3
7&j2g @ s: d dl Z d dljZd dljZd dlT d dlmZ G dd dZG dd dZG dd d e Z
G d
d d Z e d kr6d dl
Z
e
jd
dkree
jd Zej Zej ed
dZeje nxe
jd
dkr6y4e e
jd dddZeejd eejd W n2 e k
r4 Z zeejd W Y ddZ[X nX dS ) N)*)copyc
@ s e Zd Zd3Zed4 Zi ZdZdZdZdZ dZ
d d Z d d Z d d! Z
d"d# Zd$d% Zd&d' Zd(d) Zd*d+ Zd,d- Zd.d/ Zd0d1 Zd2S )5 PolicyLexPOLICYALGORITHM_POLICYZONE ALGORITHM DIRECTORYKEYTTLKEY_SIZE ROLL_PERIOD PRE_PUBLISH POST_PUBLISHCOVERAGESTANDBYNONE
DATESUFFIXKEYTYPEALGNAMESTRQSTRINGNUMBERLBRACERBRACESEMIz z (//|\#).*z\{z\};c C s |j j|jjd7 _dS )z\n+
N)lexerlinenovaluecount)selft r# /usr/lib/python3.6/policy.py t_newline7 s zPolicyLex.t_newlinec C s |j j|jjd7 _dS )z/\*(.|\n)*?\*/r N)r r r r )r! r" r# r# r$ t_comment; s zPolicyLex.t_commentc C s t jd|jjdj |_|S )z(?i)(?<=[0-9 \t])(y(?:ears|ear|ea|e)?|mo(?:nths|nth|nt|n)?|w(?:eeks|eek|ee|e)?|d(?:ays|ay|a)?|h(?:ours|our|ou|o)?|mi(?:nutes|nute|nut|nu|n)?|s(?:econds|econd|econ|eco|ec|e)?)\bz (?i)(y|mo|w|d|h|mi|s)([a-z]*) )rematchr grouplower)r! r" r# r# r$ t_DATESUFFIX? s zPolicyLex.t_DATESUFFIXc C s |j j |_ |S )z(?i)\b(KSK|ZSK)\b)r upper)r! r" r# r# r$ t_KEYTYPED s zPolicyLex.t_KEYTYPEc C s |j j |_ |S )z(?i)\b(RSAMD5|DH|DSA|NSEC3DSA|ECC|RSASHA1|NSEC3RSASHA1|RSASHA256|RSASHA512|ECCGOST|ECDSAP256SHA256|ECDSAP384SHA384|ED25519|ED448)\b)r r- )r! r" r# r# r$ t_ALGNAMEI s zPolicyLex.t_ALGNAMEc C s | j j|jd|_|S )z[A-Za-z._-][\w._-]*r ) reserved_mapgetr type)r! r" r# r# r$ t_STRN s zPolicyLex.t_STRc C s& | j j|jd|_|jdd |_|S )z"([^"\n]|(\\"))*"r r' )r0 r1 r r2 )r! r" r# r# r$ t_QSTRINGS s zPolicyLex.t_QSTRINGc C s t |j|_|S )z\d+)intr )r! r" r# r# r$ t_NUMBERY s zPolicyLex.t_NUMBERc C s" t d|jd |jjd d S )NzIllegal character '%s'r r' )printr r skip)r! r" r# r# r$ t_error^ s zPolicyLex.t_errorc K sb dt tkrtjdd}n
tdd}x"| jD ]}|| j|j j|< q,W tjf d| i|| _d S )N maketrans_-object) dirstrr; reservedr0 r+ translatelexr )r! kwargsZtransrr# r# r$ __init__b s
zPolicyLex.__init__c C s. | j j| x | j j }|s P t| qW d S )N)r inputtokenr8 )r! textr" r# r# r$ testk s
zPolicyLex.testN)
r r r r r r
r r r
r r r r ) r r r r r r r r r )__name__
__module__ __qualname__rA tokensr0 Zt_ignoreZt_ignore_olcommentZt_LBRACEZt_RBRACEZt_SEMIr% r& r, r. r/ r3 r5 r7 r: rF rJ r# r# r# r$ r sN r c
@ s e Zd ZdZdZdZdZdZdZdZ dZ
dZ dZ dZ
dZdZdZdZdZddgddgddgddgddgddgddgdddddd ZdddZd d
Zd d Zd
d Zdd Zdd ZdS )PolicyFNi i i ) DSANSEC3DSARSAMD5RSASHA1 NSEC3RSASHA1 RSASHA256 RSASHA512ECCGOSTECDSAP256SHA256ECDSAP384SHA384ED25519ED448c C s || _ || _|| _d S )N)name algorithmparent)r! r\ r] r^ r# r# r$ rF s zPolicy.__init__c C sF d| j r dp"| jrdp"| jr dp"d| jp*d| jr8| jjp:d| jrRdt| j d pTd| jp\d| jrlt| jpnd| j r~t| j pd| j
rt| j
pd| j rt| j pd| j rt| j pd| j
rt| j
pd| jrt| jpd| jrt| jpd| jrt| jpd| jrt| jpd| jr(t| jp*d| jr>t| jp@df S ) Na %spolicy %s:
inherits %s
directory %s
algorithm %s
coverage %s
ksk_keysize %s
zsk_keysize %s
ksk_rollperiod %s
zsk_rollperiod %s
ksk_prepublish %s
ksk_postpublish %s
zsk_prepublish %s
zsk_postpublish %s
ksk_standby %s
zsk_standby %s
keyttl %s
z constructed zzone z
algorithm ZUNKNOWNNone")is_constructedis_zoneis_algr\ r^ directoryr@ r] coverage ksk_keysize zsk_keysizeksk_rollperiodzsk_rollperiodksk_prepublishksk_postpublishzsk_prepublishzsk_postpublish ksk_standby zsk_standbykeyttl)r! r# r# r$ __repr__ s(
zPolicy.__repr__c C s |d | ko|d kS S )Nr r' r# )r! Zkey_sizeZ
size_ranger# r# r$ Z
__verify_size s zPolicy.__verify_sizec C s | j S )N)r\ )r! r# r# r$ get_name s zPolicy.get_namec C s | j S )N)rb )r! r# r# r$ constructed s zPolicy.constructedc C s$ | j r:| jdk r:| j| j kr:t| j dd| j| j f fS | j rj| jdk rj| j| j krjdd| j| j f fS | jr| jdk r| j| jkrdd| j| jf fS | jr| jdk r| j| jkrdd| j| jf fS | j o| jo| jo| j| j | j krdd| j| j| j f fS | jrL| jrL| jrL| j| j | jkrLdd| j| j| jf fS | jdk r | jj | j}|dk r| j
| j |sdd
| j |f fS | j
| j |sdd | j |f fS | jd kr| j d dkrdd | j fS | jd kr| j d dkrdd | j fS | jd kr d| _ d| _ d!S )"zr Check if the values in the policy make sense
:return: True/False if the policy passes validation
NFz6KSK pre-publish period (%d) exceeds rollover period %dz7KSK post-publish period (%d) exceeds rollover period %dz6ZSK pre-publish period (%d) exceeds rollover period %dz7ZSK post-publish period (%d) exceeds rollover period %dz%KSK pre/post-publish periods (%d/%d) z"combined exceed rollover period %dz%ZSK pre/post-publish periods (%d/%d) z&KSK key size %d outside valid range %sz&ZSK key size %d outside valid range %srP rQ @ r z$KSK key size %d not divisible by 64 zas required for DSAz$ZSK key size %d not divisible by 64 rW rX rY rZ r[ Tr_ zGKSK pre/post-publish periods (%d/%d) combined exceed rollover period %dzGZSK pre/post-publish periods (%d/%d) combined exceed rollover period %d)rP rQ z7KSK key size %d not divisible by 64 as required for DSA)rP rQ z7ZSK key size %d not divisible by 64 as required for DSA)rW rX rY rZ r[ )Tr_ )
ri rk r8 rl rj rm rn r] valid_key_sz_per_algor1 _Policy__verify_sizerg rh )r! Z key_sz_ranger# r# r$ validate s
zPolicy.validate)NNN)rK rL rM rc rd rb ri rj rk rm rl rn rg rh ro rp rq rf re rv rF rr rw rs rt rx r# r# r# r$ rO v sD
&rO c @ s e Zd ZdS )PolicyExceptionN)rK rL rM r# r# r# r$ ry ) s ry c @ s. e Zd Zi Zi Zi ZdZdZdZdEddZ dd Z
dd Z d d
Z d d Z
d
d Zdd Zdd Zdd Zdd Zdd Zdd Zdd Zd d Zd d Zd!d" Zd#d$ Zd%d& Zd'd( Zd)d* Z d+d, Z d-d. Z d/d0 Z d1d2 Z d3d4 Z!d5d6 Z"d7d8 Z#d9d: Z$d;d< Z%d=d> Z&d?d@ Z'dAdB Z(dCdD Z)dS )F
dnssec_policyNTc K s t | _| jj| _d|kr"d|d< d|kr2d|d< tjf d| i|| _| jd t }d |_d|_d|_ d|_
t || j d< d| j d _d| j d _
d | j d _ t || j d
< d
| j d
_d
| j d
_
d | j d
_ t || j d < d | j d _d | j d _
t || j d < d | j d _d | j d _
t || j d
< d
| j d
_d
| j d
_
t || j d< d| j d _d| j d _
t || j d< d| j d _d| j d _
t || j d< d| j d _d| j d _
t || j d< d| j d _d| j d _
d | j d _ d | j d _
t || j d< d| j d _d| j d _
d | j d _ d | j d _
t || j d< d| j d _d| j d _
d | j d _ d | j d _
t || j d< d| j d _d| j d _
d | j d _ d | j d _
|r| j| d S )NdebugF write_tablesmodulea policy global { algorithm rsasha256;
key-size ksk 2048;
key-size zsk 2048;
roll-period ksk 0;
roll-period zsk 1y;
pre-publish ksk 1mo;
pre-publish zsk 1mo;
post-publish ksk 1mo;
post-publish zsk 1mo;
standby ksk 0;
standby zsk 0;
keyttl 1h;
coverage 6mo; };
policy default { policy global; };Ti rP i rQ rR rS rT rU rV rW rX rY rZ r[ )r plexrN yaccparsersetuprO r] rd rg rh r
alg_policyr\ load)r! filenamerD pr# r# r$ rF 4 s|
zdnssec_policy.__init__c C sH || _ d| _t|$}|j }d| jj_| jj| W d Q R X d | _ d S )NTr ) r initialopenreadr~ r r r parse)r! r frI r# r# r$ r s
zdnssec_policy.loadc C s d| _ d| jj_| jj| d S )NTr )r r~ r r r r )r! rI r# r# r$ r s
zdnssec_policy.setupc K s` |j }d }|| jkr | j| }|d krBt| jd }||_d|_|jd kr|jpZ| jd }x|rr|j rr|j}q^W |r~|jpd |_|j| jkr| j|j }nt d|j
d kr|jp| jd }x|d k r|j
r|j}qW |o|j
|_
|j d kr:|jp| jd }x |r"|j r"|j}qW |r2|j p6|j |_ |j d kr|jpV| jd }x |jrv|j rv|j}qZW |r|j p|j |_ |j
d kr|jp| jd }x |jr|j
r|j}qW |r|j
p|j
|_
|jd kr6|jp| jd }x |jr |j r |j}qW |r.|jp2|j|_|jd kr|jpR| jd }x |jrr|j rr|j}qVW |r|jp|j|_|jd kr|jp| jd }x |jr|j r|j}qW |r|jp|j|_|jd kr2|jp| jd }x |jr|j r|j}qW |r*|jp.|j|_|jd kr|jpN| jd }x |jrn|j rn|j}qRW |r~|jp|j|_|jd kr|jp| jd }x |jr|j r|j}qW |r|jp|j|_|jd kr(|jp| jd }x |d k r|j r|j}qW |o$|j|_d|ks>|d r\|j \}}|s\t |d S |S )NdefaultTzalgorithm not foundZ
novalidate)r+ zone_policyr named_policyr\ rb r] r^ r ry re rf rg rh ri rj rk rm rl rn rq rx ) r! ZzonerD zr r^ ZapZvalidmsgr# r# r$ policy s
zdnssec_policy.policyc C s dS )zBpolicylist : init policy
| policylist policyNr# )r! r r# r# r$ p_policylist
s zdnssec_policy.p_policylistc C s
d| _ dS )zinit :FN)r )r! r r# r# r$ p_init s zdnssec_policy.p_initc C s dS )zTpolicy : alg_policy
| zone_policy
| named_policyNr# )r! r r# r# r$ p_policy s zdnssec_policy.p_policyc C s |d |d< dS )zAname : STR
| KEYTYPE
| DATESUFFIXr' r Nr# )r! r r# r# r$ p_name s zdnssec_policy.p_namec C s, |d j |d< tjd|d s(tddS )zcdomain : STR
| QSTRING
| KEYTYPE
| DATESUFFIXr' r z^[\w.-][\w.-]*$zinvalid domainN)stripr( r) ry )r! r r# r# r$ p_domain s zdnssec_policy.p_domainc C s t | _dS )z new_policy :N)rO current)r! r r# r# r$ p_new_policy* s zdnssec_policy.p_new_policyc C s( |d | j _d| j _| j | j|d < dS )zFalg_policy : ALGORITHM_POLICY ALGNAME new_policy alg_option_group SEMI TN)r r\ rd r )r! r r# r# r$ p_alg_policy. s zdnssec_policy.p_alg_policyc C s8 |d j d| j_d| j_| j| j|d j dj < dS )z=zone_policy : ZONE domain new_policy policy_option_group SEMIr .TN)rstripr r\ rc r r+ )r! r r# r# r$
p_zone_policy5 s zdnssec_policy.p_zone_policyc C s$ |d | j _| j | j|d j < dS )z>named_policy : POLICY name new_policy policy_option_group SEMIr N)r r\ r r+ )r! r r# r# r$ p_named_policy< s z dnssec_policy.p_named_policyc C s |d |d< dS )zduration : NUMBERr' r Nr# )r! r r# r# r$ p_duration_1B s zdnssec_policy.p_duration_1c C s d|d< dS )zduration : NONENr r# )r! r r# r# r$ p_duration_2G s zdnssec_policy.p_duration_2c C s |d dkr |d d |d< n|d dkr<|d d |d< n|d dkrZ|d d |d< n||d d
krx|d d |d< n^|d d kr|d d
|d< n@|d dkr|d d |d< n"|d dkr|d |d< nt ddS )z duration : NUMBER DATESUFFIXr yr' i3r moi ' wi: diQ hi Zmi< szinvalid durationN)ry )r! r r# r# r$ p_duration_3L s zdnssec_policy.p_duration_3c C s dS )z6policy_option_group : LBRACE policy_option_list RBRACENr# )r! r r# r# r$ p_policy_option_group_ s z#dnssec_policy.p_policy_option_groupc C s dS )zmpolicy_option_list : policy_option SEMI
| policy_option_list policy_option SEMINr# )r! r r# r# r$ p_policy_option_listc s z"dnssec_policy.p_policy_option_listc C s dS )a policy_option : parent_option
| directory_option
| coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keysize_option
| algorithm_option
| keyttl_option
| standby_optionNr# )r! r r# r# r$ p_policy_optionh s z dnssec_policy.p_policy_optionc C s dS )z0alg_option_group : LBRACE alg_option_list RBRACENr# )r! r r# r# r$ p_alg_option_groupu s z dnssec_policy.p_alg_option_groupc C s dS )z^alg_option_list : alg_option SEMI
| alg_option_list alg_option SEMINr# )r! r r# r# r$ p_alg_option_listy s z dnssec_policy.p_alg_option_listc C s dS )a alg_option : coverage_option
| rollperiod_option
| prepublish_option
| postpublish_option
| keyttl_option
| keysize_option
| standby_optionNr# )r! r r# r# r$ p_alg_option~ s zdnssec_policy.p_alg_optionc C s | j |d j | j_dS )zparent_option : POLICY namer N)r r+ r r^ )r! r r# r# r$ p_parent_option s z dnssec_policy.p_parent_optionc C s |d | j _dS )z$directory_option : DIRECTORY QSTRINGr N)r re )r! r r# r# r$ p_directory_option s z dnssec_policy.p_directory_optionc C s |d | j _dS )z#coverage_option : COVERAGE durationr N)r rf )r! r r# r# r$ p_coverage_option s z dnssec_policy.p_coverage_optionc C s* |d dkr|d | j _n |d | j _dS )z0rollperiod_option : ROLL_PERIOD KEYTYPE durationr KSK N)r ri rj )r! r r# r# r$ p_rollperiod_option s z!dnssec_policy.p_rollperiod_optionc C s* |d dkr|d | j _n |d | j _dS )z0prepublish_option : PRE_PUBLISH KEYTYPE durationr r r N)r rk rm )r! r r# r# r$ p_prepublish_option s z!dnssec_policy.p_prepublish_optionc C s* |d dkr|d | j _n |d | j _dS )z2postpublish_option : POST_PUBLISH KEYTYPE durationr r r N)r rl rn )r! r r# r# r$ p_postpublish_option s z"dnssec_policy.p_postpublish_optionc C s* |d dkr|d | j _n |d | j _dS )z(keysize_option : KEY_SIZE KEYTYPE NUMBERr r r N)r rg rh )r! r r# r# r$ p_keysize_option s z dnssec_policy.p_keysize_optionc C s* |d dkr|d | j _n |d | j _dS )z'standby_option : STANDBY KEYTYPE NUMBERr r r N)r ro rp )r! r r# r# r$ p_standby_option s z dnssec_policy.p_standby_optionc C s |d | j _dS )z keyttl_option : KEYTTL durationr N)r rq )r! r r# r# r$ p_keyttl_option s z dnssec_policy.p_keyttl_optionc C s |d | j _dS )z$algorithm_option : ALGORITHM ALGNAMEr N)r r] )r! r r# r# r$ p_algorithm_option s z dnssec_policy.p_algorithm_optionc C sd |r.t d| jpd| jrdnd|j|jf n2| js`td| jp@d| jrJdnd|rV|jpXdf d S )Nz %s%s%d:syntax error near '%s'r_ :z %s%s%d:unexpected end of inputr )r8 r r r r ry )r! r r# r# r$ p_error s zdnssec_policy.p_error)N)*rK rL rM r r r r r r rF r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r r# r# r# r$ rz , sN
_
h
rz __main__r' rC r )r{ r T)r| r{ r znonexistent.zone) r( Zply.lexrC Zply.yaccr stringr r rO Exceptionry rz rK sysargvr filer rI closer~ rJ Zppr8 r r eargsr# r# r# r$ s6
` 4 !