+
    $iG  c                   s    ^ RI t ^ RIt^ RIt^ RIt^ RIt^ RIHtHt ^ RIH	t	 ^RI
Ht Rt ! R R4      t ! R R	]4      tR# )
i    N)CalledProcessErrorcall)mkstemp)ConfigGeneratorz-
library=p11-kit-proxy.so
name=p11-kit-proxy
c                   sL   a  ] tR t^4t o RtR tR t]R 4       tR t	R t
RtV tR# )	PurposeDeduplicatora  Shorten the list of enabled algorithm/purpose pairs.

For example, given a rule set of
* ('pkcs12', 'pkcs12-legacy') -> 'pkcs12'
* ('ssl', 'pkcs12') -> 'all'
it'll shorten
  ('hmac-md5', 'pkcs12'), ('hmac-md5', 'pkcs12-legacy'), 'hmac-md5', 'ssl')
to just 'hmac-md5'.
The order of the first insertion is preserved.

It was decided to be OK to merge all currently known purposes into '/all',
even though in the future there could be more purposes added, since:
1. the list of purposes doesn't change often, and then we should update c-p
2. this will only result in overenablement for algorithms
   that the administrator already trusts for all currently known purposes,
   and it's likely that they trust it for the new purpose as well
c                sP    \         P                  ! \        4      V n        Wn        R # N)collectionsZdefaultdictZlist_alg_purpose_map_rulemap)selfZrulemaps   &&9/usr/share/crypto-policies/python/policygenerators/nss.py__init__ZPurposeDeduplicator.__init__G   s     + 7 7 =    c                sJ    V P                   V,          P                  V4       R # r   )r   append)r	   algpurposes   &&&r
   addZPurposeDeduplicator.addK   s    c"))'2r   c                s4  a  . pS  F  pR V9   d   K  WC9   d   K  WA9   ;'       d;    \         ;QJ d    V 3R lV 4       F  '       d   K   RM	  RM! V 3R lV 4       4      pV'       d   W#9   d   Kj  VP                  V4       K}  VP                  V4       K  	  V# )allc              3   s,   <"   T F	  qS9   x  K  	  R # 5ir    ).0Zppurpose_lists   & r
   	<genexpr>Z?PurposeDeduplicator._deduplicate_single_rule.<locals>.<genexpr>X   s     J8I1,.8Is   FT)r   r   )r   purposes_separatepurpose_combinedZnew_purpose_listr   Zmatchs   f&&   r
   _deduplicate_single_ruleZ,PurposeDeduplicator._deduplicate_single_ruleN   s     #G((*1 K KJ8IJJ8IJJ #7 ''(89 ''0 $  r   c                s    R pW8w  d;   V P                   P                  4        F  w  r4V P                  VVV4      pK  	  TpK@  V# r   )r   itemsr   )r	   r   Zprev_purpose_listr   r   s   &&   r
   _deduplicate_purpose_listZ-PurposeDeduplicator._deduplicate_purpose_lista   sQ     /7;}}7J7J7L3!#<<\=N=M O 8M !-r   c                s    V P                   P                  4        UUu/ uF  w  rWP                  V4      bK  	  pppR  VP                  4        4       # u uppi )c              3   sf   "   T F'  w  rVR .8w  d   V RRP                  V4       2MTx  K)  	  R# 5i)r   Z/Z,N)join)r   r   Zpurposess   &  r
   r   Z3PurposeDeduplicator.deduplicated.<locals>.<genexpr>p   s=      K%IMC 2:eW1D3%q(+,-#M%Is   /1)r   r   r   )r	   r   r   Zdeduplicated_alg_purpose_maps   &   r
   deduplicatedZ PurposeDeduplicator.deduplicatedk   sg     &*%:%:%@%@%B(
%B! //==%B 	% (
K%A%G%G%IK 	K	(
s   A)r   r   N)__name__
__module____qualname____firstlineno__Z__doc__r   r   Zstaticmethodr   r   r   __static_attributes____classdictcell__Z__classdict__   @r
   r   r   4   s9     $ 3    $K Kr   r   c                   s  a  ] tR t^tt o RtRRRRRRRRRR	R
RRRRRRRRR/
tRRRRRRRRRRRRRRRRRRRRRRRRR R!R"R!/tR#R$R%R!R&R&R'R'R(R(R)R*/t/ R+RhbR,RibR-RjbR.RkbR/RlbR0RmbR1RnbR2RobR3RpbR4RqbR5RrbR6RsbR7RtbR8RubR9RvbR:RwbR;RxbR<Rg/CtR=RyR>RzR?R{R@R|RAR}RBR~/t	R=RRARRBR/t
RDRERFRGRHRIRJRKRLRMRNRORPRQ/tRRRSRTRCRURVRWRXRYRZ/tR[RR\RR]RR^RR_RR`RRaRRbRRcRRdR/
t]Re 4       t]Rf 4       tRgtV tR!# )NSSGeneratornssz	HMAC-SHA1zHMAC-MD5zHMAC-SHA2-224zHMAC-SHA224zHMAC-SHA2-256zHMAC-SHA256zHMAC-SHA2-384zHMAC-SHA384zHMAC-SHA2-512zHMAC-SHA512zHMAC-SHA3-224zHMAC-SHA3-256zHMAC-SHA3-384zHMAC-SHA3-512ZMD2ZMD4ZMD5ZSHA1zSHA2-224ZSHA224zSHA2-256ZSHA256zSHA2-384ZSHA384zSHA2-512ZSHA512zSHA3-224zSHA3-256zSHA3-384zSHA3-512z	SHAKE-128Nz	SHAKE-256ZX25519Z
CURVE25519ZX448Z	SECP256R1Z	SECP384R1Z	SECP521R1zMLKEM768-X25519Zmlkem768x25519zAES-256-GCMzAES-192-GCMzAES-128-GCMzAES-256-CBCzAES-192-CBCzAES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-192-CBCzCAMELLIA-128-CBCzCHACHA20-POLY1305zSEED-CBCz3DES-CBCz	DES40-CBCzDES-CBCzRC4-128zRC2-CBCZIDEAZNULLRSADHE-RSADHE-DSSZECDHEECDHDHRSA-PKCSzSSL3.0zssl3.0zTLS1.0ztls1.0zTLS1.1ztls1.1zTLS1.2ztls1.2zTLS1.3ztls1.3zDTLS1.0zdtls1.0zDTLS1.2zdtls1.2zRSA-PSS-zRSA-PSSzRSA-zECDSA-ZECDSAzDSA-ZDSAzEDDSA-ED25519ZED25519z-MD5z-SHA1z	-SHA2-224z	-SHA2-256z	-SHA2-384z	-SHA2-512z	-SHA3-224z	-SHA3-256z	-SHA3-384z	-SHA3-512c                s   VP                  0 R+m4      pVP                  0 R,m4      pVP                  0 R-m4      pVP                  0 R.m4      pVP                  0 R/m4      p\        P                  4       R,           pVR,          pVR,          pVR,          pVR,          p. p\        R0RR1R
/4      p	VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR4       K8  	  VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR4       K8  	  VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR	4       K8  	  VP                  V	P                  4       4       \        R2R
/4      pVP                  R,           FZ  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       VP                  VR4       VP                  VR4       K\  	  VP                  VP                  4       4       \        R0RR3RR4R
/4      pVP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR	4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  VP                  4       4       \        R0RR6RR7R
/4      pVP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       K8  	  VP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       K8  	  VP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR	4       K8  	  VP                  R,           Fd  p
V P                  P                  4        FC  w  ppV
P                  V4      '       g   K  VP                  VR4       VP                  VR4       KE  	  Kf  	  VP                  R,           FR  p
V P                  P                  4        F1  w  ppV
P                  V4      '       g   K  VP                  VR4       K3  	  KT  	  VP                  R,           FR  p
V P                  P                  4        F1  w  ppV
P                  V4      '       g   K  VP                  VR4       K3  	  KT  	  VP                  VP                  4       4       \        R8RR9R
/4      pVP                  R,           F8  p
V P                   P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P"                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P"                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  VP                  4       4       \        R6RR:R
/4      pVP                  R,           Fv  p
V P$                  P                  4        FU  w  ppV
P'                  V4      '       g   K  VP                  VR4       VP                  VR4       VP                  VR4       KW  	  Kx  	  VP                  R,           Fd  p
V P$                  P                  4        FC  w  ppV
P'                  V4      '       g   K  VP                  VR4       VP                  VR4       KE  	  Kf  	  VP                  VP                  4       4       \(        P*                  ! RR4      R8H  pVP,                  R,          R8X  d   V'       g   VP/                  R4       VP0                  '       d7   V P2                  VP0                  ,          pVP/                  RV,           4       MVP/                  R 4       VP4                  '       d7   V P2                  VP4                  ,          pVP/                  R!V,           4       MVP/                  R"4       VP/                  R#VP6                  R$,           24       VP/                  R%VP6                  R&,           24       VP/                  R'VP6                  R(,           24       VR)P9                  V4      R*,           ,          pV# );tlssslpkcs12smimez

z	library=
zname=Policy
zNSS=flags=policyOnly,moduleDB
zconfig="disallow=ALL allow=pkcs12-legacyr   Zmacssl-key-exchangecert-signature	signatureZgroupsmime-legacyZciphersmime-signatureall-signatureZhashZsignZkey_exchangezsmime-signature-legacysmime-key-exchangesmime-key-exchange-legacyZNSS_NO_TLS_REQUIRE_EMS1Z__emsZENFORCEzTLS-REQUIRE-EMSztls-version-min=ztls-version-min=0zdtls-version-min=zdtls-version-min=0zDH-MIN=Zmin_dh_sizezDSA-MIN=Zmin_dsa_sizezRSA-MIN=Zmin_rsa_sizeZ:z"
>   r&   r.   r-   znss-tls>   r&   r/   
nss-pkcs12zpkcs12-importznss-pkcs12-import>   r&   r/   r;   >   r&   r0   	nss-smimezsmime-importznss-smime-import>   r&   r0   r<   )r/   r1   )r.   r/   )r2   r3   r4   )r0   r5   )r.   r/   r0   r   )r3   r6   r4   )r2   r7   r/   )r8   r9   )r2   r8   )r2   r7   )ZscopedNSS_P11_KIT_PROXYZlstripr   Zenabledmac_mapZgetr   Zextendr   	curve_map
cipher_maphash_mapsign_suffix_ordmapr   Zendswithkey_exchange_ssl_mapkey_exchange_smime_mapsign_prefix_ordmapZ
startswithosgetenvZenumsr   Zmin_tls_versionprotocol_mapZmin_dtls_versionZintegersr   )clsZunscoped_policyZ
ssl_policyZpkcs12_import_policyZpkcs12_export_import_policyZsmime_import_policyZsmime_export_import_policyZcfgZrZmacs_and_purposesZiZmac_algZgroups_and_purposesZ	group_algZciphers_and_purposesZ
cipher_algZhashes_and_purposesZhash_algZsuffixZ
sighashalgZkex_and_purposesZkex_algZsigalgs_and_purposesZprefixZsigalgZno_tls_require_emsZminvers   &&                         r
   generate_configZNSSGenerator.generate_config   sV	   $++,LM
.55 7
   '6&<&< >
 '# .44 6
  &5%;%; =
 &"
  &&(61|00,,/'u1
 
 ##E**A;;??1--:!%%gu5 + -44U;;A;;??1--:!%%gx8 < &--e44A;;??1--:!%%g? 5 	
"//121 @3
 
 ##G,,A ]]..q11	>#''	3EF#''	3CD#''	;?	 -
 	
$11342'%w&	4
   ##H--A!nn00B7
$((U; 8 . -44X>>A!nn00B7
$((X> 8 ? &--h77A!nn00B7
$((_E 8 8 ,33H==A!nn00B7
$((W= 8 > %,,X66A!nn00B7
$((^D 8 7 	
%22451 (>;U3
  ##F++ALL,,Q//<#''2DE , -44V<<ALL,,Q//<#''(; = &--f55ALL,,Q//<#''/B 6 ##F++A&)&<&<&B&B&D"
::f%%'++J8HI'++JD 'E ,
 ,33F;;A&)&<&<&B&B&D"
::f%%'++J8IJ 'E < %,,^<<A&)&<&<&B&B&D"
::f%%'++J,DF 'E =
 	
$1134. @$60
  ##N33A33772> $$W.@A ? 4 %,,^<<A5599!R@ $$W.IJ A = ,33NCCA5599!R@ $$W.BC A D 	
!..012 ?154
   ##F++A"%"8"8">">"@<<''(,,V5GH(,,V5EF(,,V[A	 #A , ,33F;;A"%"8"8">">"@<<''(,,V5FG(,,V[A #A <
 	
%2245  YY'?ELG$	1:LHH&'%%%%%j&@&@AFHH'&01HH()&&&%%j&A&ABFHH(612HH)*	7:..}=>?@	8J//?@AB	8J//?@ABsxx{U""
r   c                s   \         P                  ! R 4      pVf   R# \        P                  P	                  R4      p\        P
                  ! V4      p\        P                  ! RR4      R8H  pRp VP                  R4      '       g   RpT'       d   T'       g   R
MRp\        4       w  r^p
 \        P                  ! TR4      ;_uu_ 4       pTP                  T4       RRR4        \        T RT RT	 R2RR7      p
\        P                   ! T	4       T
^8X  d(   T P                  R4       T P                  RT 24       R# T
'       d(   T P                  R4       T P                  RT 24       R# R#   \         d    T P                  R	4        ELi ; i  + '       g   i     L; i  \         d    T P                  R4        Li ; i  \        P                   ! T	4       i ; i)znss-policy-checkNTZnss3ZNSS_LAXZ0r:   s   3.80Fz9Cannot determine nss version with ctypes, assuming >=3.80z-f value -f identifierZ ZwZ z
>/dev/null)Zshellz+/usr/bin/nss-policy-check: Execution failedz*There is a warning in NSS generated policyzPolicy:
z)There is an error in NSS generated policy)shutilZwhichctypesZutilZfind_libraryZCDLLrF   rG   ZNSS_VersionCheckZAttributeErrorZeprintr   ZfdopenZwriter   r    Zunlink)rI   ZconfigZnss_policy_checkZnss_pathZnss_libZnss_laxZnss_is_lax_by_defaultZoptionsZfdZpathZretZfs   &&          r
   test_configZNSSGenerator.test_config  s    "<<(:;#;;++F3++h'))Is+s2 $	*++G44 ).%
 ,G ,AC 	 9
	2s##q $J./q	4&'(!%' IIdO!8JJCDJJ6(+,JJBCJJ6(+,;  	*JJ ) *	* $# & J

HIJ IIdOsZ   /E0 E0 +G 
FG %F& 0FFF#	G &GG GG G r   )z
aes256-gcm)z
aes192-gcm)z
aes128-gcm)z
aes256-cbc)z
aes192-cbc)z
aes128-cbc)zcamellia256-cbc)zcamellia192-cbc)zcamellia128-cbc)zchacha20-poly1305)zseed-cbc)zdes-ede3-cbc)z
des-40-cbc)zdes-cbc)Zrc4)Zrc2z
rc2-40-cbcz
rc2-64-cbczrc2-128-cbc)Zidea)r'   )r(   )r)   )z	ECDHE-RSAzECDHE-ECDSA)zECDH-RSAz
ECDH-ECDSA)zDH-RSAzDH-DSS)r,   zRSA-OAEP)r*   )r+   )r   r   r   r    ZCONFIG_NAMEr>   rA   r?   r@   rC   rD   rH   rE   rB   ZclassmethodrJ   rM   r!   r"   r#   r$   r
   r%   r%   t   s    K 	[JG 	uuuHHHHJJJJTTH& 	,[[[+
I 	 		
 	 	 	0 	0 	0 	3 	M 	% 	_ 	< 	8  	E!" 		#$ 	%J, 	x<<-*" 	'	g 	(((((99L 	I
' 	XXXXZZZZ k kZ . .r   r%   )r   rL   Zctypes.utilrF   rK   Z
subprocessr    r   Ztempfiler   Zconfiggeneratorr   r=   r   r%   r   r   r
   <module>rN      sC       	  /  , H=K =K@L? Lr   