3
bW9 @ sH d Z ddlmZ ddlZddlZddlZddlZddlZddl Zddl
Zddl Zddl Zddl
ZddlmZ G dd dejjZG dd d ejjZdZd
Zd Zd Zd
ZdZdZdZdZ dZ dZ dZ dZ dZ!eeeeeeeee e e e e e!dZ"e#dd e"j$ D Z%dd Z&d d Z'd d Z(dDd d!Z)dEd"d#Z*d$d% Z+d&d' Z,d(d) Z-d*d+ Z.d,d- Z/d.d/ Z0d0d1 Z1d2d3 Z2d4d5 Z3d6d7 Z4d8d9 Z5dFd:d;Z6dGdd? Z8y(ddl9Z:ddl;Z:ddld@Z?W n" e@k
r e8Z=e8Z>dAZ?Y nX y8ddlAZAddlBZAddlCZAddlDZAd@ZEG dBdC dCeFZGW n e@k
rB dAZEY nX dS )Hz.Common DNSSEC-related functions and constants. )BytesION ) string_typesc @ s e Zd ZdZdS )UnsupportedAlgorithmz&The DNSSEC algorithm is not supported.N)__name__
__module__ __qualname____doc__ r
r
/usr/lib/python3.6/dnssec.pyr ! s r c @ s e Zd ZdZdS )ValidationFailurez The DNSSEC signature is invalid.N)r r r r r
r
r
r r & s r
)RSAMD5DHDSAECCRSASHA1 DSANSEC3SHA1RSASHA1NSEC3SHA1 RSASHA256 RSASHA512INDIRECTECDSAP256SHA256ECDSAP384SHA384
PRIVATEDNS
PRIVATEOIDc c s | ]\}}||fV qd S )Nr
).0xyr
r
r N s r+ c C s" t j| j }|dkr t| }|S )z:Convert text into a DNSSEC algorithm value
@rtype: intN)_algorithm_by_textgetupperint)textvaluer
r
r algorithm_from_textQ s r2 c C s t j| }|dkrt| }|S )z;Convert a DNSSEC algorithm value to text
@rtype: stringN)_algorithm_by_valuer- str)r1 r0 r
r
r algorithm_to_text[ s
r5 c C s t }| j||d |j S )N)origin)r to_wiregetvalue)recordr6 sr
r
r _to_rdatae s r; c C s t | |}t|}| jtkr0|d d> |d S d}x |d| d 7 }qFW t|d dkr||t|d d> 7 }||d? d@ 7 }|d@ S d S )
Nr r r
r r i )r; bytearray algorithmr rangelen)keyr6 rdataZtotalir
r
r key_idk s
rF c C s |j dkr d}tjjd }n,|j dkr@d}tjjd }n td| t| trdtjj| |} |j | j
j |j t || |j
}tjdt||j|| }tjjtjjtjj|dt|S )NSHA1r SHA256r
zunsupported algorithm "%s"z!HBBr )r. dnshashhashesr
isinstancer name from_textupdateZ canonicalizer7 r; digeststructpackrF r@ rD Z from_wire
rdataclassIN rdatatypeZDSrB )rM rC r@ r6 ZdsalgrJ rP Zdsrdatar
r
r make_ds{ s
rV c C s g }| j |j}|d kr d S t|tjjrZy|jtjjtj j
}W q^ t k
rV d S X n|}x0|D ](}|j |j krdt
||jkrd|j| qdW |S )N)r- signerrL rI ZnodeZNodeZ
find_rdatasetrS rT rU ZDNSKEYKeyErrorr@ rF Zkey_tagappend)keysrrsigZcandidate_keysr1 rdatasetrD r
r
r _find_candidate_keys s
r] c C s | t ttttfkS )N)r r r r! r" )r@ r
r
r _is_rsa s r^ c C s | t tfkS )N)r r )r@ r
r
r _is_dsa s r_ c C s t o| ttfkS )N) _have_ecdsar$ r% )r@ r
r
r _is_ecdsa s ra c C s | t kS )N)r )r@ r
r
r _is_md5 s rb c C s | t tttfkS )N)r r r r )r@ r
r
r _is_sha1 s rc c C s | t tfkS )N)r! r$ )r@ r
r
r
_is_sha256 s rd c C s | t kS )N)r% )r@ r
r
r
_is_sha384 s re c C s | t kS )N)r" )r@ r
r
r
_is_sha512 s rf c C s~ t | rtjjd S t| r,tjjd S t| rBtjjd S t| rXtjjd S t| rntjjd S td| d S )NZMD5rG rH ZSHA384ZSHA512z unknown hash for algorithm %u) rb rI rJ rK rc rd re rf r )r@ r
r
r
_make_hash s rg c C s t | r ddddddddg}ndt| r6dd d
dd g}nLt| rVd ddd
dd
ddd
g }n,t| rvd ddd
dd
ddd
g }n td| t|}t| j}dgd| | g d|d g d|g | ddg d|g }tj dt| f| S )N* H r r
r + r r ` r e r zunknown algorithm %u0 r r r z!%dB)
rb rc rd rf r rB rg Z digest_sizerQ rR )r@ ZoidZolenZdlenZidbytesr
r
r _make_algorithm_id s
<rq c ) C s t |tr tjj|tjj}xt||D ]}|srL r rI rM rN rootr] r tupletimeZ
expirationZ inceptionrg r@ r^ rC rQ unpackrB CryptoZ PublicKeyZRSAZ constructUtilnumber
bytes_to_longZ signaturer_ r ra r$ ecdsaZcurvesZNIST256pr% ZNIST384pZpoint_is_valid generatorAssertionErrorZ
ellipticcurveZPointcurveorderrZ Z VerifyingKeyZfrom_public_point ECKeyWrapperZ SignaturerO r; rW Z
to_digestableZlabelssplitrR ZrdtypeZrdclassZ original_ttlsortedrP rq verify))rrsetr[ rZ r6 nowZ
candidate_keyrrnamer\ rJ ZkeyptrZbytes_Zrsa_eZrsa_nZkeylenpubkeysigtZoctetsZdsa_qZdsa_pZdsa_gZdsa_yZdsa_rZdsa_sr key_lenr) r* ZpointZ
verifying_keyrr: suffixZ rrnamebufZrrfixedZrrlistZrrZrrdataZrrlenrP Zpadlenr
r
r _validate_rrsig s
" r c
C s t |tr tjj|tjj}t | tr0| d }n| j}t |trR|d }|d }n
|j}|}|j|}|j|}||krtdx6|D ].}yt | |||| dS tk
r Y qX qW tddS )ah Validate an RRset
@param rrset: The RRset to validate
@type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param rrsigset: The signature RRset
@type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param keys: The key dictionary.
@type keys: a dictionary keyed by dns.name.Name with node or rdataset
values
@param origin: The origin to use for relative names
@type origin: dns.name.Name or None
@param now: The time to use when validating the signatures. The default
is the current time.
@type now: int
r r zowner names do not matchNzno RRSIGs validated)
rL r rI rM rN rx ry Zchoose_relativityr r ) r ZrrsigsetrZ r6 r r Z rrsignameZ
rrsigrdatasetr[ r
r
r _validatex s*
r c O s t dd S )Nz#DNSSEC validation requires pycrypto)NotImplementedError)argskwargsr
r
r _need_pycrypto s r TFc @ s e Zd Zdd Zdd ZdS )r c C s || _ || _d S )N)rC r )selfrC r r
r
r __init__ s zECKeyWrapper.__init__c C s t jjj|}| jjj||S )N)r| r} r~ r rC r Zverifies)r rP r Zdiglongr
r
r r s zECKeyWrapper.verifyN)r r r r r r
r
r
r r s r )N)N)NN)NN)Hr ior rQ rz Z
dns.exceptionrI Zdns.hashZdns.nameZdns.nodeZ dns.rdatasetZ dns.rdataZ
dns.rdatatypeZdns.rdataclassZ_compatr Z exceptionZ DNSExceptionr r r r r r r r r r! r" r$ r% r# r& r' r, dictitemsr3 r2 r5 r; rF rV r] r^ r_ ra rb rc rd re rf rg rq r r r ZCrypto.PublicKey.RSAr| ZCrypto.PublicKey.DSAZCrypto.Util.numberZvalidateZvalidate_rrsigZ_have_pycrypto ImportErrorr Z ecdsa.ecdsaZecdsa.ellipticcurveZ
ecdsa.keysr` objectr r
r
r
r s
0