Current File : //opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyc
�
�ac @ s� d Z d d l m Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l
Z d d l Z d d l Z d d l
m Z d e j j f d � � YZ d e j j f d � � YZ d Z d
Z d Z d Z d
Z d Z d Z d Z d Z d Z d Z d Z d Z d Z i e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d 6e d! 6e d" 6e d# 6e d$ 6Z! d% � e! j" � D� Z# d& � Z$ d' � Z% d( � Z& d d) � Z( d d* � Z) d+ � Z* d, � Z+ d- � Z, d. � Z- d/ � Z. d0 � Z/ d1 � Z0 d2 � Z1 d3 � Z2 d4 � Z3 d5 � Z4 d d d6 � Z5 d d d7 � Z6 d8 � Z7 y� yh d d9 l8 m9 Z9 m: Z: m; Z; m< Z< m= Z= d d: l> m? Z@ m ZA d d; lB mC ZC mD ZD d d< lE mF ZF Wnu eG k
r;d d9 lH m9 Z9 m: Z: m; Z; m< Z< m= Z= d d: lI m? Z@ m ZA d d; lJ mC ZC mD ZD d d< lK mF ZF n XWn) eG k
rhe7 ZL e7 ZM eN ZO eN ZP n} Xe6 ZL e5 ZM eQ ZO y4 d d lR ZR d d lS ZR d d lT ZR d d lU ZR Wn eG k
r�eN ZP n XeQ ZP d= eV f d> � � YZW d S(? s. Common DNSSEC-related functions and constants.i����( t BytesIONi ( t string_typest UnsupportedAlgorithmc B s e Z d Z RS( s& The DNSSEC algorithm is not supported.( t __name__t
__module__t __doc__( ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyR " s t ValidationFailurec B s e Z d Z RS( s The DNSSEC signature is invalid.( R R R ( ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyR & s i i i i i i i i
i
i i� i� i� t RSAMD5t DHt DSAt ECCt RSASHA1t DSANSEC3SHA1t RSASHA1NSEC3SHA1t RSASHA256t RSASHA512t INDIRECTt ECDSAP256SHA256t ECDSAP384SHA384t
PRIVATEDNSt
PRIVATEOIDc C s i | ] \ } } | | � q S( ( ( t .0t xt y( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pys
<dictcomp>\ s c C s4 t j | j � � } | d k r0 t | � } n | S( sI Convert text into a DNSSEC algorithm value.
Returns an ``int``.
N( t _algorithm_by_textt gett uppert Nonet int( t textt value( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt algorithm_from_text_ s c C s. t j | � } | d k r* t | � } n | S( sE Convert a DNSSEC algorithm value to text
Returns a ``str``.
N( t _algorithm_by_valueR R t str( R R ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt algorithm_to_textk s c C s& t � } | j | d | �| j � S( Nt origin( R t to_wiret getvalue( t recordR# t s( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _to_rdataw s c C s� t | | � } t | � } | j t k r> | d d >| d Sd } xD t t | � d � D], } | | d | d >| d | d 7} q[ Wt | � d d k r� | | t | � d d >7} n | | d ?d @7} | d @Sd S(
s� Return the key id (a 16-bit number) for the specified key.
Note the *origin* parameter of this function is historical and
is not needed.
Returns an ``int`` between 0 and 65535.
i����i i����i i i i i�� N( R( t bytearrayt algorithmR t ranget len( t keyR# t rdatat totalt i( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt key_id} s c C s | j � d k r' d } t j � } n7 | j � d k rN d } t j � } n t d | � � t | t � r� t j j | | � } n | j
| j � j � � | j
t
| | � � | j � } t j d t | � | j | � | } t j j t j j t j j | d t | � � S( s� Create a DS record for a DNSSEC key.
*name* is the owner name of the DS record.
*key* is a ``dns.rdtypes.ANY.DNSKEY``.
*algorithm* is a string describing which hash algorithm to use. The
currently supported hashes are "SHA1" and "SHA256". Case does not
matter for these strings.
*origin* is a ``dns.name.Name`` and will be used as the origin
if *key* is a relative name.
Returns a ``dns.rdtypes.ANY.DS``.
t SHA1i t SHA256i s unsupported algorithm "%s"s !HBBi ( R R2 t newR3 R t
isinstanceR t dnst namet from_textt updatet canonicalizeR$ R( t digestt structt packR1 R* R. t from_wiret
rdataclasst INt rdatatypet DSR, ( R7 R- R* R# t dsalgt hashR; t dsrdata( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt make_ds� s %!c C s� g } | j | j � } | d k r( d St | t j j � rw y" | j t j j t j
j � } Wq} t k
rs d SXn | } xE | D]= } | j
| j
k r� t | � | j k r� | j | � q� q� W| S( N( R t signerR R5 R6 t nodet Nodet
find_rdatasetR? R@ RA t DNSKEYt KeyErrorR* R1 t key_tagt append( t keyst rrsigt candidate_keysR t rdatasetR. ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _find_candidate_keys� s
c C s | t t t t t f k S( N( R R R
R R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _is_rsa� s c C s | t t f k S( N( R R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _is_dsa� s c C s t o | t t f k S( N( t _have_ecdsaR R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _is_ecdsa� s c C s
| t k S( N( R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _is_md5� s c C s | t t t t f k S( N( R R R R
( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _is_sha1� s c C s | t t f k S( N( R R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha256� s c C s
| t k S( N( R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha384� s c C s
| t k S( N( R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt
_is_sha512� s c C s� t | � r t j � St | � r, t j � St | � rB t j � St | � rX t j � St | � rn t
j � St d | � � d S( Ns unknown hash for algorithm %u( RX t MD5R4 RY R2 RZ R3 R[ t SHA384R\ t SHA512R ( R* ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt
_make_hash� s
c C s> t | � r- d d d d d d d d g } n� t | � rQ d d d
d d g } np t | � r� d d d d
d d
d d d
g } n@ t | � r� d d d d
d d
d d d
g } n t d | � � t | � } t | � j } d g d | | g d | d g d | g | d d g d | g } t j d t | � | � S( Ni* i� iH i� i
i i i+ i i i i` i ie i s unknown algorithm %ui0 i i i s !%dB(
RX RY RZ R\ R R, R` t digest_sizeR< R= ( R* t oidt olent dlent idbytes( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _make_algorithm_id� s ! $ $ Hc ' C s0 t | t � r- t j j | t j j � } n t | | � } | d k rW t d � � n x�| D]�} t | t � r� | d } | d } n | j } | } | d k r� t
j
� } n | j | k r� t d � � n | j | k r� t d � � n t
| j � } t | j � r�| j }
t j d |
d d !� \ } |
d }
| d k rrt j d |
d d !� \ } |
d }
n |
d | !} |
| }
y+ t j t j |
� t j | � f � } Wn t k
r�t d � � n X| j } nFt | j � r�| j }
t j d |
d d !� \ } |
d }
d
| d } |
d d !} |
d }
|
d | !} |
| }
|
d | !} |
| }
|
d | !} t j t j | � t j | � t j | � t j | � f � } | j d } nYt | j � r| j }
| j t k r t j j } d
} n$ | j t k r-t j j! } d } n t j |
d | !� } t j |
| | d !� } t j j" | j# | | � s�t d � � n t j$ j% | j& | | | j' � } t j( j) j* | | � } t+ | | � } | j | } | j | } t j j, t j | � t j | � � } n t d | j � � | j- t. | | � d � | j- | j/ j0 | � � | j1 t2 | � d k r�| j3 | j1 d � d } t j j d | � } n | j0 | � } t j4 d | j5 | j6 | j7 � } t8 | � }! xi |! D]a }" | j- | � | j- | � |" j0 | � }# t j4 d t2 |# � � }$ | j- |$ � | j- |# � q�Wy� t | j � r�t9 j: | � }% |% j; | | � n� t | j � r�t< j: | d � }% |% j; | | � nL t | j � r�| j= � }& | j; |& | � s t � q n t d | j � � d SWq^ t k
rq^ q^ Xq^ Wt d � � d S( s Validate an RRset against a single signature rdata
The owner name of *rrsig* is assumed to be the same as the owner name
of *rrset*.
*rrset* is the RRset to validate. It can be a ``dns.rrset.RRset`` or
a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple.
*rrsig* is a ``dns.rdata.Rdata``, the signature to validate.
*keys* is the key dictionary, used to find the DNSKEY associated with
a given name. The dictionary is keyed by a ``dns.name.Name``, and has
``dns.node.Node`` or ``dns.rdataset.Rdataset`` values.
*origin* is a ``dns.name.Name``, the origin to use for relative names.
*now* is an ``int``, the time to use when validating the signatures,
in seconds since the UNIX epoch. The default is the current time.
s unknown keyi i t expireds
not yet valids !Bs !Hi s invalid public keyi@ i i i i0 s invalid ECDSA keys unknown algorithm %ui t *s !HHIs
fips-186-3Ns verify failure(> R5 R R6 R7 R8 t rootRS R R t tuplet timet
expirationt inceptionR` R* RT R- R< t unpackt CryptoRSAt constructt numbert
bytes_to_longt
ValueErrort signatureRU t CryptoDSARW R t ecdsat curvest NIST256pR t NIST384pt point_is_validt generatort
ellipticcurvet Pointt curvet orderRO t VerifyingKeyt from_public_pointt ECKeyWrappert SignatureR9 R( RG t
to_digestablet labelsR, t splitR= t rdtypet rdclasst original_ttlt sortedt pkcs1_15R4 t verifyt DSSR; (' t rrsetRP RO R# t nowRQ t
candidate_keyt rrnameRR RD t keyptrt bytes_t rsa_et rsa_nt pubkeyt sigt tt octetst dsa_qt dsa_pt dsa_gt dsa_yR~ t key_lenR R t pointt
verifying_keyt rR' t suffixt rrnamebuft rrfixedt rrlistt rrt rrdatat rrlent verifierR; ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _validate_rrsig s�
!
c C s t | t � r- t j j | t j j � } n t | t � rI | d } n | j } t | t � rx | d } | d } n | j } | } | j | � } | j | � } | | k r� t d � � n x@ | D]8 } y t | | | | | � d SWq� t k
r� q� Xq� Wt d � � d S( s� Validate an RRset.
*rrset* is the RRset to validate. It can be a ``dns.rrset.RRset`` or
a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple.
*rrsigset* is the signature RRset to be validated. It can be a
``dns.rrset.RRset`` or a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple.
*keys* is the key dictionary, used to find the DNSKEY associated with
a given name. The dictionary is keyed by a ``dns.name.Name``, and has
``dns.node.Node`` or ``dns.rdataset.Rdataset`` values.
*origin* is a ``dns.name.Name``, the origin to use for relative names.
*now* is an ``int``, the time to use when validating the signatures,
in seconds since the UNIX epoch. The default is the current time.
i i s owner names do not matchNs no RRSIGs validated(
R5 R R6 R7 R8 Ri Rj t choose_relativityR R� ( R� t rrsigsetRO R# R� R� t rrsignamet
rrsigrdatasetRP ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _validate� s*
c O s t d � � d S( Ns5 DNSSEC validation requires pycryptodome/pycryptodomex( t NotImplementedError( t argst kwargs( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt _need_pycrypto� s ( R] R2 R3 R^ R_ ( t RSAR ( R� R� ( Rq R� c B s e Z d � Z d � Z RS( c C s | | _ | | _ d S( N( R- R� ( t selfR- R� ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt __init__ s c C s% t j | � } | j j j | | � S( N( Rq Rr R- R� t verifies( R� R; R� t diglong( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyR� s ( R R R� R� ( ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyR� � s (X R t ioR R< Rk t
dns.exceptionR6 t dns.namet dns.nodet dns.rdatasett dns.rdatat
dns.rdatatypet dns.rdataclasst _compatR t exceptiont DNSExceptionR R R R R R
R R R
R R R R R R R R t itemsR R R" R( R R1 RF RS RT RU RW RX RY RZ R[ R\ R` Rf R� R� R� t Crypto.HashR] R2 R3 R^ R_ t Crypto.PublicKeyR� Ro Ru t Crypto.SignatureR� R� t Crypto.UtilRq t ImportErrort Cryptodome.Hasht Cryptodome.PublicKeyt Cryptodome.Signaturet Cryptodome.Utilt validatet validate_rrsigt Falset _have_pycryptoRV t TrueRv t ecdsa.ecdsat ecdsa.ellipticcurvet
ecdsa.keyst objectR� ( ( ( s? /opt/plesk/python/2.7/lib/python2.7/site-packages/dns/dnssec.pyt <module> s�
% �0 (
(
Mini Shell