3 [_] @sdZddlZddlZddlZddlZddlZddlZddlm Z m Z m Z Gdddej j ZGdddej j ZGd d d ej j ZGd d d eZGd ddeZGdddeZGdddeZejjdZejjdZejjdZejjdZejjdZejjdZeejeejeejeej eej!eej"iZ#eZ$dZ%dZ&dZ'dZ(ddde$fdd Z)ddde$fd!d"Z*d)d#d$Z+d%d&Z,d'd(Z-dS)*zDNS TSIG support.N)long string_types text_typec@seZdZdZdS)BadTimez8The current time is not within the TSIG's validity time.N)__name__ __module__ __qualname____doc__r r -/tmp/pip-build-yz_zf6az/dnspython/dns/tsig.pyrsrc@seZdZdZdS) BadSignaturez#The TSIG signature fails to verify.N)rrr r r r r r r "sr c@seZdZdZdS) PeerErrorz;Base class for all TSIG errors generated by the remote peerN)rrr r r r r r r'src@seZdZdZdS) PeerBadKeyz$The peer didn't know the key we usedN)rrr r r r r r r,src@seZdZdZdS)PeerBadSignaturez*The peer didn't like the signature we sentN)rrr r r r r r r1src@seZdZdZdS) PeerBadTimez%The peer didn't like the time we sentN)rrr r r r r r r6src@seZdZdZdS)PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentN)rrr r r r r r r;srzHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256z hmac-sha384z hmac-sha512FTc Cst|tr|j}t| \} }| r\tj||d} t|}|dkr\| jtj d|| j|tj d|}| j|| j|dd| r| j|j | jtj dt j j | jtj dd|td}|d?td@}|td @}tj d |||}| |}t|}|dkrtd tj d |||}| rF| j|| j|n | j|| j}tj dt|}|||||}| rtj||d} t|}| jtj d|| j|nd} ||| fS) ajReturn a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata for the input parameters, the HMAC MAC calculated by applying the TSIG signature algorithm, and the TSIG digest context. @rtype: (string, string, hmac.HMAC object) @raises ValueError: I{other_data} is too long @raises NotImplementedError: I{algorithm} is not supported ) digestmodrz!HNz!I ilz!HIHz TSIG Other Data is > 65535 bytesz!HH) isinstancerencode get_algorithmhmacnewlenupdatestructpack to_digestablednsZ rdataclassANYr ValueErrordigest)wirekeynamesecrettimefudge original_iderror other_data request_macctxmultifirst algorithmZalgorithm_namermlidZ long_time upper_time lower_timeZtime_macZpre_macolZpost_macmacZmpack tsig_rdatar r r signYsN            r<c Cs t|||||||||| | | | S)N)r<) r(r)r*r+r,r-r.r/r0r1r2r3r4r r r hmac_md5sr=c Cstjd|dd\} | dkr&tjj| d8} |ddtjd| |d|} |} tjj|| \}}| |} tjd|| | d\}}}}|tdd>|td}| d7} || | |}| |7} tjd|| | d \}}}| d 7} || | |}| |7} | ||kr tjj|dkrv|t kr:t n<|t krJt n,|t krZtn|tkrjtn td |||}||}||ks||krtt| |||||||||| | | \}}}||krt|S) a*Validate the specified TSIG rdata against the other input parameters. @raises FormError: The TSIG is badly formed. @raises BadTime: There is too much time skew between the client and the server. @raises BadSignature: The TSIG signature did not validate @rtype: hmac.HMAC objectz!H rrz!HIHHrz!HHHzunknown TSIG error code %d)r!unpackr$ exception FormErrorr"name from_wirerBADSIGrBADKEYrBADTIMErBADTRUNCrrrr<r )r(r)r*nowr0Z tsig_startr; tsig_rdlenr1r2r3ZadcountZnew_wirecurrentanameusedr7r8r,mac_sizer+r:r-r.Z other_sizer/time_lowZ time_highZjunkZour_macr r r validatesN $         rQc CsTt|trtjj|}y|jt|fStk rNtdt |dYnXdS)zReturns the wire format string and the hash module to use for the specified TSIG algorithm @rtype: (string, hash constructor) @raises NotImplementedError: I{algorithm} is not supported zTSIG algorithm z is not supportedN) rrr$rD from_textr#_hashesKeyErrorNotImplementedErrorstr)r4r r r rs   rc Csz|}tjj||\}}||}tjd|||d\}}}} |d7}|||| } || 7}|||krrtjj|| fS)zlReturn the tsig algorithm for the specified tsig_rdata @raises FormError: The TSIG is badly formed. z!HIHHr>)r$rDrEr!rArBrC) r(r;rKrLrMrNr7r8r,rOr:r r r get_algorithm_and_macs  rW)NFT).r hashlibrr!Z dns.exceptionr$Zdns.rdataclassZdns.name_compatrrrrBZ DNSExceptionrr rrrrrrDrRZHMAC_MD5Z HMAC_SHA1Z HMAC_SHA224Z HMAC_SHA256Z HMAC_SHA384Z HMAC_SHA512sha224sha256sha384sha512sha1md5rSZdefault_algorithmrFrGrHrIr<r=rQrrWr r r r sL        5  5