JezK
Edit File: tsig.cpython-39.pyc
a �M�e�, � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl ZG dd� dej j �Z G dd� dej j �Z G dd� dej j �ZG d d � d ej j �ZG d d � d ej j �ZG d d� de�ZG dd� de�ZG dd� de�ZG dd� de�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Z ej�d�Z ej�d �Z ej�d �Z ej�d �Z eZ!ed ed ed!ed"e d#e d$e d%e d!ed"e d&i Z"G d'd(� d(�Z#G d)d*� d*�Z$G d+d,� d,�Z%d:d-d.�Z&d/d0� Z'd;d2d3�Z(d<d4d5�Z)d6d7� Z*G d8d9� d9�Z+dS )=zDNS TSIG support.� Nc @ s e Zd ZdZdS )�BadTimez8The current time is not within the TSIG's validity time.N��__name__� __module__� __qualname__�__doc__� r r �,/usr/lib/python3.9/site-packages/dns/tsig.pyr s r c @ s e Zd ZdZdS )� BadSignaturez#The TSIG signature fails to verify.Nr r r r r r # s r c @ s e Zd ZdZdS )�BadKeyz2The TSIG record owner name does not match the key.Nr r r r r r ' s r c @ s e Zd ZdZdS )� BadAlgorithmz*The TSIG algorithm does not match the key.Nr r r r r r + s r c @ s e Zd ZdZdS )� PeerErrorz;Base class for all TSIG errors generated by the remote peerNr r r r r r / s r c @ s e Zd ZdZdS )� PeerBadKeyz$The peer didn't know the key we usedNr r r r r r 3 s r c @ s e Zd ZdZdS )�PeerBadSignaturez*The peer didn't like the signature we sentNr r r r r r 7 s r c @ s e Zd ZdZdS )� PeerBadTimez%The peer didn't like the time we sentNr r r r r r ; s r c @ s e Zd ZdZdS )�PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr r r r r r ? s r zHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256zhmac-sha256-128z hmac-sha384zhmac-sha384-192z hmac-sha512zhmac-sha512-256�gss-tsig� � � � �0 � �@ � c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd S ) �GSSTSigaG GSS-TSIG TSIG implementation. This uses the GSS-API context established in the TKEY message handshake to sign messages using GSS-API message integrity codes, per the RFC. In order to avoid a direct GSSAPI dependency, the keyring holds a ref to the GSSAPI object required, rather than the key itself. c C s || _ d| _d| _d S )N� r )�gssapi_context�data�name)�selfr r r r �__init__j s zGSSTSig.__init__c C s | j |7 _ d S �N)r �r r r r r �updateo s zGSSTSig.updatec C s | j �| j�S r" )r Z get_signaturer )r r r r �signr s z GSSTSig.signc C s. z| j �| j|�W S ty( t�Y n0 d S r" )r Zverify_signaturer � Exceptionr )r �expectedr r r �verifyv s zGSSTSig.verifyN)r r r r r! r$ r% r( r r r r r ` s r c @ s( e Zd Zdd� Zdd� Zedd� �ZdS )�GSSTSigAdapterc C s || _ d S r" )�keyring)r r* r r r r! � s zGSSTSigAdapter.__init__c C sF || j v r>| j | }t|t�r:|jtkr:|r:t�|||� |S d S d S r" )r* � isinstance�Key� algorithm�GSS_TSIGr) �parse_tkey_and_step)r �message�keyname�keyr r r �__call__� s zGSSTSigAdapter.__call__c C sV z>|� |j|tjjtjj�}|r<|d j}|j}|� |�W S W n t yP Y n0 d S )Nr ) Z find_rrsetZanswer�dns� rdataclass�ANYZ rdatatypeZTKEYr2 �secret�step�KeyError)�clsr2 r0 r1 Zrrset�tokenr r r r r/ � s � z"GSSTSigAdapter.parse_tkey_and_stepN)r r r r! r3 � classmethodr/ r r r r r) s r) c @ sv e Zd ZdZeejeeje ej e ej dfe ej eej dfeejeejdfeeji Zdd� Zdd� Zd d � Zd d � Zd S )�HMACTSigzo HMAC TSIG implementation. This uses the HMAC python module to handle the sign/verify operations. r � � c C s� z| j | }W n" ty0 td|� d���Y n0 t|t�r\tj||d d�| _|d | _ntj||d�| _d | _| jj | _ | jr�| j d| j� �7 _ d S )NzTSIG algorithm z is not supportedr )Z digestmod� �-) �_hashesr9 �NotImplementedErrorr+ �tuple�hmac�new� hmac_context�sizer )r r2 r- Zhashinfor r r r! � s zHMACTSig.__init__c C s | j �|�S r" )rG r$ r# r r r r$ � s zHMACTSig.updatec C s& | j �� }| jr"|d | jd � }|S )N� )rG �digestrH )r rJ r r r r% � s z HMACTSig.signc C s | � � }t�||�st�d S r" )r% rE Zcompare_digestr )r r' �macr r r r( � s zHMACTSig.verifyN)r r r r � HMAC_SHA1�hashlibZsha1� HMAC_SHA224Zsha224� HMAC_SHA256Zsha256�HMAC_SHA256_128� HMAC_SHA384Zsha384�HMAC_SHA384_192� HMAC_SHA512Zsha512�HMAC_SHA512_256�HMAC_MD5Zmd5rB r! r$ r% r( r r r r r= � s � r= c C s0 |o| }|r:t |�}|r:|�t�dt|��� |�|� |�t�d|j�� |�| dd� � |r�|�|j�� � |�t�dtj j �� |�t�dd�� |du r�|j }|d? d@ }|d@ } t�d || |j �} t|j �} | dkr�td ��|�r"|�|j�� | � |�t�d |j| �|j � n |�| � |S ) z�Return a context containing the TSIG rdata for the input parameters @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object @raises ValueError: I{other_data} is too long @raises NotImplementedError: I{algorithm} is not supported �!H� Nz!Ir r i�� l �� z!HIHz TSIG Other Data is > 65535 bytesz!HH)� get_contextr$ �struct�pack�lenZ original_idr Z to_digestabler4 r5 r6 � time_signed�fudge�other� ValueErrorr- �error) �wirer2 �rdata�time� request_mac�ctx�multi�firstZ upper_timeZ lower_timeZ time_encodedZ other_lenr r r �_digest� s2 rh c C s8 |r0t | �}|�t�dt|��� |�|� |S dS dS )z�If this is the first message in a multi-message sequence, start a new context. @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object rV N)rX r$ rY rZ r[ )r2 rK rf re r r r �_maybe_start_digest� s ri Fc C s: t | ||||||�}|�� }|j||d�}|t|||�fS )a~ Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata for the input parameters, the HMAC MAC calculated by applying the TSIG signature algorithm, and the TSIG digest context. @rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object) @raises ValueError: I{other_data} is too long @raises NotImplementedError: I{algorithm} is not supported )r\ rK )rh r% �replaceri ) ra r2 rb rc rd re rf rK Ztsigr r r r% s r% c C s t �d| dd� �\} | dkr&tjj�| d8 } | dd� t �d| � | d|� } |jdkr�|jtjjkrpt �nJ|jtjj kr�t �n6|jtjj kr�t �n"|jtjjkr�t�ntd|j ��t|j| �|jkr�t�|j|kr�t�|j|jkr�t�t| ||d|||�}|�|j� t ||j|�S )aF Validate the specified TSIG rdata against the other input parameters. @raises FormError: The TSIG is badly formed. @raises BadTime: There is too much time skew between the client and the server. @raises BadSignature: The TSIG signature did not validate @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrV � � r r@ zunknown TSIG error code %dN) rY �unpackr4 � exceptionZ FormErrorrZ r` ZrcodeZBADSIGr ZBADKEYr ZBADTIMEr ZBADTRUNCr r �absr\ r] r r r r- r rh r( rK ri ) ra r2 �ownerrb Znowrd Z tsig_startre rf ZadcountZnew_wirer r r �validate s0 $ rq c C s& | j tkrt| j�S t| j| j �S dS )z�Returns an HMAC context for the specified key. @rtype: HMAC context @raises NotImplementedError: I{algorithm} is not supported N)r- r. r r7 r= )r2 r r r rX : s rX c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )r, c C sZ t |t�rtj�|�}|| _t |t�r4t�|�� �}|| _t |t�rPtj�|�}|| _ d S r" ) r+ �strr4 r � from_text�base64Z decodebytes�encoder7 r- )r r r7 r- r r r r! H s z Key.__init__c C s. t |t�o,| j|jko,| j|jko,| j|jkS r" )r+ r, r r7 r- )r r^ r r r �__eq__S s � � �z Key.__eq__c C sN d| j � d�d| j� d� }| jtkrB|dt�| j��� � d�7 }|d7 }|S )Nz<DNS key name='z', z algorithm='�'z , secret='�>)r r- r. rt Z b64encoder7 �decode)r �rr r r �__repr__[ s z Key.__repr__N)r r r �default_algorithmr! rv r{ r r r r r, G s r, )NNNN)NNNF)NF),r rt rM rE rY Z dns.exceptionr4 Zdns.nameZ dns.rcodeZdns.rdataclassrn Z DNSExceptionr r r r r r r r r r rs rU rL rN rO rP rQ rR rS rT r. r| Z mac_sizesr r) r= rh ri r% rq rX r, r r r r �<module> sb � 4 # � &