a
�M�e�, � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl ZG dd� dej
j �Z G dd� dej
j �Z
G dd� dej
j �ZG d d
� d
ej
j �ZG d d � d ej
j �ZG d
d� de�ZG dd� de�ZG dd� de�ZG dd� de�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Z ej�d�Z ej�d �Z ej�d �Z ej�d �Z eZ!ed ed ed!ed"e d#e d$e d%e d!ed"e d&i
Z"G d'd(� d(�Z#G d)d*� d*�Z$G d+d,� d,�Z%d:d-d.�Z&d/d0� Z'd;d2d3�Z(d<d4d5�Z)d6d7� Z*G d8d9� d9�Z+dS )=zDNS TSIG support.� Nc @ s e Zd ZdZdS )�BadTimez8The current time is not within the TSIG's validity time.N��__name__�
__module__� __qualname__�__doc__� r r �,/usr/lib/python3.9/site-packages/dns/tsig.pyr s r c @ s e Zd ZdZdS )� BadSignaturez#The TSIG signature fails to verify.Nr r r r r r
# s r
c @ s e Zd ZdZdS )�BadKeyz2The TSIG record owner name does not match the key.Nr r r r r r ' s r c @ s e Zd ZdZdS )� BadAlgorithmz*The TSIG algorithm does not match the key.Nr r r r r r + s r c @ s e Zd ZdZdS )� PeerErrorz;Base class for all TSIG errors generated by the remote peerNr r r r r r
/ s r
c @ s e Zd ZdZdS )�
PeerBadKeyz$The peer didn't know the key we usedNr r r r r r 3 s r c @ s e Zd ZdZdS )�PeerBadSignaturez*The peer didn't like the signature we sentNr r r r r r 7 s r c @ s e Zd ZdZdS )� PeerBadTimez%The peer didn't like the time we sentNr r r r r r ; s r c @ s e Zd ZdZdS )�PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr r r r r r ? s r zHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256zhmac-sha256-128z hmac-sha384zhmac-sha384-192z hmac-sha512zhmac-sha512-256�gss-tsig� � � � �0 � �@ � c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
S ) �GSSTSigaG
GSS-TSIG TSIG implementation. This uses the GSS-API context established
in the TKEY message handshake to sign messages using GSS-API message
integrity codes, per the RFC.
In order to avoid a direct GSSAPI dependency, the keyring holds a ref
to the GSSAPI object required, rather than the key itself.
c C s || _ d| _d| _d S )N� r )�gssapi_context�data�name)�selfr r r r �__init__j s zGSSTSig.__init__c C s | j |7 _ d S �N)r �r r r r r �updateo s zGSSTSig.updatec C s | j �| j�S r" )r Z
get_signaturer )r r r r �signr s z GSSTSig.signc C s. z| j �| j|�W S ty( t�Y n0 d S r" )r Zverify_signaturer � Exceptionr
)r �expectedr r r �verifyv s zGSSTSig.verifyN)r r r r r! r$ r% r( r r r r r ` s
r c @ s( e Zd Zdd� Zdd� Zedd� �ZdS )�GSSTSigAdapterc C s
|| _ d S r" )�keyring)r r* r r r r! � s zGSSTSigAdapter.__init__c C sF || j v r>| j | }t|t�r:|jtkr:|r:t�|||� |S d S d S r" )r* �
isinstance�Key� algorithm�GSS_TSIGr) �parse_tkey_and_step)r �message�keyname�keyr r r �__call__� s
zGSSTSigAdapter.__call__c C sV z>|� |j|tjjtjj�}|r<|d j}|j}|� |�W S W n t
yP Y n0 d S )Nr ) Z
find_rrsetZanswer�dns�
rdataclass�ANYZ rdatatypeZTKEYr2 �secret�step�KeyError)�clsr2 r0 r1 Zrrset�tokenr r r r r/ � s �
z"GSSTSigAdapter.parse_tkey_and_stepN)r r r r! r3 � classmethodr/ r r r r r) s
r) c @ sv e Zd ZdZeejeeje ej
e ej
dfe ej
eej
dfeejeejdfeeji Zdd� Zdd� Zd d
� Zd d � Zd
S )�HMACTSigzo
HMAC TSIG implementation. This uses the HMAC python module to handle the
sign/verify operations.
r � � c C s� z| j | }W n" ty0 td|� d���Y n0 t|t�r\tj||d d�| _|d | _ntj||d�| _d | _| jj | _ | jr�| j d| j� �7 _ d S )NzTSIG algorithm z is not supportedr )Z digestmod� �-)
�_hashesr9 �NotImplementedErrorr+ �tuple�hmac�new� hmac_context�sizer )r r2 r- Zhashinfor r r r! � s
zHMACTSig.__init__c C s | j �|�S r" )rG r$ r# r r r r$ � s zHMACTSig.updatec C s& | j �� }| jr"|d | jd � }|S )N� )rG �digestrH )r rJ r r r r% � s
z
HMACTSig.signc C s | � � }t�||�st�d S r" )r% rE Zcompare_digestr
)r r' �macr r r r( � s zHMACTSig.verifyN)r r r r � HMAC_SHA1�hashlibZsha1� HMAC_SHA224Zsha224� HMAC_SHA256Zsha256�HMAC_SHA256_128� HMAC_SHA384Zsha384�HMAC_SHA384_192� HMAC_SHA512Zsha512�HMAC_SHA512_256�HMAC_MD5Zmd5rB r! r$ r% r( r r r r r= � s
� r= c C s0 |o| }|r:t |�}|r:|�t�dt|��� |�|� |�t�d|j�� |�| dd� � |r�|�|j�� � |�t�dtj j
�� |�t�dd�� |du r�|j }|d? d@ }|d@ } t�d || |j �}
t|j
�} | dkr�td
��|�r"|�|j�� |
� |�t�d |j| �|j
� n
|�|
� |S ) z�Return a context containing the TSIG rdata for the input parameters
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
�!H� Nz!Ir r i�� l �� z!HIHz TSIG Other Data is > 65535 bytesz!HH)� get_contextr$ �struct�pack�lenZ original_idr Z
to_digestabler4 r5 r6 � time_signed�fudge�other�
ValueErrorr- �error) �wirer2 �rdata�time� request_mac�ctx�multi�firstZ
upper_timeZ
lower_timeZ time_encodedZ other_lenr r r �_digest� s2
rh c C s8 |r0t | �}|�t�dt|��� |�|� |S dS dS )z�If this is the first message in a multi-message sequence,
start a new context.
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
rV N)rX r$ rY rZ r[ )r2 rK rf re r r r �_maybe_start_digest� s
ri Fc C s: t | ||||||�}|�� }|j||d�}|t|||�fS )a~ Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
for the input parameters, the HMAC MAC calculated by applying the
TSIG signature algorithm, and the TSIG digest context.
@rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
)r\ rK )rh r% �replaceri ) ra r2 rb rc rd re rf rK Ztsigr r r r% s r% c C s t �d| dd� �\} | dkr&tjj�| d8 } | dd� t �d| � | d|� }
|jdkr�|jtjjkrpt �nJ|jtjj
kr�t �n6|jtjj kr�t
�n"|jtjjkr�t�ntd|j ��t|j| �|jkr�t�|j|kr�t�|j|jkr�t�t|
||d|||�}|�|j� t ||j|�S )aF Validate the specified TSIG rdata against the other input parameters.
@raises FormError: The TSIG is badly formed.
@raises BadTime: There is too much time skew between the client and the
server.
@raises BadSignature: The TSIG signature did not validate
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrV �
� r r@ zunknown TSIG error code %dN) rY �unpackr4 � exceptionZ FormErrorrZ r` ZrcodeZBADSIGr ZBADKEYr ZBADTIMEr ZBADTRUNCr r
�absr\ r] r r r r- r rh r( rK ri ) ra r2 �ownerrb Znowrd Z
tsig_startre rf ZadcountZnew_wirer r r �validate s0 $
rq c C s& | j tkrt| j�S t| j| j �S dS )z�Returns an HMAC context for the specified key.
@rtype: HMAC context
@raises NotImplementedError: I{algorithm} is not supported
N)r- r. r r7 r= )r2 r r r rX : s
rX c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )r, c C sZ t |t�rtj�|�}|| _t |t�r4t�|�� �}|| _t |t�rPtj�|�}|| _ d S r" )
r+ �strr4 r � from_text�base64Z decodebytes�encoder7 r- )r r r7 r- r r r r! H s
z Key.__init__c C s. t |t�o,| j|jko,| j|jko,| j|jkS r" )r+ r, r r7 r- )r r^ r r r �__eq__S s
�
�
�z
Key.__eq__c C sN d| j � d�d| j� d� }| jtkrB|dt�| j��� � d�7 }|d7 }|S )Nz<DNS key name='z', z algorithm='�'z
, secret='�>)r r- r. rt Z b64encoder7 �decode)r �rr r r �__repr__[ s
z Key.__repr__N)r r r �default_algorithmr! rv r{ r r r r r, G s r, )NNNN)NNNF)NF),r rt rM rE rY Z
dns.exceptionr4 Zdns.nameZ dns.rcodeZdns.rdataclassrn Z DNSExceptionr r
r r r
r r r r r rs rU rL rN rO rP rQ rR rS rT r. r| Z mac_sizesr r) r= rh ri r% rq rX r, r r r r �<module> sb � 4
#
�
&