JFIF $
d d 7
Viewing File: /usr/share/crypto-policies/python/policygenerators/libreswan.py
# SPDX-License-Identifier: LGPL-2.1-or-later
# Copyright (c) 2019 Red Hat, Inc.
# Copyright (c) 2019 Tomáš Mráz <tmraz@fedoraproject.org>
import os
from subprocess import CalledProcessError, call
from tempfile import mkstemp
from .configgenerator import ConfigGenerator
class LibreswanGenerator(ConfigGenerator):
CONFIG_NAME = 'libreswan'
SCOPES = {'ipsec', 'ike', 'libreswan'}
RELOAD_CMD = 'systemctl try-restart ipsec.service 2>/dev/null || :\n'
group_map = {
'X448': '',
'X25519': 'dh31',
'SECP256R1': 'dh19',
'SECP384R1': 'dh20',
'SECP521R1': 'dh21',
'FFDHE-6144': '',
'FFDHE-1536': 'dh5',
'FFDHE-2048': 'dh14',
'FFDHE-3072': 'dh15',
'FFDHE-4096': 'dh16',
'FFDHE-8192': 'dh18'
}
cipher_map = {
'AES-256-CBC': 'aes256',
'AES-192-CBC': 'aes192',
'AES-128-CBC': 'aes128',
'AES-256-GCM': 'aes_gcm256',
'AES-192-GCM': 'aes_gcm192',
'AES-128-GCM': 'aes_gcm128',
'CHACHA20-POLY1305': 'chacha20_poly1305'
# Unused for IKEv2
# '3DES-CBC':'3des'
}
cipher_prf_map = {
'AES-256-CBC-HMAC-SHA2-512': 'sha2_512',
'AES-256-CBC-HMAC-SHA2-256': 'sha2_256',
'AES-192-CBC-HMAC-SHA2-512': 'sha2_512',
'AES-192-CBC-HMAC-SHA2-256': 'sha2_256',
'AES-128-CBC-HMAC-SHA2-256': 'sha2_256',
# Not needed for IKEv2
# 'AES-256-CBC-HMAC-SHA1':'sha1',
# 'AES-128-CBC-HMAC-SHA1':'sha1',
'AES-256-GCM-HMAC-SHA2-512': 'sha2_512',
'AES-256-GCM-HMAC-SHA2-256': 'sha2_256',
'AES-192-GCM-HMAC-SHA2-512': 'sha2_512',
'AES-192-GCM-HMAC-SHA2-256': 'sha2_256',
'AES-128-GCM-HMAC-SHA2-512': 'sha2_512',
'AES-128-GCM-HMAC-SHA2-256': 'sha2_256',
'CHACHA20-POLY1305-HMAC-SHA2-512': 'sha2_512',
'CHACHA20-POLY1305-HMAC-SHA2-256': 'sha2_256'
# '3DES-CBC-HMAC-SHA1':'sha1'
}
cipher_mac_map = {
'AES-256-CBC-HMAC-SHA2-512': 'sha2_512',
'AES-192-CBC-HMAC-SHA2-512': 'sha2_512',
'AES-256-CBC-HMAC-SHA2-256': 'sha2_256',
'AES-192-CBC-HMAC-SHA2-256': 'sha2_256',
'AES-128-CBC-HMAC-SHA2-256': 'sha2_256',
'AES-256-CBC-HMAC-SHA1': 'sha1',
'AES-192-CBC-HMAC-SHA1': 'sha1',
'AES-128-CBC-HMAC-SHA1': 'sha1',
'AES-256-GCM-AEAD': '',
'AES-192-GCM-AEAD': '',
'AES-128-GCM-AEAD': '',
'CHACHA20-POLY1305-AEAD': ''
# '3DES-CBC-HMAC-SHA1':'3des-sha1'
}
sign_map = {
'RSA-SHA1': 'rsa-sha1',
'ECDSA-SHA2-256': 'ecdsa-sha2_256',
'ECDSA-SHA2-384': 'ecdsa-sha2_384',
'ECDSA-SHA2-512': 'ecdsa-sha2_512',
'RSA-PSS-SHA2-256': 'rsa-sha2_256',
'RSA-PSS-SHA2-384': 'rsa-sha2_384',
'RSA-PSS-SHA2-512': 'rsa-sha2_512',
'RSA-PSS-RSAE-SHA2-256': 'rsa-sha2_256',
'RSA-PSS-RSAE-SHA2-384': 'rsa-sha2_384',
'RSA-PSS-RSAE-SHA2-512': 'rsa-sha2_512'
}
mac_ike_prio_map = {
'AEAD': 0,
'HMAC-SHA2-512': 1,
'HMAC-SHA2-256': 2,
'HMAC-SHA1': 3
}
mac_esp_prio_map = {
'AEAD': 0,
'HMAC-SHA2-512': 1,
'HMAC-SHA1': 2,
'HMAC-SHA2-256': 3
}
group_prio_map = {
# sorted() guarantees stable order so we just put the two
# most common groups first to avoid extra roundtrips
'SECP256R1': 0,
'FFDHE-2048': 1
}
@classmethod
def __get_ike_prio(cls, key): # pylint: disable=unused-private-member
if key not in cls.mac_ike_prio_map:
return 99
return cls.mac_ike_prio_map[key]
@classmethod
def __get_esp_prio(cls, key): # pylint: disable=unused-private-member
if key not in cls.mac_esp_prio_map:
return 99
return cls.mac_esp_prio_map[key]
@classmethod
def __get_group_prio(cls, key): # pylint: disable=unused-private-member
if key not in cls.group_prio_map:
return 99
return cls.group_prio_map[key]
@classmethod
def generate_config(cls, policy):
cfg = 'conn %default\n'
sep = ','
p = policy.enabled
s = ''
proto = [x for x in p['protocol'] if x.startswith('IKE')]
if 'IKEv2' in proto:
s = 'ikev2=insist'
elif 'IKEv1' in proto: # and 'IKEv2' not in proto
s = 'ikev2=never'
if s:
cfg += '\t' + s + '\n'
cfg += '\tpfs=yes\n'
sorted_macs = sorted(p['mac'],
key=cls.__get_ike_prio)
sorted_groups = sorted(p['group'],
key=cls.__get_group_prio)
tmp = ''
for cipher in p['cipher']:
try:
cm = cls.cipher_map[cipher]
except KeyError:
continue
combo = cm + '-'
s = ''
for mac in sorted_macs:
try:
mm = cls.cipher_prf_map[cipher + '-' + mac]
except KeyError:
continue
s = cls.append(s, mm, '+')
if not s:
continue
combo += s
s = ''
for i in sorted_groups:
try:
group = cls.group_map[i]
except KeyError:
continue
s = cls.append(s, group, '+')
combo = cls.append(combo, s, '-')
tmp = cls.append(tmp, combo, sep)
if tmp:
cfg += '\tike=' + tmp + '\n'
sorted_macs = sorted(p['mac'],
key=cls.__get_esp_prio)
tmp = ''
for cipher in p['cipher']:
try:
cm = cls.cipher_map[cipher]
except KeyError:
continue
combo = cm + '-'
s = ''
for mac in sorted_macs:
try:
mm = cls.cipher_mac_map[cipher + '-' + mac]
except KeyError:
continue
if not mm:
# Special handling for AEAD
combo = cm
break
s = cls.append(s, mm, '+')
combo += s
if combo[-1:] == '-':
continue
tmp = cls.append(tmp, combo, sep)
if tmp:
cfg += '\tesp=' + tmp + '\n'
tmp = ''
sigalgs = set()
for sign in p['sign']:
try:
sm = cls.sign_map[sign]
except KeyError:
continue
if sm not in sigalgs:
sigalgs.add(sm)
tmp = cls.append(tmp, sm, sep)
if tmp:
cfg += '\tauthby=' + tmp + '\n'
return cfg
@classmethod
def test_config(cls, config):
if not os.access('/usr/sbin/ipsec', os.X_OK):
return True
fd, path = mkstemp()
ret = 255
try:
with os.fdopen(fd, 'w') as f:
f.write(config)
try:
ret = call(f'/usr/sbin/ipsec readwriteconf --config {path}'
' >/dev/null', shell=True)
except CalledProcessError:
cls.eprint("/usr/sbin/ipsec: Execution failed")
finally:
os.unlink(path)
if ret:
cls.eprint('There is an error in libreswan generated policy')
cls.eprint(f'Policy:\n{config}')
return False
return True
Back to Directory
nL+D550H?Mx ,D"v]qv;6*Zqn)ZP 0 !1 A "#a$2Qr D8 a Ri[f\mIykIw0 cuFcRı?lO7к_f˓[C$殷WF<_W ԣs KcëIzyQy /_LKℂ;C",pFA: /]=H ~,ls/9ć:[=/#f;)x {ٛEQ )~ =𘙲r*2~ a _V=' kumF D}KYYC)({ *g&f`툪ry`=^cJ.I](*`wq 1dđ#̩͑0;H]u搂@:~וKL Nsh}OIR*8:2 !lDJVo( 3=M(zȰ+i*NA r6KnSl )!JJӁ* %݉?|D}d5:eP0R;{$X'xF@.ÊB {,WJuQɲRI;9QE琯62fT.DUJ;*cP A\ILNj!J۱+O\ ͔]ޒ SJȧc%ANolՎprULZԛerE2=XDXgVQeӓk yP7U*omQIs,K`)6\G3t?pgjrmۛجwluGtf h9uyP0D;Uڽ"OXlif$)&|ML0Zrm1[HXPlPR0'G=i2N +0e2]] 9VTPO7h(F*癈 '=QVZDF,d߬~TX
G[`le69CR(!S2!P
<0x < !1AQ "Raq02Br#SCTb
?Ζ"]mH5WR7k.ۛ!}Q~+yԏz|@T20S~Kek *zFf^2X*(@8r?CIuI|֓>^ExLgNUY+{.RѪ
τVYTD I62'8Y2 7'\TP.6d&˦@Vqi|8- OΕ]ʔ U=TL8=;6c| !qfF3aů&~$l}'NWUs$Uk^SV:U# 6w++s&r+nڐ{@29 gL
u"TÙM=6 (^"7r} =6YݾlCuhquympǦ
G jhsǜNlɻ}o7 #S6aw4!OSrD57%|?x>L
|/nD6?/8w#[)L7+6〼T ATg ! %5MmZ/c-{1_Je"|^$'O&ޱմ Trb$ w)R$&
N1EtdU3Uȉ1pM" N*(DN yd96.(jQ)X
5cQɎMyW? Q*!R>6=7)Xj5`J]e 8%t!+'!1Q 5 !1 AQaqё#2"0BRb ? Gt^## .llQT $v,,m 㵜5 ubV =sY+@d{N! dnO< .-B; _wJt6;QJd.Qc%p{ 1,sNDdFHI0ГoXшe黅XۢF:)[FGXƹ/w_cMeD,ʡcc. WDtA$j@:) -# u
c1<@ۗ9F)KJ-hpP]_x[qBlbp ʖw q"LFGd ƶ*s+ډ_Zc"? %t[IP 6J]#=ɺVvvCGsGh1 >)6|ey?Lӣm,4GWUi` ]uJVoV DG< SB 6ϏQ@ TiUly OU0kfV~~}SZ@*WUUi##; s/[ =!7}" WN]'(L! ~y5g9T̅JkbM' +s:S + B)v@Mj
e Cf jE 0Y\QnzG1д~Wo{T 9?`Rmyhsy3!HAD]mc1~2L Su7xT;j$`}4->L#vzŏ ILS ֭ T { rjGKC; bpU= -`BsK.SFw4Mq]ZdHS0)tLg