File: //opt/alt/python37/lib/python3.7/site-packages/dns/__pycache__/tsig.cpython-37.pyc
B
��f�, � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl ZG dd� dej
j �Z G dd� dej
j �Z
G dd� dej
j �ZG d d
� d
ej
j �ZG d d � d ej
j �ZG d
d� de�ZG dd� de�ZG dd� de�ZG dd� de�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Z ej�d�Z ej�d �Z ej�d �Z ej�d �Z eZ!ed ed ed!ed"e d#e d$e d%e d!ed"e d&i
Z"G d'd(� d(�Z#G d)d*� d*�Z$G d+d,� d,�Z%d:d-d.�Z&d/d0� Z'd;d2d3�Z(d<d4d5�Z)d6d7� Z*G d8d9� d9�Z+dS )=zDNS TSIG support.� Nc @ s e Zd ZdZdS )�BadTimez8The current time is not within the TSIG's validity time.N)�__name__�
__module__� __qualname__�__doc__� r r �9/opt/alt/python37/lib/python3.7/site-packages/dns/tsig.pyr s r c @ s e Zd ZdZdS )� BadSignaturez#The TSIG signature fails to verify.N)r r r r r r r r r $ s r c @ s e Zd ZdZdS )�BadKeyz2The TSIG record owner name does not match the key.N)r r r r r r r r r
) s r
c @ s e Zd ZdZdS )� BadAlgorithmz*The TSIG algorithm does not match the key.N)r r r r r r r r r . s r c @ s e Zd ZdZdS )� PeerErrorz;Base class for all TSIG errors generated by the remote peerN)r r r r r r r r r 3 s r c @ s e Zd ZdZdS )�
PeerBadKeyz$The peer didn't know the key we usedN)r r r r r r r r r
8 s r
c @ s e Zd ZdZdS )�PeerBadSignaturez*The peer didn't like the signature we sentN)r r r r r r r r r = s r c @ s e Zd ZdZdS )� PeerBadTimez%The peer didn't like the time we sentN)r r r r r r r r r B s r c @ s e Zd ZdZdS )�PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentN)r r r r r r r r r G s r zHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256zhmac-sha256-128z hmac-sha384zhmac-sha384-192z hmac-sha512zhmac-sha512-256zgss-tsig� � � � �0 � �@ � c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
S ) �GSSTSigaG
GSS-TSIG TSIG implementation. This uses the GSS-API context established
in the TKEY message handshake to sign messages using GSS-API message
integrity codes, per the RFC.
In order to avoid a direct GSSAPI dependency, the keyring holds a ref
to the GSSAPI object required, rather than the key itself.
c C s || _ d| _d| _d S )N� zgss-tsig)�gssapi_context�data�name)�selfr r r r �__init__s s zGSSTSig.__init__c C s | j |7 _ d S )N)r )r r r r r �updatex s zGSSTSig.updatec C s | j �| j�S )N)r Z
get_signaturer )r r r r �sign{ s z GSSTSig.signc C s. y| j �| j|�S tk
r( t�Y nX d S )N)r Zverify_signaturer � Exceptionr )r �expectedr r r �verify s zGSSTSig.verifyN)r r r r r r r! r$ r r r r r i s
r c @ s( e Zd Zdd� Zdd� Zedd� �ZdS )�GSSTSigAdapterc C s
|| _ d S )N)�keyring)r r& r r r r � s zGSSTSigAdapter.__init__c C sF || j kr>| j | }t|t�r:|jtkr:|r:t�|||� |S d S d S )N)r& �
isinstance�Key� algorithm�GSS_TSIGr% �parse_tkey_and_step)r �message�keyname�keyr r r �__call__� s
zGSSTSigAdapter.__call__c C sV y<|� |j|tjjtjj�}|r:|d j}|j}|� |�S W n t
k
rP Y nX d S )Nr ) Z
find_rrsetZanswer�dns�
rdataclass�ANYZ rdatatypeZTKEYr. �secret�step�KeyError)�clsr. r, r- Zrrset�tokenr r r r r+ � s
z"GSSTSigAdapter.parse_tkey_and_stepN)r r r r r/ � classmethodr+ r r r r r% � s
r% c @ sv e Zd ZdZeejeeje ej
e ej
dfe ej
eej
dfeejeejdfeeji Zdd� Zdd� Zd d
� Zd d � Zd
S )�HMACTSigzo
HMAC TSIG implementation. This uses the HMAC python module to handle the
sign/verify operations.
r � � c C s� y| j | }W n( tk
r6 td|� d�d ��Y nX t|t�rbtj||d d�| _|d | _ntj||d�| _d | _| jj | _ | jr�| j d| j� �7 _ d S )NzTSIG algorithm � zis not supportedr )� digestmod� �-)
�_hashesr5 �NotImplementedErrorr' �tuple�hmac�new� hmac_context�sizer )r r. r) Zhashinfor r r r � s
zHMACTSig.__init__c C s | j �|�S )N)rE r )r r r r r r � s zHMACTSig.updatec C s& | j �� }| jr"|d | jd � }|S )N� )rE �digestrF )r rH r r r r! � s
z
HMACTSig.signc C s | � � }t�||�st�d S )N)r! rC �compare_digestr )r r# �macr r r r$ � s zHMACTSig.verifyN)r r r r � HMAC_SHA1�hashlib�sha1� HMAC_SHA224�sha224� HMAC_SHA256�sha256�HMAC_SHA256_128� HMAC_SHA384�sha384�HMAC_SHA384_192� HMAC_SHA512�sha512�HMAC_SHA512_256�HMAC_MD5�md5r@ r r r! r$ r r r r r9 � s
r9 c C s0 |o| }|r:t |�}|r:|�t�dt|��� |�|� |�t�d|j�� |�| dd� � |r�|�|j�� � |�t�dtj j
�� |�t�dd�� |dkr�|j }|d? d@ }|d@ } t�d || |j �}
t|j
�} | dkr�td
��|�r"|�|j�� |
� |�t�d |j| �|j
� n
|�|
� |S ) z�Return a context containing the TSIG rdata for the input parameters
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
z!H� Nz!Ir r i�� l �� z!HIHz TSIG Other Data is > 65535 bytesz!HH)� get_contextr �struct�pack�lenZ original_idr Z
to_digestabler0 r1 r2 � time_signed�fudge�other�
ValueErrorr) �error) �wirer. �rdata�time� request_mac�ctx�multi�firstZ
upper_timeZ
lower_timeZ time_encodedZ other_lenr r r �_digest� s2
rl c C s8 |r0t | �}|�t�dt|��� |�|� |S dS dS )z�If this is the first message in a multi-message sequence,
start a new context.
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
z!HN)r\ r r] r^ r_ )r. rJ rj ri r r r �_maybe_start_digest s
rm Fc C s: t | ||||||�}|�� }|j||d�}|t|||�fS )a~ Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
for the input parameters, the HMAC MAC calculated by applying the
TSIG signature algorithm, and the TSIG digest context.
@rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
)r` rJ )rl r! �replacerm ) re r. rf rg rh ri rj rJ Ztsigr r r r! s r! c C s t �d| dd� �\} | dkr&tjj�| d8 } | dd� t �d| � | d|� }
|jdkr�|jtjjkrpt �nJ|jtjj
kr�t �n6|jtjj kr�t
�n"|jtjjkr�t�ntd|j ��t|j| �|jkr�t�|j|kr�t�|j|jkr�t�t|
||d|||�}|�|j� t ||j|�S )aF Validate the specified TSIG rdata against the other input parameters.
@raises FormError: The TSIG is badly formed.
@raises BadTime: There is too much time skew between the client and the
server.
@raises BadSignature: The TSIG signature did not validate
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectz!H�
� r r> zunknown TSIG error code %dN) r] �unpackr0 � exceptionZ FormErrorr^ rd ZrcodeZBADSIGr ZBADKEYr
ZBADTIMEr ZBADTRUNCr r �absr` ra r r r
r) r rl r$ rJ rm ) re r. �ownerrf �nowrh Z
tsig_startri rj ZadcountZnew_wirer r r �validate s0 $
rv c C s& | j tkrt| j�S t| j| j �S dS )z�Returns an HMAC context for the specified key.
@rtype: HMAC context
@raises NotImplementedError: I{algorithm} is not supported
N)r) r* r r3 r9 )r. r r r r\ E s
r\ c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )r( c C sZ t |t�rtj�|�}|| _t |t�r4t�|�� �}|| _t |t�rPtj�|�}|| _ d S )N)
r' �strr0 r � from_text�base64� decodebytes�encoder3 r) )r r r3 r) r r r r S s
z Key.__init__c C s. t |t�o,| j|jko,| j|jko,| j|jkS )N)r' r( r r3 r) )r rb r r r �__eq__^ s
z
Key.__eq__c C sN d| j � d�d| j� d� }| jtkrB|dt�| j��� � d�7 }|d7 }|S )Nz<DNS key name='z', z algorithm='�'z
, secret='�>)r r) r* ry � b64encoder3 �decode)r �rr r r �__repr__f s
z Key.__repr__N)r r r �default_algorithmr r| r� r r r r r( R s r( )NNNN)NNNF)NF),r ry rL rC r] Z
dns.exceptionr0 Zdns.rdataclassZdns.nameZ dns.rcoderr Z DNSExceptionr r r
r r r
r r r r rx rY rK rN rP rR rS rU rV rX r* r� Z mac_sizesr r% r9 rl rm r! rv r\ r( r r r r �<module> s^ 6
#
%