1#@!#!123s

: / proc / thread-self / root / usr / share / crypto-policies / python / policygenerators /

Filename : bind.py

back

# SPDX-License-Identifier: LGPL-2.1-or-later

# Copyright (c) 2019 Red Hat, Inc.
# Copyright (c) 2019 Tomáš Mráz <tmraz@fedoraproject.org>

from subprocess import check_output, CalledProcessError
from tempfile import mkstemp
import os

from .configgenerator import ConfigGenerator


class BindGenerator(ConfigGenerator):
	CONFIG_NAME = 'bind'
	SCOPES = {'dnssec', 'bind'}

	RELOAD_CMD = 'systemctl try-reload-or-restart bind.service 2>/dev/null || :\n'

	sign_not_map = {
		'DSA-SHA1': ('DSA', 'NSEC3DSA'),
		'RSA-SHA1': ('RSASHA1', 'NSEC3RSASHA1'),
		'RSA-SHA2-256': ('RSASHA256',),
		'RSA-SHA2-512': ('RSASHA512',),
		'ECDSA-SHA2-256': ('ECDSAP256SHA256',),  # + custom handling below
		'ECDSA-SHA2-384': ('ECDSAP384SHA384',),  # + custom handling below
		'EDDSA-ED25519': ('ED25519',),
		'EDDSA-ED448': ('ED448',),
	}

	hash_not_map = {
		'SHA1': 'SHA-1',
		'SHA2-256': 'SHA-256',
		'SHA2-384': 'SHA-384',
		'GOST': 'GOST',
	}

	@classmethod
	def generate_config(cls, policy):
		ip = policy.disabled
		s = ''

		s += 'disable-algorithms "." {\n'
		s += 'RSAMD5;\n'  # deprecated, disabled unconditionally
		s += 'ECCGOST;\n'  # deprecated, disabled unconditionally, no such knob
		for i in ip['sign']:
			try:
				for disabled_sign in cls.sign_not_map[i]:
					s += f'{disabled_sign};\n'
			except KeyError:
				pass
		if 'ECDSA-SHA256' not in ip['sign'] and 'SECP256R1' in ip['group']:
			s += 'ECDSAP256SHA256;\n'  # additionally disabled on lack of P-256
		if 'ECDSA-SHA384' not in ip['sign'] and 'SECP384R1' in ip['group']:
			s += 'ECDSAP384SHA384;\n'  # additionally disabled on lack of P-384
		s += '};\n'

		s += 'disable-ds-digests "." {\n'
		for i in ip['hash']:
			try:
				s += f'{cls.hash_not_map[i]};\n'
			except KeyError:
				pass
		s += '};\n'

		return s

	@classmethod
	def test_config(cls, config):
		fd, path = mkstemp()

		try:
			with os.fdopen(fd, 'w') as f:
				f.write('options {\n')
				f.write(config)
				f.write('\n};\n')
			try:
				_ = check_output(["/usr/sbin/named-checkconf", path])
			except CalledProcessError:
				cls.eprint("There is an error in bind generated policy")
				cls.eprint("Policy:\n%s" % config)
				return False
			except OSError:
				# Ignore missing check command
				pass
		finally:
			os.unlink(path)

		return True

Name	Size	Last Modified	Owner	Permissions
__pycache__	Dir	December 10 2023 3:44:18	root	0755
__init__.py	0.817 KB	August 01 2023 3:18:06	root	0644
bind.py	2.226 KB	August 01 2023 3:18:06	root	0644
configgenerator.py	0.392 KB	August 01 2023 3:18:06	root	0644
gnutls.py	5.474 KB	August 01 2023 3:18:06	root	0644
java.py	3.581 KB	August 01 2023 3:18:06	root	0644
krb5.py	1.609 KB	August 01 2023 3:18:06	root	0644
libreswan.py	4.714 KB	August 01 2023 3:18:06	root	0644
libssh.py	4.015 KB	August 01 2023 3:18:06	root	0644
nss.py	4.785 KB	August 01 2023 3:18:06	root	0644
openssh.py	8.184 KB	August 01 2023 3:18:06	root	0644
openssl.py	5.455 KB	August 01 2023 3:18:06	root	0644

2017 © D7net \| D704T team