Your IP : 3.147.86.104
3
�b�W�9 � @ sH d Z ddlmZ ddlZddlZddlZddlZddlZddl Zddl
Zddl Zddl Zddl
ZddlmZ G dd� dejj�ZG dd � d ejj�ZdZd
Zd Zd Zd
ZdZdZdZdZ dZ dZ dZ dZ dZ!eeeeeeeee e e e e e!d�Z"e#dd� e"j$� D ��Z%dd� Z&d d � Z'd d � Z(dDd d!�Z)dEd"d#�Z*d$d%� Z+d&d'� Z,d(d)� Z-d*d+� Z.d,d-� Z/d.d/� Z0d0d1� Z1d2d3� Z2d4d5� Z3d6d7� Z4d8d9� Z5dFd:d;�Z6dGd<d=�Z7d>d?� Z8y(ddl9Z:ddl;Z:ddl<Z:e7Z=e6Z>d@Z?W n" e@k
�r� e8Z=e8Z>dAZ?Y nX y8ddlAZAddlBZAddlCZAddlDZAd@ZEG dBdC� dCeF�ZGW n e@k
�rB dAZEY nX dS )Hz.Common DNSSEC-related functions and constants.� )�BytesION� )� string_typesc @ s e Zd ZdZdS )�UnsupportedAlgorithmz&The DNSSEC algorithm is not supported.N)�__name__�
__module__� __qualname__�__doc__� r
r
� /usr/lib/python3.6/dnssec.pyr ! s r c @ s e Zd ZdZdS )�ValidationFailurez The DNSSEC signature is invalid.N)r r r r r
r
r
r r & s r � � � � � � � �
�
� � � � )�RSAMD5�DH�DSA�ECC�RSASHA1� DSANSEC3SHA1�RSASHA1NSEC3SHA1� RSASHA256� RSASHA512�INDIRECT�ECDSAP256SHA256�ECDSAP384SHA384�
PRIVATEDNS�
PRIVATEOIDc c s | ]\}}||fV qd S )Nr
)�.0�x�yr
r
r � <genexpr>N s r+ c C s" t j| j� �}|dkr t| �}|S )z:Convert text into a DNSSEC algorithm value
@rtype: intN)�_algorithm_by_text�get�upper�int)�text�valuer
r
r �algorithm_from_textQ s r2 c C s t j| �}|dkrt| �}|S )z;Convert a DNSSEC algorithm value to text
@rtype: stringN)�_algorithm_by_valuer- �str)r1 r0 r
r
r �algorithm_to_text[ s
r5 c C s t � }| j||d� |j� S )N)�origin)r �to_wire�getvalue)�recordr6 �sr
r
r � _to_rdatae s r; c C s� t | |�}t|�}| jtkr0|d d> |d S d}x<tt|�d �D ](}||d| d> |d| d 7 }qFW t|�d dkr�||t|�d d> 7 }||d? d@ 7 }|d@ S d S )
Nr r r
r r � i�� ������)r; � bytearray� algorithmr �range�len)�keyr6 �rdataZtotal�ir
r
r �key_idk s
rF c C s� |j � dkr d}tjjd � }n,|j � dkr@d}tjjd � }n td| ��t| t�rdtjj| |�} |j | j
� j � � |j t ||�� |j
� }tjdt|�|j|�| }tjjtjjtjj|dt|��S )N�SHA1r �SHA256r
zunsupported algorithm "%s"z!HBBr )r. �dns�hash�hashesr �
isinstancer �name� from_text�updateZ canonicalizer7 r; �digest�struct�packrF r@ rD Z from_wire�
rdataclass�IN� rdatatypeZDSrB )rM rC r@ r6 ZdsalgrJ rP Zdsrdatar
r
r �make_ds{ s
rV c C s� g }| j |j�}|d kr d S t|tjj�rZy|jtjjtj j
�}W q^ t k
rV d S X n|}x0|D ](}|j |j krdt
|�|jkrd|j|� qdW |S )N)r- �signerrL rI ZnodeZNodeZ
find_rdatasetrS rT rU ZDNSKEY�KeyErrorr@ rF Zkey_tag�append)�keys�rrsigZcandidate_keysr1 �rdatasetrD r
r
r �_find_candidate_keys� s
r] c C s | t ttttfkS )N)r r r r! r" )r@ r
r
r �_is_rsa� s r^ c C s | t tfkS )N)r r )r@ r
r
r �_is_dsa� s r_ c C s t o| ttfkS )N)� _have_ecdsar$ r% )r@ r
r
r � _is_ecdsa� s ra c C s | t kS )N)r )r@ r
r
r �_is_md5� s rb c C s | t tttfkS )N)r r r r )r@ r
r
r �_is_sha1� s rc c C s | t tfkS )N)r! r$ )r@ r
r
r �
_is_sha256� s rd c C s | t kS )N)r% )r@ r
r
r �
_is_sha384� s re c C s | t kS )N)r" )r@ r
r
r �
_is_sha512� s rf c C s~ t | �rtjjd � S t| �r,tjjd � S t| �rBtjjd � S t| �rXtjjd � S t| �rntjjd � S td| ��d S )NZMD5rG rH ZSHA384ZSHA512z unknown hash for algorithm %u) rb rI rJ rK rc rd re rf r )r@ r
r
r �
_make_hash� s rg c C s� t | �r ddddddddg}ndt| �r6dd d
dd g}nLt| �rVd ddd
dd
ddd
g }n,t| �rvd ddd
dd
ddd
g }n td| ��t|�}t| �j}dgd| | g d|d g d|g | ddg d|g }tj dt|� f|�� S )N�* � �H � r r
r �+ r r � �` r �e r zunknown algorithm %u�0 r r r z!%dB)
rb rc rd rf r rB rg Z digest_sizerQ rR )r@ ZoidZolenZdlenZidbytesr
r
r �_make_algorithm_id� s
<rq c ) C s t |t�r tjj|tjj�}�x�t||�D �]�}|s<td��t | t�rX| d }| d }n
| j}| }|dkrrt j � }|j
|k r�td��|j |kr�td��t |j
�}t|j
��r`|j} tjd| dd� �\}
| dd� } |
dk�r tjd| dd � �\}
| d d� } | d|
� } | |
d� } t| �d
}
tjjjtjjj| �tjjj| �f�}tjjj|j�f}�n t|j
��rl|j} tjd| dd� �\}| dd� } d |d
}| dd � }| d d� } | d|� }| |d� } | d|� }| |d� } | d|� }tjj jtjjj|�tjjj|�tjjj|�tjjj|�f�}tjd
|jdd� �\}}tjjj|�tjjj|�f}�nt |j
��rr|j
t k�r�t j j!}d}n"|j
t"k�r�t j j#}d}ntd��|j} tjjj| d|� �}tjjj| ||d � �}t j j$|j%||��st&�t j'j(|j)|||j*�} t j+j,j-| |�} t.| |�}|jd|� } |j|d� } t j j/tjjj| �tjjj| ��}ntd|j
��|j0t1||�dd� � |j0|j2j3|�� |j4t|�d k �r�|j5|j4d �d } tjjd| �}|j3|�}!tj6d|j7|j8|j9�}"t:|�}#xP|#D ]H}$|j0|!� |j0|"� |$j3|�}%tj6dt|%��}&|j0|&� |j0|%� �qW |j;� }'t|j
��r�t<|j
�|' }'|
d
t|'� d }(tj6dd |( d fddgdg|( dg �� |' }'n(t|j
��s�t |j
��r�ntd|j
��|j=|'|�r*dS q*W td��dS )a� Validate an RRset against a single signature rdata
The owner name of the rrsig is assumed to be the same as the owner name
of the rrset.
@param rrset: The RRset to validate
@type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param rrsig: The signature rdata
@type rrsig: dns.rrset.Rdata
@param keys: The key dictionary.
@type keys: a dictionary keyed by dns.name.Name with node or rdataset
values
@param origin: The origin to use for relative names
@type origin: dns.name.Name or None
@param now: The time to use when validating the signatures. The default
is the current time.
@type now: int
z unknown keyr r NZexpiredz
not yet validz!Bz!Hr
r �@ � z!20s20s� rp zunknown ECDSA curvezunknown algorithm %u� �*z!HHIr z!%dB� zverify failure)>rL r rI rM rN �rootr] r �tuple�timeZ
expirationZ inceptionrg r@ r^ rC rQ �unpackrB �CryptoZ PublicKeyZRSAZ construct�Util�number�
bytes_to_longZ signaturer_ r ra r$ �ecdsaZcurvesZNIST256pr% ZNIST384pZpoint_is_valid� generator�AssertionErrorZ
ellipticcurveZPoint�curve�orderrZ Z VerifyingKeyZfrom_public_point� ECKeyWrapperZ SignaturerO r; rW Z
to_digestableZlabels�splitrR ZrdtypeZrdclassZ original_ttl�sortedrP rq �verify))�rrsetr[ rZ r6 �nowZ
candidate_key�rrnamer\ rJ ZkeyptrZbytes_Zrsa_eZrsa_nZkeylen�pubkey�sig�tZoctetsZdsa_qZdsa_pZdsa_gZdsa_yZdsa_rZdsa_sr� �key_lenr) r* ZpointZ
verifying_key�rr: �suffixZ rrnamebufZrrfixedZrrlistZrrZrrdataZrrlenrP Zpadlenr
r
r �_validate_rrsig� s�
" r� c
C s� t |t�r tjj|tjj�}t | t�r0| d }n| j}t |t�rR|d }|d }n
|j}|}|j|�}|j|�}||kr�td��x6|D ].}yt | ||||� dS tk
r� Y q�X q�W td��dS )ah Validate an RRset
@param rrset: The RRset to validate
@type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param rrsigset: The signature RRset
@type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param keys: The key dictionary.
@type keys: a dictionary keyed by dns.name.Name with node or rdataset
values
@param origin: The origin to use for relative names
@type origin: dns.name.Name or None
@param now: The time to use when validating the signatures. The default
is the current time.
@type now: int
r r zowner names do not matchNzno RRSIGs validated)
rL r rI rM rN rx ry Zchoose_relativityr r� ) r� ZrrsigsetrZ r6 r� r� Z rrsignameZ
rrsigrdatasetr[ r
r
r � _validatex s*
r� c O s t d��d S )Nz#DNSSEC validation requires pycrypto)�NotImplementedError)�args�kwargsr
r
r �_need_pycrypto� s r� TFc @ s e Zd Zdd� Zdd� ZdS )r� c C s || _ || _d S )N)rC r� )�selfrC r� r
r
r �__init__� s zECKeyWrapper.__init__c C s t jjj|�}| jjj||�S )N)r| r} r~ r rC r� Zverifies)r� rP r� Zdiglongr
r
r r� � s zECKeyWrapper.verifyN)r r r r� r� r
r
r
r r� � s r� )N)N)NN)NN)Hr �ior rQ rz Z
dns.exceptionrI Zdns.hashZdns.nameZdns.nodeZ dns.rdatasetZ dns.rdataZ
dns.rdatatypeZdns.rdataclassZ_compatr Z exceptionZ DNSExceptionr r r r r r r r r r! r" r$ r% r# r& r' r, �dict�itemsr3 r2 r5 r; rF rV r] r^ r_ ra rb rc rd re rf rg rq r� r� r� ZCrypto.PublicKey.RSAr| ZCrypto.PublicKey.DSAZCrypto.Util.numberZvalidateZvalidate_rrsigZ_have_pycrypto� ImportErrorr� Z ecdsa.ecdsaZecdsa.ellipticcurveZ
ecdsa.keysr` �objectr� r
r
r
r �<module> s�
0