3 [_]x@@sdZddlmZddlZddlZddlZddlZddlZddl Zddl Zddl Zddl Zddl mZGdddejjZGdd d ejjZdZd Zd Zd Zd ZdZdZdZdZdZdZdZdZdZ eeeeeeeeeeeeee dZ!dde!j"DZ#ddZ$ddZ%ddZ&dHd d!Z'dId"d#Z(d$d%Z)d&d'Z*d(d)Z+d*d+Z,d,d-Z-d.d/Z.d0d1Z/d2d3Z0d4d5Z1d6d7Z2d8d9Z3dJd:d;Z4dKdd?Z6yyLdd@l7m8Z8m9Z9m:Z:m;Z;mZ?mZ@ddBlAmBZBmCZCddClDmEZEWn^eFk rDdd@lGm8Z8m9Z9m:Z:m;Z;mZ?mZ@ddBlImBZBmCZCddClJmEZEYnXWn&eFk rne6ZKe6ZLdDZMdDZNYnbXe5ZKe4ZLdEZMy$ddlOZOddlPZOddlQZOddlRZOWneFk rdDZNYnXdEZNGdFdGdGeSZTdS)Lz.Common DNSSEC-related functions and constants.)BytesION) string_typesc@seZdZdZdS)UnsupportedAlgorithmz&The DNSSEC algorithm is not supported.N)__name__ __module__ __qualname____doc__r r //tmp/pip-build-yz_zf6az/dnspython/dns/dnssec.pyr"src@seZdZdZdS)ValidationFailurez The DNSSEC signature is invalid.N)rrrr r r r r r &sr  )RSAMD5DHDSAECCRSASHA1 DSANSEC3SHA1RSASHA1NSEC3SHA1 RSASHA256 RSASHA512INDIRECTECDSAP256SHA256ECDSAP384SHA384 PRIVATEDNS PRIVATEOIDcCsi|]\}}||qSr r ).0xyr r r \sr+cCs"tj|j}|dkrt|}|S)zIConvert text into a DNSSEC algorithm value. Returns an ``int``. N)_algorithm_by_textgetupperint)textvaluer r r algorithm_from_text_sr2cCstj|}|dkrt|}|S)zEConvert a DNSSEC algorithm value to text Returns a ``str``. N)_algorithm_by_valuer-str)r1r0r r r algorithm_to_textks r5cCst}|j||d|jS)N)origin)rto_wiregetvalue)recordr6sr r r _to_rdatawsr;cCst||}t|}|jtkr0|d d>|d Sd}x|d|d7}qFWt|ddkr||t|dd>7}||d?d@7}|d@SdS) zReturn the key id (a 16-bit number) for the specified key. Note the *origin* parameter of this function is historical and is not needed. Returns an ``int`` between 0 and 65535. rrr rriN)r; bytearray algorithmrrangelen)keyr6rdatatotalir r r key_id}s  rGcCs|jdkrd}tj}n&|jdkr4d}tj}n td|t|trXtjj ||}|j |j j |j t |||j}tjdt||j||}tjjtjjtjj|dt|S)aCreate a DS record for a DNSSEC key. *name* is the owner name of the DS record. *key* is a ``dns.rdtypes.ANY.DNSKEY``. *algorithm* is a string describing which hash algorithm to use. The currently supported hashes are "SHA1" and "SHA256". Case does not matter for these strings. *origin* is a ``dns.name.Name`` and will be used as the origin if *key* is a relative name. Returns a ``dns.rdtypes.ANY.DS``. SHA1rSHA256r zunsupported algorithm "%s"z!HBBr)r.rHnewrIr isinstancerdnsname from_textupdateZ canonicalizer7r;digeststructpackrGr@rDZ from_wire rdataclassIN rdatatypeZDSrB)rMrCr@r6ZdsalghashrPZdsrdatar r r make_dss      rWc Csg}|j|j}|dkrdSt|tjjrZy|jtjjtj j }Wq^t k rVdSXn|}x0|D](}|j |j krdt ||jkrd|j|qdW|S)N)r-signerrKrLnodeNodeZ find_rdatasetrSrTrUZDNSKEYKeyErrorr@rGZkey_tagappend)keysrrsigcandidate_keysr1rdatasetrDr r r _find_candidate_keyss     racCs|tttttfkS)N)rrr r!r")r@r r r _is_rsasrbcCs |ttfkS)N)rr)r@r r r _is_dsasrccCsto|ttfkS)N) _have_ecdsar$r%)r@r r r _is_ecdsasrecCs|tkS)N)r)r@r r r _is_md5srfcCs|ttttfkS)N)rrrr )r@r r r _is_sha1srgcCs |ttfkS)N)r!r$)r@r r r _is_sha256srhcCs|tkS)N)r%)r@r r r _is_sha384sricCs|tkS)N)r")r@r r r _is_sha512srjcCs`t|rtjSt|r tjSt|r0tjSt|r@tjSt |rPt jSt d|dS)Nzunknown hash for algorithm %u) rfMD5rJrgrHrhrIriSHA384rjSHA512r )r@r r r _make_hashsrnc Cst|rddddddddg}ndt|r6dd d dd g}nLt|rVd ddd dd ddd g }n,t|rvd ddd dd ddd g }n td|t|}t|j}dgd||gd|dgd|g|ddgd|g}tj dt|f|S)N*Hrr r+rr`rerzunknown algorithm %u0rrrz!%dB) rfrgrhrjr rBrn digest_sizerQrR)r@oidZolendlenZidbytesr r r _make_algorithm_ids  <r{c'Cst|trtjj|tjj}t||}|dkr6tdxx|D]n}t|tr`|d}|d}n |j}|}|dkrzt j }|j |krtd|j |krtdt |j } t|j rh|j} tjd| dd\} | dd} | dkrtjd| dd \} | d d} | d| } | | d} ytjtj| tj| f}Wntk r\td YnX|j}nt|j r8|j} tjd| dd\}| dd} d |d }| dd }| d d} | d|}| |d} | d|}| |d} | d|}tjtj|tj|tj|tj|f}|jdd}nt|j r(|j} |j tkrdtjj}d}n|j tkr|tjj }d}tj| d|}tj| ||d }tjj!|j"||stdtj#j$|j%|||j&}tj'j(j)||}t*||}|jd|}|j|d}tjj+tj|tj|}ntd|j | j,t-||dd| j,|j.j/||j0t1|dkr|j2|j0dd}tjjd|}|j/|}tj3d|j4|j5|j6} t7|}!xP|!D]H}"| j,|| j,| |"j/|}#tj3dt1|#}$| j,|$| j,|#qWyt|j r6t8j9|}%|%j:| |n\t|j r\t;j9|d}%|%j:| |n6t|j r| j<}&|j:|&|stntd|j dStk rw>Yq>Xq>WtddS)aValidate an RRset against a single signature rdata The owner name of *rrsig* is assumed to be the same as the owner name of *rrset*. *rrset* is the RRset to validate. It can be a ``dns.rrset.RRset`` or a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple. *rrsig* is a ``dns.rdata.Rdata``, the signature to validate. *keys* is the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin* is a ``dns.name.Name``, the origin to use for relative names. *now* is an ``int``, the time to use when validating the signatures, in seconds since the UNIX epoch. The default is the current time. Nz unknown keyrrZexpiredz not yet validz!Bz!Hr zinvalid public key@r rwzinvalid ECDSA keyzunknown algorithm %u*z!HHIz fips-186-3zverify failure)=rKrrLrMrNrootrar tupletimeZ expirationZ inceptionrnr@rbrCrQunpack CryptoRSAZ constructnumber bytes_to_long ValueError signaturerc CryptoDSArer$ecdsaZcurvesZNIST256pr%ZNIST384pZpoint_is_valid generatorZ ellipticcurveZPointcurveorderr]Z VerifyingKeyZfrom_public_point ECKeyWrapper SignaturerOr;rXZ to_digestablelabelsrBsplitrRZrdtypeZrdclassZ original_ttlsortedpkcs1_15rJverifyDSSrP)'rrsetr^r]r6nowr_Z candidate_keyrrnamer`rVZkeyptrbytes_Zrsa_eZrsa_npubkeysigtoctetsZdsa_qZdsa_pZdsa_gZdsa_yrkey_lenr)r*ZpointZ verifying_keyrr:suffixZ rrnamebufZrrfixedZrrlistZrrZrrdataZrrlenZverifierrPr r r _validate_rrsigs                                         rc Cst|trtjj|tjj}t|tr0|d}n|j}t|trR|d}|d}n |j}|}|j|}|j|}||krtdx6|D].}yt |||||dStk rYqXqWtddS)aValidate an RRset. *rrset* is the RRset to validate. It can be a ``dns.rrset.RRset`` or a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple. *rrsigset* is the signature RRset to be validated. It can be a ``dns.rrset.RRset`` or a ``(dns.name.Name, dns.rdataset.Rdataset)`` tuple. *keys* is the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin* is a ``dns.name.Name``, the origin to use for relative names. *now* is an ``int``, the time to use when validating the signatures, in seconds since the UNIX epoch. The default is the current time. rrzowner names do not matchNzno RRSIGs validated) rKrrLrMrNrrZchoose_relativityr r) rZrrsigsetr]r6rrZ rrsignameZ rrsigrdatasetr^r r r _validates*         rcOs tddS)Nz5DNSSEC validation requires pycryptodome/pycryptodomex)NotImplementedError)argskwargsr r r _need_pycryptosr)rkrHrIrlrm)RSAr)rr)rFTc@seZdZddZddZdS)rcCs||_||_dS)N)rCr)selfrCrr r r __init__szECKeyWrapper.__init__cCstj|}|jjj||S)N)rrrCrZverifies)rrPrZdiglongr r r rs zECKeyWrapper.verifyN)rrrrrr r r r rsr)N)N)NN)NN)Ur iorrQrZ dns.exceptionrLZdns.nameZdns.nodeZ dns.rdatasetZ dns.rdataZ dns.rdatatypeZdns.rdataclass_compatr exceptionZ DNSExceptionrr rrrrrrr r!r"r$r%r#r&r'r,itemsr3r2r5r;rGrWrarbrcrerfrgrhrirjrnr{rrrZ Crypto.HashrkrHrIrlrmZCrypto.PublicKeyrrrZCrypto.SignaturerrZ Crypto.Utilr ImportErrorZCryptodome.HashZCryptodome.PublicKeyZCryptodome.SignatureZCryptodome.UtilvalidateZvalidate_rrsigZ_have_pycryptordrZ ecdsa.ecdsaZecdsa.ellipticcurveZ ecdsa.keysobjectrr r r r s      %  0