���7|jdD]5}
|jj
|
d�D]}|j|d���7|jdD]5}
|jj
|
d�D]}|j|d���7|j|j��tdddd��}|jdD]2}
|jj
|
�x}��!|j|d��4|jdD]2}
|jj
|
�x}��!|j|d��4|jdD]2}
|jj
|
�x}��!|j|d��4|jdD]Z}
|jj�D];\}}|
j|�s�|j|d�|j|d��=�\|jdD]H}
|jj�D])\}}|
j|�s�|j|d��+�J|jd D]H}
|jj�D])\}}|
j|�s�|j|d!��+�J|j|j��td"dd#��}|jd D]5}
|j j
|
d�D]}|j|d���7|jd D]5}
|j"j
|
d�D]}|j|d$���7|jd D]5}
|j"j
|
d�D]}|j|d"���7|j|j��tddd%��}|jdD]l}
|j$j�D]M\}}|
j'|�s�|j|d�|j|d�|j|d��O�n|jdD]Z}
|j$j�D];\}}|
j'|�s�|j|d�|j|d��=�\|j|j��t)j*d&d'�d(k(}|j,d)d*k(r|s|j/d+�|j0r.|j2|j0}|j/d,|z�n|j/d-�|j4r.|j2|j4}|j/d.|z�n|j/d/�|j/d0|j6d1���|j/d2|j6d3���|j/d4|j6d5���|d6j9|�d7zz
}|S)8N>�nss-tlsr9�ssl�tls>�
pkcs12-import�nss-pkcs12-importr9�pkcs12�
nss-pkcs12>r9rmrn>�smime-import�nss-smime-importr9�smime�	nss-smime>r9rqrrz

z	library=
zname=Policy
zNSS=flags=policyOnly,moduleDB
zconfig="disallow=ALL allow=rmr)�rm�
pkcs12-legacy)rirm�macrirt)�ssl-key-exchange�cert-signature�	signature�grouprvrwrxrq)rs)rq�smime-legacy)rirmrq�cipherrrz�
all-signature)rs�rw�smime-signaturerx)rvr|rm�hash�signr~�key_exchangezsmime-signature-legacy�smime-key-exchange))r��smime-key-exchange-legacy)rvr�r�)r})rvr|�NSS_NO_TLS_REQUIRE_EMS�0�1�__ems�ENFORCEzTLS-REQUIRE-EMSztls-version-min=ztls-version-min=0zdtls-version-min=zdtls-version-min=0zDH-MIN=�min_dh_sizezDSA-MIN=�min_dsa_sizezRSA-MIN=�min_rsa_size�:z"
)�scoped�NSS_P11_KIT_PROXY�lstripr�enabled�mac_map�getr�extendr1�	curve_map�
cipher_map�hash_map�sign_suffix_ordmapr'�endswith�key_exchange_ssl_map�key_exchange_smime_map�sign_prefix_ordmap�
startswith�os�getenv�enumsr�min_tls_version�protocol_map�min_dtls_version�integersr.)�cls�unscoped_policy�
ssl_policy�pkcs12_import_policy�pkcs12_export_import_policy�smime_import_policy�smime_export_import_policy�cfg�r�macs_and_purposes�i�mac_alg�groups_and_purposes�	group_alg�ciphers_and_purposes�
cipher_alg�hashes_and_purposes�hash_alg�suffix�
sighashalg�kex_and_purposes�kex_alg�sigalgs_and_purposes�prefix�sigalg�no_tls_require_ems�minvers                           r�generate_configzNSSGenerator.generate_config�s���$�+�+�,L�M�
�.�5�5�7
� ��'6�&<�&<�>
�'�#�.�4�4�6
���&5�%;�%;�=
�&�"�
 �&�&�(�6�1���|��������0�0���,�,����/�)1�$�1
���
�#�#�E�*�A��;�;�?�?�1�-�-��:�!�%�%�g�u�5�+�-�4�4�U�;�A��;�;�?�?�1�-�-��:�!�%�%�g�x�8�<�&�-�-�e�4�A��;�;�?�?�1�-�-��:�!�%�%�g��?�5�	
���"�/�/�1�2�1�
@��3
���
�#�#�G�,�A� �]�]�.�.�q�1�1�	�>�#�'�'�	�3E�F�#�'�'�	�3C�D�#�'�'�	�;�?�	-�
	
���$�1�1�3�4�2�)1�'.�(-�	4
� ���#�#�H�-�A�!�n�n�0�0��B�7�
�$�(�(��U�;�8�.�-�4�4�X�>�A�!�n�n�0�0��B�7�
�$�(�(��X�>�8�?�&�-�-�h�7�A�!�n�n�0�0��B�7�
�$�(�(��_�E�8�8�,�3�3�H�=�A�!�n�n�0�0��B�7�
�$�(�(��W�=�8�>�%�,�,�X�6�A�!�n�n�0�0��B�7�
�$�(�(��^�D�8�7�	
���%�2�2�4�5�1�*2��=B�3
����#�#�F�+�A��L�L�,�,�Q�/�/��<�#�'�'��2D�E�,�-�4�4�V�<�A��L�L�,�,�Q�/�/��<�#�'�'��(�;�=�&�-�-�f�5�A��L�L�,�,�Q�/�/��<�#�'�'��/�B�6��#�#�F�+�A�&)�&<�&<�&B�&B�&D�"��
��:�:�f�%�'�+�+�J�8H�I�'�+�+�J��D�'E�,�
,�3�3�F�;�A�&)�&<�&<�&B�&B�&D�"��
��:�:�f�%�'�+�+�J�8I�J�'E�<�%�,�,�^�<�A�&)�&<�&<�&B�&B�&D�"��
��:�:�f�%�'�+�+�J�,D�F�'E�=�
	
���$�1�1�3�4�.�%�8=�0
����#�#�N�3�A��3�3�7�7��2�>�� �$�$�W�.@�A�?�4�%�,�,�^�<�A��5�5�9�9�!�R�@�� �$�$�W�.I�J�A�=�,�3�3�N�C�A��5�5�9�9�!�R�@�� �$�$�W�.B�C�A�D�	
���!�.�.�0�1�2� �38�4
� ���#�#�F�+�A�"%�"8�"8�">�">�"@�����<�<��'�(�,�,�V�5G�H�(�,�,�V�5E�F�(�,�,�V�[�A�	#A�,�,�3�3�F�;�A�"%�"8�"8�">�">�"@�����<�<��'�(�,�,�V�5F�G�(�,�,�V�[�A�#A�<�
	
���%�2�2�4�5� �Y�Y�'?��E��L�����G�$�	�1�:L�
�H�H�&�'��%�%��%�%�j�&@�&@�A�F�
�H�H�'�&�0�1�
�H�H�(�)��&�&��%�%�j�&A�&A�B�F�
�H�H�(�6�1�2�
�H�H�)�*�	���7�:�.�.�}�=�>�?�@�	���8�J�/�/��?�@�A�B�	���8�J�/�/��?�@�A�B��s�x�x��{�U�"�"���
rc�@�tjjd�}tj|�}t	j
dd�dk(}d}	|j
d�sd}|r|sgd	�ng}t�\}}	t	j|d
�5}	|	j|�ddd�tjdg|�|�ddtjtj�
�}
t	j |�|
j"dk(r�|
j$j'd�}dD]}||vs�|j)|��dj+|�}
d|
vrd|
vry|jd�|jd�|jd|���y|
j"r7|jd�|jd�|jd|���yy#t$r|jd�Y���wxYw#1swY��WxYw#t	j |�wxYw)N�nss3�NSS_LAXr�r�Ts3.80Fz9Cannot determine nss version with ctypes, assuming >=3.80)�-f�valuer��
identifier�wznss-policy-checkzutf-8)�check�encoding�stdout�stderrr�
)z!NSS-POLICY-WARN: NUMBER-OF-ECC: 0z&NSS-POLICY-WARN: NUMBER-OF-SMIME-KX: 0�NSS-POLICY-WARNzNSS-POLICY-FAILr�z+/usr/bin/nss-policy-check: Execution failedz*There is a warning in NSS generated policyzPolicy:
z)There is an error in NSS generated policy)�ctypes�util�find_library�CDLLr�r��NSS_VersionCheck�AttributeError�eprintr�fdopen�write�
subprocess�run�PIPE�STDOUT�unlink�
returncoder��split�remover.)r��config�nss_path�nss_lib�nss_lax�nss_is_lax_by_default�options�fd�path�fr�lines�line�rests              r�test_configzNSSGenerator.test_config�s����;�;�+�+�F�3���+�+�h�'���)�)�I�s�+�s�2�� $��	*��+�+�G�4�).�%�
,�G�7�AC�	��9���D�
	����2�s�#�q������$���� 2� 0�!(� 0�*.� 0�%*�(/�&0�o�o�&0�&7�&7�9�A�
�I�I�d�O��<�<�1���H�H�N�N�4�(�E�,���5�=��L�L��&�	,�
�9�9�U�#�D� ��,�1B�$�1N���J�J�D�E��J�J�C�D��J�J��6�(�+�,���<�<��J�J�D�E��J�J�B�C��J�J��6�(�+�,����U�	*��J�J�)�
*�	*��$�#��
�I�I�d�O�s7�G�<H�G9�$AH�G6�5G6�9H�>H�H)r2r3r4�CONFIG_NAMEr�r�r�r�r�r�r�r�r��classmethodr�r�rrrr8r8ss%���K�!��&�&�&�&�(�(�(�(��G����������������H�&�� � � �+�,�.�
�I��������	���	��	�
	���	��
�	�0��	�0��	�0��	�3��	�M��	�%��	�_��	�<��	�8�� 	�E�!�"	�	�#�$	��%�J�,���-�*�"�
��(�������������L�����"����	���������������k��k�Z�6��6rr8)r
r��ctypes.utilr�r��tempfiler�configgeneratorrr�rr8rrr�<module>r�s@���
��	���,���H=K�=K�@W�?�Wr