shell bypass 403
3
."�d� � @ sd d dl mZmZ d dlmZ d dlZddlmZ G dd� de�ZG dd � d e�Z G d
d � d e�Z
dS ) � )�call�CalledProcessError)�mkstempN� )�ConfigGeneratorc @ s� e Zd ZdZdddddddddddddd d
dddddd d �Zd
dddddd�Zddddddd�Zddd d d d d d!d"d#� Zd$d%d&�Zd'd(d)d*d+d,d-d.�Z d/d0d1d2d3d4d5d6d7�Z
d8d9d:d;d<d=d>d?d7�Z e d@dA� �Z
dBS )C�OpenSSHGenerator� zaes256-gcm@openssh.comz
aes256-ctrz
aes192-ctrzaes128-gcm@openssh.comz
aes128-ctrz chacha20-poly1305@openssh.comz
aes256-cbcz
aes192-cbcz
aes128-cbcz3des-cbc)z AES-256-GCMz AES-256-CTRz AES-192-GCMz AES-192-CTRz AES-128-GCMz AES-128-CTRzCHACHA20-POLY1305zCAMELLIA-256-GCMz AES-256-CCMz AES-192-CCMz AES-128-CCMzCAMELLIA-128-GCMz AES-256-CBCz AES-192-CBCz AES-128-CBCzCAMELLIA-256-CBCzCAMELLIA-128-CBCzRC4-128zDES-CBCzCAMELLIA-128-CTSz3DES-CBCzhmac-md5-etm@openssh.comzumac-64-etm@openssh.comzumac-128-etm@openssh.comzhmac-sha1-etm@openssh.comz hmac-sha2-256-etm@openssh.comz hmac-sha2-512-etm@openssh.com)zHMAC-MD5zUMAC-64zUMAC-128z HMAC-SHA1z
HMAC-SHA2-256z
HMAC-SHA2-512zhmac-md5zumac-64@openssh.comzumac-128@openssh.comz hmac-sha1z
hmac-sha2-256z
hmac-sha2-512zecdh-sha2-nistp521zecdh-sha2-nistp384zecdh-sha2-nistp256z.curve25519-sha256,curve25519-sha256@libssh.orgzdiffie-hellman-group1-sha1zdiffie-hellman-group14-sha1z diffie-hellman-group14-sha256z diffie-hellman-group16-sha512z diffie-hellman-group18-sha512) zECDHE-SECP521R1-SHA2-512zECDHE-SECP384R1-SHA2-384zECDHE-SECP256R1-SHA2-256zECDHE-X25519-SHA2-256zDHE-FFDHE-1024-SHA1zDHE-FFDHE-2048-SHA1zDHE-FFDHE-2048-SHA2-256zDHE-FFDHE-4096-SHA2-512zDHE-FFDHE-8192-SHA2-512z"diffie-hellman-group-exchange-sha1z$diffie-hellman-group-exchange-sha256)zDHE-SHA1z DHE-SHA2-256z
gss-gex-sha1-zgss-group1-sha1-zgss-group14-sha1-zgss-group14-sha256-zgss-nistp256-sha256-zgss-curve25519-sha256-zgss-group16-sha512-)z DHE-GSS-SHA1zDHE-GSS-FFDHE-1024-SHA1zDHE-GSS-FFDHE-2048-SHA1zDHE-GSS-FFDHE-2048-SHA2-256z ECDHE-GSS-SECP256R1-SHA2-256zECDHE-GSS-X25519-SHA2-256zDHE-GSS-FFDHE-4096-SHA2-512zssh-rsazssh-dssz rsa-sha2-256z rsa-sha2-512zecdsa-sha2-nistp256zecdsa-sha2-nistp384zecdsa-sha2-nistp521z ssh-ed25519)zRSA-SHA1zDSA-SHA1z RSA-SHA2-256z RSA-SHA2-512zECDSA-SHA2-256zECDSA-SHA2-384zECDSA-SHA2-512z
EDDSA-ED25519z ssh-rsa-cert-v01@openssh.comz ssh-dss-cert-v01@openssh.comz!rsa-sha2-256-cert-v01@openssh.comz!rsa-sha2-512-cert-v01@openssh.comz(ecdsa-sha2-nistp256-cert-v01@openssh.comz(ecdsa-sha2-nistp384-cert-v01@openssh.comz(ecdsa-sha2-nistp521-cert-v01@openssh.comz ssh-ed25519-cert-v01@openssh.comc & C s� |j }d}d}d}x>|d D ]2} y| j|| j| |�}W q tk
rL Y q X q W |rh|| jjd|�7 }d}|jd r�x>|d D ]2} y| j|| j| |�}W q� tk
r� Y q�X q�W x>|d D ]2} y| j|| j| |�}W q� tk
r� Y q�X q�W |�r|| jjd|�7 }d}d}
�xF|d D �]8} �x.|d D �] } |jd
�r�y$| j | d | }
| j||
|�}W n tk
�r� Y nX y"|| d | }
| j|
|
|�}
W n tk
�r� Y nX x�|d D ]�}y*|| d | d | }
| j||
|�}W n tk
�r
Y nX y*|| d | d | }
| j|
|
|�}
W n tk
�rL Y nX �q�W �q4W �q"W |
�rz|| jjd
|
�7 }n|| jjdd�7 }|�r�|| jjd|�7 }d}x�|d D ]v} y| j|| j
| |�}W n tk
�r� Y nX |jd dk�r�y| j|| j | |�}W n tk
�r$ Y nX �q�W |�r\|�rJ|| jjd|�7 }|| jjd|�7 }d}xB|d D ]6} y| j|| j
| |�}W n tk
�r� Y nX �qjW |�r�|| jjd|�7 }|S )Nr �,ZcipherZCiphersZssh_etmZmacZMACsZ key_exchange�hashZarbitrary_dh_groups�-�groupZGSSAPIKexAlgorithmsZGSSAPIKeyExchange�noZ
KexAlgorithmsZsignZ ssh_certsr ZHostKeyAlgorithmsZPubkeyAcceptedKeyTypesZCASignatureAlgorithms) Zenabled�append�
cipher_map�KeyError�_FORMAT_STRING�formatZintegers� mac_map_etm�mac_map�gx_map�sign_map�sign_map_certs)�cls�policy� local_kx_map�local_gss_kx_mapZ do_host_key�p�cfg�sep�s�iZgssZkx�h�val�g� r$ �>./usr/share/crypto-policies/python/policygenerators/openssh.py�generate_optionsl s�
z!OpenSSHGenerator.generate_optionsN)�__name__�
__module__� __qualname__r r r r �kx_mapr �
gss_kx_mapr r � classmethodr& r$ r$ r$ r% r s� r c @ s6 e Zd ZdZdddhZdZedd� �Zedd� �Zd S )
�OpenSSHClientGenerator�openssh�sshzopenssh-clientz{0} {1}
c C s$ t | j�}t | j�}| j|||d�S )NF)�dictr* r+ r& )r r r r r$ r$ r% �generate_config� s
z&OpenSSHClientGenerator.generate_configc C s� t jdt j�sdS t� \}}d}z^t j|d��}|j|� W d Q R X ytd| d dd�}W n tk
rz | jd� Y nX W d t j |� X |r�| jd � | jd
| � d S dS ) Nz /usr/bin/sshT� �wz/usr/bin/ssh -G -F z bogus654_server >/dev/null)�shellz /usr/bin/ssh: Execution failedz-There is an error in OpenSSH generated policyz
Policy:
%sF)
�os�access�X_OKr �fdopen�writer r �eprint�unlink)r �config�fd�path�ret�fr$ r$ r% � test_config� s&
z"OpenSSHClientGenerator.test_configN) r' r( r) � CONFIG_NAME�SCOPESr r, r1 rA r$ r$ r$ r% r- � s
r- c @ sR e Zd ZdZdddhZdZdZedd� �Zed d
� �Z ed d � �Z
ed
d� �Z dS )�OpenSSHServerGeneratorZ
opensshserverr/ r. zopenssh-serverz4systemctl try-restart sshd.service 2>/dev/null || :
z
-o{0}={1} c C sD t | j�}t | j�}|d= |d= | j|||d�}|j� }d| d S )NzDHE-FFDHE-1024-SHA1zDHE-GSS-FFDHE-1024-SHA1TzCRYPTO_POLICY='�')r0 r* r+ r& �rstrip)r r r r r r$ r$ r% r1 s
z&OpenSSHServerGenerator.generate_configc C sf t � \}}tj|� d}ytd| d dd�}W n tk
rN | jd� Y nX |rb| jd� dS |S ) Nr2 z&/usr/bin/ssh-keygen -t rsa -b 2048 -f z -N "" >/dev/nullT)r4 z%/usr/bin/ssh-keygen: Execution failedz4SSH Keygen failed when testing OpenSSH server policyr )r r5 r; r r r: )r Z_fdr> r? r$ r$ r% � _test_setup
s
z"OpenSSHServerGenerator._test_setupc C s |rt j|� d S )N)r5 r; )r r> r$ r$ r% �
_test_cleanup s z$OpenSSHServerGenerator._test_cleanupc C s� t jdt j�sdS | j� }|s"dS t� \}}d}zft j|d��}|j|� W d Q R X y td| d | d dd �}W n tk
r� | j d
� Y nX W d t j
|� | j |� X |r�| j d � | j d | � dS dS )
Nz/usr/sbin/sshdTFr2 r3 z/usr/bin/bash -c 'source z( && /usr/sbin/sshd -T $CRYPTO_POLICY -h z -f /dev/null' >/dev/null)r4 z /usr/sbin/sshd: Execution failedz4There is an error in OpenSSH server generated policyz
Policy:
%s) r5 r6 r7 rG r r8 r9 r r r: r; rH )r r< Zhost_key_filenamer= r> r? r@ r$ r$ r% rA # s0
z"OpenSSHServerGenerator.test_configN) r' r( r) rB rC Z
RELOAD_CMDr r, r1 rG rH rA r$ r$ r$ r% rD � s
rD ) �
subprocessr r Ztempfiler r5 Zconfiggeneratorr r r- rD r$ r$ r$ r% �<module> s C(