File: //usr/lib/python2.7/site-packages/dns/dnssec.pyo
�
�b�Wc @ s9 d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l Z d d l
Z d d l m Z d e j j f d � � YZ d e j j f d � � YZ d Z d
Z d Z d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z! i e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d! 6e d" 6e d# 6e! d$ 6Z" e# d% � e" j$ � D� � Z% d& � Z& d' � Z' d( � Z( d d) � Z* d d* � Z+ d+ � Z, d, � Z- d- � Z. d. � Z/ d/ � Z0 d0 � Z1 d1 � Z2 d2 � Z3 d3 � Z4 d4 � Z5 d5 � Z6 d d d6 � Z7 d d d7 � Z8 d8 � Z9 y: d d l: Z; d d l< Z; d d l= Z; e8 Z> e7 Z? e@ ZA Wn# eB k
r�e9 Z> e9 Z? eC ZA n XyP d d lD ZD d d lE ZD d d lF ZD d d lG ZD e@ ZH d9 eI f d: � � YZJ Wn eB k
r4eC ZH n Xd S(; s. Common DNSSEC-related functions and constants.i����( t BytesIONi ( t string_typest UnsupportedAlgorithmc B s e Z d Z RS( s& The DNSSEC algorithm is not supported.( t __name__t
__module__t __doc__( ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyR ! s t ValidationFailurec B s e Z d Z RS( s The DNSSEC signature is invalid.( R R R ( ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyR & s i i i i i i i i
i
i i� i� i� t RSAMD5t DHt DSAt ECCt RSASHA1t DSANSEC3SHA1t RSASHA1NSEC3SHA1t RSASHA256t RSASHA512t INDIRECTt ECDSAP256SHA256t ECDSAP384SHA384t
PRIVATEDNSt
PRIVATEOIDc c s! | ] \ } } | | f Vq d S( N( ( t .0t xt y( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pys <genexpr>N s c C s4 t j | j � � } | d k r0 t | � } n | S( s: Convert text into a DNSSEC algorithm value
@rtype: intN( t _algorithm_by_textt gett uppert Nonet int( t textt value( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt algorithm_from_textQ s c C s. t j | � } | d k r* t | � } n | S( s; Convert a DNSSEC algorithm value to text
@rtype: stringN( t _algorithm_by_valueR R t str( R R ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt algorithm_to_text[ s c C s& t � } | j | d | �| j � S( Nt origin( R t to_wiret getvalue( t recordR# t s( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _to_rdatae s c C s� t | | � } t | � } | j t k r> | d d >| d Sd } xD t t | � d � D], } | | d | d >| d | d 7} q[ Wt | � d d k r� | | t | � d d >7} n | | d ?d @7} | d @Sd S( Ni����i i����i i i i i�� ( R( t bytearrayt algorithmR t ranget len( t keyR# t rdatat totalt i( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt key_idk s c C s! | j � d k r. d } t j j d � } n> | j � d k r\ d } t j j d � } n t d | � � t | t � r� t j j | | � } n | j | j
� j � � | j t | | � � | j
� } t j d t | � | j | � | } t j j t j j t j j | d t | � � S( Nt SHA1i t SHA256i s unsupported algorithm "%s"s !HBBi ( R t dnst hasht hashesR t
isinstanceR t namet from_textt updatet canonicalizeR$ R( t digestt structt packR1 R* R. t from_wiret
rdataclasst INt rdatatypet DSR, ( R8 R- R* R# t dsalgR5 R< t dsrdata( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt make_ds{ s %!c C s� g } | j | j � } | d k r( d St | t j j � rw y" | j t j j t j
j � } Wq} t k
rs d SXn | } xE | D]= } | j
| j
k r� t | � | j k r� | j | � q� q� W| S( N( R t signerR R7 R4 t nodet Nodet
find_rdatasetR@ RA RB t DNSKEYt KeyErrorR* R1 t key_tagt append( t keyst rrsigt candidate_keysR t rdatasetR. ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _find_candidate_keys� s
c C s | t t t t t f k S( N( R R R
R R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _is_rsa� s c C s | t t f k S( N( R R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _is_dsa� s c C s t o | t t f k S( N( t _have_ecdsaR R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _is_ecdsa� s c C s
| t k S( N( R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _is_md5� s c C s | t t t t f k S( N( R R R R
( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _is_sha1� s c C s | t t f k S( N( R R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha256� s c C s
| t k S( N( R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha384� s c C s
| t k S( N( R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha512� s c C s� t | � r t j j d � St | � r: t j j d � St | � rW t j j d � St | � rt t j j d � St | � r� t j j d � St d | � � d S( Nt MD5R2 R3 t SHA384t SHA512s unknown hash for algorithm %u( RX R4 R5 R6 RY RZ R[ R\ R ( R* ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt
_make_hash� s c C s> t | � r- d d d d d d d d g } n� t | � rQ d d d
d d g } np t | � r� d d d d
d d
d d d
g } n@ t | � r� d d d d
d d
d d d
g } n t d | � � t | � } t | � j } d g d | | g d | d g d | g | d d g d | g } t j d t | � | � S( Ni* i� iH i� i
i i i+ i i i i` i ie i s unknown algorithm %ui0 i i i s !%dB(
RX RY RZ R\ R R, R` t digest_sizeR= R> ( R* t oidt olent dlent idbytes( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _make_algorithm_id� s ! $ $ Hc ) C s� t | t � r- t j j | t j j � } n xEt | | � D]4} | sX t d � � n t | t � r~ | d } | d } n | j } | } | d k r� t
j
� } n | j | k r� t d � � n | j | k r� t d � � n t
| j � } t | j � r�| j } t j d | d d !� \ }
| d } |
d k rft j d | d d !� \ }
| d } n | d |
!} | |
} t | � d }
t j j j t j j j | � t j j j | � f � } t j j j | j � f } n�t | j � r+| j } t j d | d d !� \ } | d } d
| d } | d d !} | d } | d | !} | | } | d | !} | | } | d | !} t j j j t j j j | � t j j j | � t j j j | � t j j j | � f � } t j d | j d � \ } } t j j j | � t j j j | � f } nSt | j � rk| j t k r^t j! j" } d
} n0 | j t# k r�t j! j$ } d } n t d � � | j } t j j j | d | !� } t j j j | | | d !� } t j% j& | j' | | | j( � } t j) j* j+ | | � } t, | | � } | j | } | j | } t j j- t j j j | � t j j j | � � } n t d | j � � | j. t/ | | � d � | j. | j0 j1 | � � | j2 t | � d k r�| j3 | j2 d � d } t j j d | � } n | j1 | � }! t j4 d | j5 | j6 | j7 � }" t8 | � }# xi |# D]a }$ | j. |! � | j. |" � |$ j1 | � }% t j4 d t |% � � }& | j. |& � | j. |% � q?W| j9 � }' t | j � r't: | j � |' }' |
d t |' � d }( t j4 d d |( d d d g d g |( d g � |' }' n4 t | j � s[t | j � rHn t d | j � � | j; |' | � r= d Sq= Wt d � � d S( s� Validate an RRset against a single signature rdata
The owner name of the rrsig is assumed to be the same as the owner name
of the rrset.
@param rrset: The RRset to validate
@type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param rrsig: The signature rdata
@type rrsig: dns.rrset.Rdata
@param keys: The key dictionary.
@type keys: a dictionary keyed by dns.name.Name with node or rdataset
values
@param origin: The origin to use for relative names
@type origin: dns.name.Name or None
@param now: The time to use when validating the signatures. The default
is the current time.
@type now: int
s unknown keyi i t expireds
not yet valids !Bs !Hi i i@ i s !20s20si i0 s unknown ECDSA curves unknown algorithm %ui t *s !HHIi s !%dBi� Ns verify failure(< R7 R R4 R8 R9 t rootRS R t tupleR t timet
expirationt inceptionR` R* RT R- R= t unpackR, t Cryptot PublicKeyt RSAt constructt Utilt numbert
bytes_to_longt signatureRU R RW R t ecdsat curvest NIST256pR t NIST384pt
ellipticcurvet Pointt curvet orderRO t VerifyingKeyt from_public_pointt ECKeyWrappert SignatureR: R( RG t
to_digestablet labelst splitR> t rdtypet rdclasst original_ttlt sortedR< Rf t verify() t rrsetRP RO R# t nowt
candidate_keyt rrnameRR R5 t keyptrt bytes_t rsa_et rsa_nt keylent pubkeyt sigt tt octetst dsa_qt dsa_pt dsa_gt dsa_yt dsa_rt dsa_sR} t key_lenR R t pointt
verifying_keyt rR' t suffixt rrnamebuft rrfixedt rrlistt rrt rrdatat rrlenR< t padlen( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _validate_rrsig� s�
!
( c C s t | t � r- t j j | t j j � } n t | t � rI | d } n | j } t | t � rx | d } | d } n | j } | } | j | � } | j | � } | | k r� t d � � n x@ | D]8 } y t | | | | | � d SWq� t k
r� q� Xq� Wt d � � d S( sh Validate an RRset
@param rrset: The RRset to validate
@type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param rrsigset: The signature RRset
@type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
tuple
@param keys: The key dictionary.
@type keys: a dictionary keyed by dns.name.Name with node or rdataset
values
@param origin: The origin to use for relative names
@type origin: dns.name.Name or None
@param now: The time to use when validating the signatures. The default
is the current time.
@type now: int
i i s owner names do not matchNs no RRSIGs validated(
R7 R R4 R8 R9 Ri Rj t choose_relativityR R� ( R� t rrsigsetRO R# R� R� t rrsignamet
rrsigrdatasetRP ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _validatex s*
c O s t d � � d S( Ns# DNSSEC validation requires pycrypto( t NotImplementedError( t argst kwargs( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt _need_pycrypto� s R� c B s e Z d � Z d � Z RS( c C s | | _ | | _ d S( N( R- R� ( t selfR- R� ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt __init__� s c C s+ t j j j | � } | j j j | | � S( N( Ro Rs Rt Ru R- R� t verifies( R� R< R� t diglong( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyR� � s ( R R R� R� ( ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyR� � s (K R t ioR R= Rk t
dns.exceptionR4 t dns.hasht dns.namet dns.nodet dns.rdatasett dns.rdatat
dns.rdatatypet dns.rdataclasst _compatR t exceptiont DNSExceptionR R R R R R
R R R
R R R R R R R R t dictt itemsR R R" R( R R1 RF RS RT RU RW RX RY RZ R[ R\ R` Rf R� R� R� t Crypto.PublicKey.RSARo t Crypto.PublicKey.DSAt Crypto.Util.numbert validatet validate_rrsigt Truet _have_pycryptot ImportErrort FalseRw t ecdsa.ecdsat ecdsa.ellipticcurvet
ecdsa.keysRV t objectR� ( ( ( s. /usr/lib/python2.7/site-packages/dns/dnssec.pyt <module> s�
�0