+
        G                         ^ RI t ^ RIt^ RIt^ RIt^ RIt^ RIHtHt ^ RIH	t	 ^RI
Ht Rt ! R R4      t ! R R	]4      tR# )
    N)CalledProcessErrorcall)mkstemp)ConfigGeneratorz-
library=p11-kit-proxy.so
name=p11-kit-proxy
c                   L   a  ] tR t^4t o RtR tR t]R 4       tR t	R t
RtV tR# )	PurposeDeduplicatora  Shorten the list of enabled algorithm/purpose pairs.

For example, given a rule set of
* ('pkcs12', 'pkcs12-legacy') -> 'pkcs12'
* ('ssl', 'pkcs12') -> 'all'
it'll shorten
  ('hmac-md5', 'pkcs12'), ('hmac-md5', 'pkcs12-legacy'), 'hmac-md5', 'ssl')
to just 'hmac-md5'.
The order of the first insertion is preserved.

It was decided to be OK to merge all currently known purposes into '/all',
even though in the future there could be more purposes added, since:
1. the list of purposes doesn't change often, and then we should update c-p
2. this will only result in overenablement for algorithms
   that the administrator already trusts for all currently known purposes,
   and it's likely that they trust it for the new purpose as well
c                P    \         P                  ! \        4      V n        Wn        R # N)collectionsdefaultdictlist_alg_purpose_map_rulemap)selfrulemaps   &&9/usr/share/crypto-policies/python/policygenerators/nss.py__init__PurposeDeduplicator.__init__G   s     + 7 7 =    c                J    V P                   V,          P                  V4       R # r
   )r   append)r   algpurposes   &&&r   addPurposeDeduplicator.addK   s    c"))'2r   c                4  a  . pS  F  pR V9   d   K  WC9   d   K  WA9   ;'       d;    \         ;QJ d    V 3R lV 4       F  '       d   K   RM	  RM! V 3R lV 4       4      pV'       d   W#9   d   Kj  VP                  V4       K}  VP                  V4       K  	  V# )allc              3   ,   <"   T F	  qS9   x  K  	  R # 5ir
    ).0ppurpose_lists   & r   	<genexpr>?PurposeDeduplicator._deduplicate_single_rule.<locals>.<genexpr>X   s     J8I1,.8Is   FT)r   r   )r"   purposes_separatepurpose_combinednew_purpose_listr   matchs   f&&   r   _deduplicate_single_rule,PurposeDeduplicator._deduplicate_single_ruleN   s     #G((*1 K KJ8IJJ8IJJ #7 ''(89 ''0 $  r   c                    R pW8w  d;   V P                   P                  4        F  w  r4V P                  VVV4      pK  	  TpK@  V# r
   )r   itemsr)   )r   r"   prev_purpose_listr%   r&   s   &&   r   _deduplicate_purpose_list-PurposeDeduplicator._deduplicate_purpose_lista   sQ     /7;}}7J7J7L3!#<<\=N=M O 8M !-r   c                    V P                   P                  4        UUu/ uF  w  rWP                  V4      bK  	  pppR  VP                  4        4       # u uppi )c              3   f   "   T F'  w  rVR .8w  d   V RRP                  V4       2MTx  K)  	  R# 5i)r   /,N)join)r    r   purposess   &  r   r#   3PurposeDeduplicator.deduplicated.<locals>.<genexpr>p   s=      K%IMC 2:eW1D3%q(+,-#M%Is   /1)r   r,   r.   )r   r   r"   deduplicated_alg_purpose_maps   &   r   deduplicated PurposeDeduplicator.deduplicatedk   sg     &*%:%:%@%@%B(
%B! //==%B 	% (
K%A%G%G%IK 	K	(
s   A)r   r   N)__name__
__module____qualname____firstlineno____doc__r   r   staticmethodr)   r.   r8   __static_attributes____classdictcell____classdict__s   @r   r   r   4   s9     $ 3    $K Kr   r   c                     a  ] tR t^tt o RtRRRRRRRRRR	R
RRRRRRRRR/
tRRRRRRRRRRRRRRRRRRRRRRRRR R!R"R!/tR#R$R%R!R&R&R'R'R(R(R)R*/t/ R+RhbR,RibR-RjbR.RkbR/RlbR0RmbR1RnbR2RobR3RpbR4RqbR5RrbR6RsbR7RtbR8RubR9RvbR:RwbR;RxbR<Rg/CtR=RyR>RzR?R{R@R|RAR}RBR~/t	R=RRARRBR/t
RDRERFRGRHRIRJRKRLRMRNRORPRQ/tRRRSRTRCRURVRWRXRYRZ/tR[RR\RR]RR^RR_RR`RRaRRbRRcRRdR/
t]Re 4       t]Rf 4       tRgtV tR!# )NSSGeneratornssz	HMAC-SHA1zHMAC-MD5zHMAC-SHA2-224zHMAC-SHA224zHMAC-SHA2-256zHMAC-SHA256zHMAC-SHA2-384zHMAC-SHA384zHMAC-SHA2-512zHMAC-SHA512zHMAC-SHA3-224zHMAC-SHA3-256zHMAC-SHA3-384zHMAC-SHA3-512MD2MD4MD5SHA1zSHA2-224SHA224zSHA2-256SHA256zSHA2-384SHA384zSHA2-512SHA512zSHA3-224zSHA3-256zSHA3-384zSHA3-512z	SHAKE-128Nz	SHAKE-256X25519
CURVE25519X448	SECP256R1	SECP384R1	SECP521R1zMLKEM768-X25519mlkem768x25519zAES-256-GCMzAES-192-GCMzAES-128-GCMzAES-256-CBCzAES-192-CBCzAES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-192-CBCzCAMELLIA-128-CBCzCHACHA20-POLY1305zSEED-CBCz3DES-CBCz	DES40-CBCzDES-CBCzRC4-128zRC2-CBCIDEANULLRSADHE-RSADHE-DSSECDHEECDHDHRSA-PKCSzSSL3.0zssl3.0zTLS1.0ztls1.0zTLS1.1ztls1.1zTLS1.2ztls1.2zTLS1.3ztls1.3zDTLS1.0zdtls1.0zDTLS1.2zdtls1.2zRSA-PSS-zRSA-PSSzRSA-zECDSA-ECDSAzDSA-DSAzEDDSA-ED25519ED25519z-MD5z-SHA1z	-SHA2-224z	-SHA2-256z	-SHA2-384z	-SHA2-512z	-SHA3-224z	-SHA3-256z	-SHA3-384z	-SHA3-512c                   VP                  0 R+m4      pVP                  0 R,m4      pVP                  0 R-m4      pVP                  0 R.m4      pVP                  0 R/m4      p\        P                  4       R,           pVR,          pVR,          pVR,          pVR,          p. p\        R0RR1R
/4      p	VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR4       K8  	  VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR4       K8  	  VP                  R,           F6  p
V P
                  P                  V
4      ;pf   K$  V	P                  VR	4       K8  	  VP                  V	P                  4       4       \        R2R
/4      pVP                  R,           FZ  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       VP                  VR4       VP                  VR4       K\  	  VP                  VP                  4       4       \        R0RR3RR4R
/4      pVP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR	4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  VP                  4       4       \        R0RR6RR7R
/4      pVP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       K8  	  VP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR4       K8  	  VP                  R,           F6  p
V P                  P                  V
4      ;pf   K$  VP                  VR	4       K8  	  VP                  R,           Fd  p
V P                  P                  4        FC  w  ppV
P                  V4      '       g   K  VP                  VR4       VP                  VR4       KE  	  Kf  	  VP                  R,           FR  p
V P                  P                  4        F1  w  ppV
P                  V4      '       g   K  VP                  VR4       K3  	  KT  	  VP                  R,           FR  p
V P                  P                  4        F1  w  ppV
P                  V4      '       g   K  VP                  VR4       K3  	  KT  	  VP                  VP                  4       4       \        R8RR9R
/4      pVP                  R,           F8  p
V P                   P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P"                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  R,           F8  p
V P"                  P                  V
R54       F  pVP                  VR4       K  	  K:  	  VP                  VP                  4       4       \        R6RR:R
/4      pVP                  R,           Fv  p
V P$                  P                  4        FU  w  ppV
P'                  V4      '       g   K  VP                  VR4       VP                  VR4       VP                  VR4       KW  	  Kx  	  VP                  R,           Fd  p
V P$                  P                  4        FC  w  ppV
P'                  V4      '       g   K  VP                  VR4       VP                  VR4       KE  	  Kf  	  VP                  VP                  4       4       \(        P*                  ! RR4      R8H  pVP,                  R,          R8X  d   V'       g   VP/                  R4       VP0                  '       d7   V P2                  VP0                  ,          pVP/                  RV,           4       MVP/                  R 4       VP4                  '       d7   V P2                  VP4                  ,          pVP/                  R!V,           4       MVP/                  R"4       VP/                  R#VP6                  R$,           24       VP/                  R%VP6                  R&,           24       VP/                  R'VP6                  R(,           24       VR)P9                  V4      R*,           ,          pV# );tlssslpkcs12smimez

z	library=
zname=Policy
zNSS=flags=policyOnly,moduleDB
zconfig="disallow=ALL allow=pkcs12-legacyr   macssl-key-exchangecert-signature	signaturegroupsmime-legacyciphersmime-signatureall-signaturehashsignkey_exchangezsmime-signature-legacysmime-key-exchangesmime-key-exchange-legacyNSS_NO_TLS_REQUIRE_EMS1__emsENFORCEzTLS-REQUIRE-EMSztls-version-min=ztls-version-min=0zdtls-version-min=zdtls-version-min=0zDH-MIN=min_dh_sizezDSA-MIN=min_dsa_sizezRSA-MIN=min_rsa_size:z"
>   rF   rd   rc   nss-tls>   rF   re   
nss-pkcs12pkcs12-importnss-pkcs12-import>   rF   re   r   >   rF   rf   	nss-smimesmime-importnss-smime-import>   rF   rf   r   )re   rg   )rd   re   )ri   rj   rk   )rf   rm   )rd   re   rf   r   )rj   ro   rk   )ri   rp   re   )rt   ru   )ri   rt   )ri   rp   )scopedNSS_P11_KIT_PROXYlstripr   enabledmac_mapgetr   extendr8   	curve_map
cipher_maphash_mapsign_suffix_ordmapr,   endswithkey_exchange_ssl_mapkey_exchange_smime_mapsign_prefix_ordmap
startswithosgetenvenumsr   min_tls_versionprotocol_mapmin_dtls_versionintegersr4   )clsunscoped_policy
ssl_policypkcs12_import_policypkcs12_export_import_policysmime_import_policysmime_export_import_policycfgrmacs_and_purposesimac_alggroups_and_purposes	group_algciphers_and_purposes
cipher_alghashes_and_purposeshash_algsuffix
sighashalgkex_and_purposeskex_algsigalgs_and_purposesprefixsigalgno_tls_require_emsminvers   &&                         r   generate_configNSSGenerator.generate_config   sV	   $++,LM
.55 7
   '6&<&< >
 '# .44 6
  &5%;%; =
 &"
  &&(61|00,,/'u1
 
 ##E**A;;??1--:!%%gu5 + -44U;;A;;??1--:!%%gx8 < &--e44A;;??1--:!%%g? 5 	
"//121 @3
 
 ##G,,A ]]..q11	>#''	3EF#''	3CD#''	;?	 -
 	
$11342'%w&	4
   ##H--A!nn00B7
$((U; 8 . -44X>>A!nn00B7
$((X> 8 ? &--h77A!nn00B7
$((_E 8 8 ,33H==A!nn00B7
$((W= 8 > %,,X66A!nn00B7
$((^D 8 7 	
%22451 (>;U3
  ##F++ALL,,Q//<#''2DE , -44V<<ALL,,Q//<#''(; = &--f55ALL,,Q//<#''/B 6 ##F++A&)&<&<&B&B&D"
::f%%'++J8HI'++JD 'E ,
 ,33F;;A&)&<&<&B&B&D"
::f%%'++J8IJ 'E < %,,^<<A&)&<&<&B&B&D"
::f%%'++J,DF 'E =
 	
$1134. @$60
  ##N33A33772> $$W.@A ? 4 %,,^<<A5599!R@ $$W.IJ A = ,33NCCA5599!R@ $$W.BC A D 	
!..012 ?154
   ##F++A"%"8"8">">"@<<''(,,V5GH(,,V5EF(,,V[A	 #A , ,33F;;A"%"8"8">">"@<<''(,,V5FG(,,V[A #A <
 	
%2245  YY'?ELG$	1:LHH&'%%%%%j&@&@AFHH'&01HH()&&&%%j&A&ABFHH(612HH)*	7:..}=>?@	8J//?@AB	8J//?@ABsxx{U""
r   c                   \         P                  ! R 4      pVf   R# \        P                  P	                  R4      p\        P
                  ! V4      p\        P                  ! RR4      R8H  pRp VP                  R4      '       g   RpT'       d   T'       g   R
MRp\        4       w  r^p
 \        P                  ! TR4      ;_uu_ 4       pTP                  T4       RRR4        \        T RT RT	 R2RR7      p
\        P                   ! T	4       T
^8X  d(   T P                  R4       T P                  RT 24       R# T
'       d(   T P                  R4       T P                  RT 24       R# R#   \         d    T P                  R	4        ELi ; i  + '       g   i     L; i  \         d    T P                  R4        Li ; i  \        P                   ! T	4       i ; i)znss-policy-checkNTnss3NSS_LAX0rw   s   3.80Fz9Cannot determine nss version with ctypes, assuming >=3.80z-f value -f identifier w z
>/dev/null)shellz+/usr/bin/nss-policy-check: Execution failedz*There is a warning in NSS generated policyzPolicy:
z)There is an error in NSS generated policy)shutilwhichctypesutilfind_libraryCDLLr   r   NSS_VersionCheckAttributeErroreprintr   fdopenwriter   r   unlink)r   confignss_policy_checknss_pathnss_libnss_laxnss_is_lax_by_defaultoptionsfdpathretfs   &&          r   test_configNSSGenerator.test_config  s    "<<(:;#;;++F3++h'))Is+s2 $	*++G44 ).%
 ,G ,AC 	 9
	2s##q $J./q	4&'(!%' IIdO!8JJCDJJ6(+,JJBCJJ6(+,;  	*JJ ) *	* $# & J

HIJ IIdOsZ   /E0 E0 +G 
FG %F& 0FFF#	G &GG GG G r   )z
aes256-gcm)z
aes192-gcm)z
aes128-gcm)z
aes256-cbc)z
aes192-cbc)z
aes128-cbc)zcamellia256-cbc)zcamellia192-cbc)zcamellia128-cbc)zchacha20-poly1305)zseed-cbc)zdes-ede3-cbc)z
des-40-cbc)zdes-cbc)rc4)rc2z
rc2-40-cbcz
rc2-64-cbczrc2-128-cbc)idea)rX   )rY   )rZ   )z	ECDHE-RSAzECDHE-ECDSA)zECDH-RSAz
ECDH-ECDSA)zDH-RSAzDH-DSS)r^   zRSA-OAEP)r\   )r]   )r:   r;   r<   r=   CONFIG_NAMEr   r   r   r   r   r   r   r   r   classmethodr   r   r@   rA   rB   s   @r   rE   rE   t   s    K 	[JG 	uuuHHHHJJJJTTH& 	,[[[+
I 	 		
 	 	 	0 	0 	0 	3 	M 	% 	_ 	< 	8  	E!" 		#$ 	%J, 	x<<-*" 	'	g 	(((((99L 	I
' 	XXXXZZZZ k kZ . .r   rE   )r   r   ctypes.utilr   r   
subprocessr   r   tempfiler   configgeneratorr   r   r   rE   r   r   r   <module>r      sC       	  /  , H=K =K@L? Lr   