| Şuanki Dizin: /proc/self/root/usr/share/crypto-policies/python/policygenerators/ |
| Şuanki Dosya : //proc/self/root/usr/share/crypto-policies/python/policygenerators/java.py |
# SPDX-License-Identifier: LGPL-2.1-or-later
# Copyright (c) 2019 Red Hat, Inc.
# Copyright (c) 2019 Tomáš Mráz <tmraz@fedoraproject.org>
from .configgenerator import ConfigGenerator
class JavaGenerator(ConfigGenerator):
CONFIG_NAME = 'java'
SCOPES = {'tls', 'ssl', 'java-tls'}
hash_not_map = {
'MD2': 'MD2',
'MD5': 'MD5',
'SHA1': 'SHA1',
'SHA2-224': 'SHA224',
'SHA2-256': 'SHA256',
'SHA2-384': 'SHA384',
'SHA2-512': 'SHA512',
'SHA3-256': 'SHA3_256',
'SHA3-384': 'SHA3_384',
'SHA3-512': 'SHA3_512',
'SHAKE-128': '',
'SHAKE-256': '',
'GOSTR94': ''
}
cipher_not_map = {
'AES-256-CTR': '',
'AES-128-CTR': '',
'CHACHA20-POLY1305': 'ChaCha20-Poly1305',
'CAMELLIA-256-GCM': '',
'CAMELLIA-128-GCM': '',
'CAMELLIA-256-CBC': '',
'CAMELLIA-128-CBC': '',
'AES-256-CBC': 'AES_256_CBC',
'AES-128-CBC': 'AES_128_CBC',
'AES-256-GCM': 'AES_256_GCM',
'AES-128-GCM': 'AES_128_GCM',
'AES-256-CCM': 'AES_256_CCM',
'AES-128-CCM': 'AES_128_CCM',
'RC4-128': 'RC4_128',
'RC4-40': 'RC4_40',
'RC2-CBC': 'RC2',
'DES-CBC': 'DES_CBC',
'DES40-CBC': 'DES40_CBC',
'3DES-CBC': '3DES_EDE_CBC',
'SEED-CBC': '',
'IDEA-CBC': '',
'NULL': 'anon, NULL'
}
cipher_legacy_map = {
'RC4-128': 'RC4_128',
'3DES-CBC': '3DES_EDE_CBC',
}
key_exchange_not_map = {
'EXPORT': ', '.join(( # noqa: FLY002
'RSA_EXPORT',
'DHE_DSS_EXPORT',
'DHE_RSA_EXPORT',
'DH_DSS_EXPORT',
'DH_RSA_EXPORT',
)),
'DH': 'DH_RSA, DH_DSS',
'ANON': 'DH_anon, ECDH_anon',
'RSA': ', '.join(( # noqa: FLY002
'TLS_RSA_WITH_AES_256_CBC_SHA256',
'TLS_RSA_WITH_AES_256_CBC_SHA',
'TLS_RSA_WITH_AES_128_CBC_SHA256',
'TLS_RSA_WITH_AES_128_CBC_SHA',
'TLS_RSA_WITH_AES_256_GCM_SHA384',
'TLS_RSA_WITH_AES_128_GCM_SHA256',
)),
'DHE-RSA': 'DHE_RSA',
'DHE-DSS': 'DHE_DSS',
'ECDHE': 'ECDHE',
'ECDH': 'ECDH',
'PSK': '',
'DHE-PSK': '',
'ECDHE-PSK': '',
'RSA-PSK': 'RSAPSK'
}
group_not_map = { # also reused in JavaSystemGenerator as group_map
'X25519': 'x25519',
'SECP256R1': 'secp256r1',
'SECP384R1': 'secp384r1',
'SECP521R1': 'secp521r1',
'X448': 'x448',
'FFDHE-2048': 'ffdhe2048',
'FFDHE-3072': 'ffdhe3072',
'FFDHE-4096': 'ffdhe4096',
'FFDHE-6144': 'ffdhe6144',
'FFDHE-8192': 'ffdhe8192',
'BRAINPOOL-P256R1': 'brainpoolP256r1',
# brainpoolP320r1 - unconditionally disabled
'BRAINPOOL-P384R1': 'brainpoolP384r1',
'BRAINPOOL-P512R1': 'brainpoolP512r1',
}
group_always_disabled = [
'secp112r1', 'secp112r2', 'secp128r1', 'secp128r2',
'secp160k1', 'secp160r1', 'secp160r2',
'secp192k1', 'secp192r1',
'secp224k1', 'secp224r1',
'secp256k1',
'sect113r1', 'sect113r2', 'sect131r1', 'sect131r2',
'sect163k1', 'sect163r1', 'sect163r2',
'sect193r1', 'sect193r2',
'sect233k1', 'sect233r1',
'sect239k1',
'sect283k1', 'sect283r1',
'sect409k1', 'sect409r1',
'sect571k1', 'sect571r1',
# not prefixing with X9.62,
# because stale c9s 1.8.0.362.b09-4.el9 errors out if I do
'c2tnb191v1', 'c2tnb191v2', 'c2tnb191v3',
'c2tnb239v1', 'c2tnb239v2', 'c2tnb239v3',
'c2tnb359v1',
'c2tnb431r1',
'prime192v2', 'prime192v3',
'prime239v1', 'prime239v2', 'prime239v3',
'brainpoolP320r1',
]
sign_not_map = {
'RSA-MD5': 'MD5withRSA',
'RSA-SHA1': 'SHA1withRSA',
'DSA-SHA1': 'SHA1withDSA',
'ECDSA-SHA1': 'SHA1withECDSA',
'RSA-SHA2-224': 'SHA224withRSA',
'DSA-SHA2-224': 'SHA224withDSA',
'ECDSA-SHA2-224': 'SHA224withECDSA',
'RSA-SHA2-256': 'SHA256withRSA',
'DSA-SHA2-256': 'SHA256withDSA',
'ECDSA-SHA2-256': 'SHA256withECDSA',
'RSA-SHA2-384': 'SHA384withRSA',
'DSA-SHA2-384': 'SHA384withDSA',
'ECDSA-SHA2-384': 'SHA384withECDSA',
'RSA-SHA2-512': 'SHA512withRSA',
'DSA-SHA2-512': 'SHA512withDSA',
'ECDSA-SHA2-512': 'SHA512withECDSA',
'EDDSA-ED25519': 'Ed25519',
'EDDSA-ED448': 'Ed448',
'RSA-PSS-SHA1': 'SHA1withRSAandMGF1',
'RSA-PSS-SHA2-224': 'SHA224withRSAandMGF1',
'RSA-PSS-SHA2-256': 'SHA256withRSAandMGF1',
'RSA-PSS-SHA2-384': 'SHA384withRSAandMGF1',
'RSA-PSS-SHA2-512': 'SHA512withRSAandMGF1',
}
protocol_not_map = {
'SSL2.0': 'SSLv2',
'SSL3.0': 'SSLv3',
'TLS1.0': 'TLSv1',
'TLS1.1': 'TLSv1.1',
'TLS1.2': 'TLSv1.2',
'DTLS1.0': 'DTLSv1.0',
'DTLS1.2': ''
}
mac_not_map = {
'AEAD': '',
'HMAC-MD5': 'HmacMD5',
'HMAC-SHA1': 'HmacSHA1',
'HMAC-SHA2-256': 'HmacSHA256',
'HMAC-SHA2-384': 'HmacSHA384',
'HMAC-SHA2-512': 'HmacSHA512',
}
@classmethod
def generate_config(cls, policy):
p = policy.enabled
ip = policy.disabled
sep = ', '
shared = [ # unconditionally disabled
'MD2', 'MD5withDSA', 'MD5withECDSA'
'RIPEMD160withRSA', 'RIPEMD160withECDSA',
'RIPEMD160withRSAandMGF1',
]
for i in ip['sign']:
try:
shared.append(cls.sign_not_map[i])
except KeyError:
pass
def keysize(keyword, size):
return f'{keyword} keySize < {size}' if size else keyword
shared.append(keysize('RSA', policy.integers['min_rsa_size']))
shared.append(keysize('DSA', policy.integers['min_dsa_size']))
shared.append(keysize('DH', policy.integers['min_dh_size']))
shared.append(keysize('EC', policy.integers['min_ec_size']))
cfg = f'jdk.certpath.disabledAlgorithms={", ".join(shared)}'
for i in ip['hash']:
try:
cfg = cls.append(cfg, cls.hash_not_map[i], sep)
except KeyError:
pass
cfg += f'\njdk.tls.disabledAlgorithms={", ".join(shared)}'
# https://bugs.openjdk.org/browse/JDK-8236730
cfg = cls.append(cfg, 'include jdk.disabled.namedCurves', sep)
for i in ip['protocol']:
try:
cfg = cls.append(cfg, cls.protocol_not_map[i], sep)
except KeyError:
pass
for i in ip['key_exchange']:
try:
cfg = cls.append(cfg, cls.key_exchange_not_map[i], sep)
except KeyError:
pass
for i in ip['cipher']:
try:
cfg = cls.append(cfg, cls.cipher_not_map[i], sep)
except KeyError:
pass
for i in ip['mac']:
try:
cfg = cls.append(cfg, cls.mac_not_map[i], sep)
except KeyError:
pass
cfg += '\n'
s = ''
for i in ip['group']:
try:
s = cls.append(s, cls.group_not_map[i], sep)
except KeyError:
pass
for g in cls.group_always_disabled:
s = cls.append(s, g, sep)
cfg += f'jdk.disabled.namedCurves={s}\n'
# see also system property jdk.tls.namedGroups
s = ''
for i in p['cipher']:
try:
s = cls.append(s, cls.cipher_legacy_map[i], sep)
except KeyError:
pass
cfg += f'jdk.tls.legacyAlgorithms={s}\n'
return cfg
@classmethod
def test_config(cls, config): # pylint: disable=unused-argument
return True
class JavaSystemGenerator(ConfigGenerator):
CONFIG_NAME = 'javasystem'
SCOPES = {'tls', 'ssl', 'java-tls'}
group_map = JavaGenerator.group_not_map
@classmethod
def generate_config(cls, policy):
p = policy.enabled
sep = ', '
cfg = ''
cfg += f'jdk.tls.ephemeralDHKeySize={policy.integers["min_dh_size"]}\n'
s = ''
for i in p['group']:
try:
s = cls.append(s, cls.group_map[i], sep)
except KeyError:
pass
cfg += f'jdk.tls.namedGroups={s}\n'
# see also security property jdk.disabled.namedCurves
return cfg
@classmethod
def test_config(cls, config): # pylint: disable=unused-argument
return True
Linux 65-254-81-4.cprapid.com 5.14.0-284.11.1.el9_2.x86_64 #1 SMP PREEMPT_DYNAMIC Tue May 9 05:49:00 EDT 2023 x86_64
Apache
65.254.81.4