HOME

�
��Sc@s:dZd
dl
Z
d
dlZd
dlZd
dlZd
dlZd
dlZd
dlZd
dl	Zd
dl
Zd
dlZd
dlZdej
jf
d��YZdej
jf
d��YZdZdZd	Zd
ZdZdZd
ZdZdZdZdZdZdZdZied6ed6ed6ed6ed6ed6ed6ed6ed6ed6ed6ed 6ed!6ed"6Ze gej!�D]\Z"Z#e#e"f^q�
�
Z$d#�Z%d$�Z&d%�Z'dd&�
Z)dd'�
Z*d(�Z+d)�Z,d*�Z-d+�Z.d,�Z/d-�Z0d.�Z1d/�Z2d0�Z3d1�Z4d2�Z5ddd3�Z6ddd4�Z7d5�Z8y:d
dl9Z:d
dl;Z:d
dl<Z:e7Z=e6Z>e?Z@Wn#eAk
r�


e8Z=e8Z>eBZ@n
XyPd
dlCZCd
dlDZCd
dlEZCd
dlFZCe?ZGd6eHf
d7��YZIWneAk
r5


eBZGn
XdS(8s.Common DNSSEC-related functions and constants.i����NtUnsupportedAlgorithmc
BseZ
dZRS(
s(Raised if an algorithm is not supported.(t__name__t
__module__t__doc__(((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyRs

tValidationFailurec
BseZ
dZRS(
s The DNSSEC signature is invalid.(R
RR(((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyR#s

i
iiiiiiii
i
ii�i�i�tRSAMD5tDHtDSAtECCtRSASHA1tDSANSEC3SHA1tRSASHA1NSEC3SHA1t	RSASHA256t	RSASHA512tINDIRECTtECDSAP256SHA256tECDSAP384SHA384t
PRIVATEDNSt
PRIVATEOIDc
Cs4tj
|j��
}
|
d
kr0t|�
}
n|
S(s:Convert text into a DNSSEC algorithm value
    @rtype: intN(t_algorithm_by_texttgettuppertNonetint(ttexttvalue((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pytalgorithm_from_textMs


c
Cs.tj
|�
}
|
d
kr*t|�
}
n|
S(s;Convert a DNSSEC algorithm value to text
    @rtype: stringN(t_algorithm_by_valueRRtstr(RR((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pytalgorithm_to_textVs


cCs)tj
�}|j|d
|
�


|j�S(Ntorigin(t	cStringIOtStringIOtto_wiretgetvalue(trecordRt
s((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt	_to_rdata_s


cCs�t||
�}|j
tkr>t|d
�
d>t|d�
Sd}xPtt|�
d�
D]8}|t|d|�
d>t|d|d�
7}q[Wt|�
ddkr�|t|t|�
d�
d>7}n||d?d@7}|d@SdS(	Ni����ii����iii
ii��(R%t	algorithmRtordtrangetlen(tkeyRtrdatattotalt
i((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pytkey_idds


 

6

%

cCs(
|j�d
kr0d}t
jjd
�
�}n=|j�dkr`d}t
jjd�
�}n
td|�t|ttf�r�t
jj	||�}n|j
|j�j��

|j
t
|
|��

|j�}tjdt|
�
|
j|�|}t
jjt
jjt
jj|dt|�
�S(NtSHA1i
tSHA256isunsupported algorithm "%s"s!HBBi(RtdnsthashRRt
isinstanceRtunicodetnamet	from_texttupdatetcanonicalizeR!R%tdigesttstructtpackR.R&R+t	from_wiret
rdataclasstINt	rdatatypetDSR)(R5R*R&RtdsalgR2R9tdsrdata((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pytmake_dsqs










%
!
cCs�g}|j|
j
�
}|dkr(dSt|tjj�rwy"|jtjj	tj
j�}Wq}tk
rs


dSXn|}xE|D]=}|j
|
j
kr�t|�
|
jkr�|j|�

q�q�W|S(
N(RtsignerRR3R1tnodetNodet
find_rdatasetR=R>R?tDNSKEYtKeyErrorR&R.tkey_tagtappend(tkeystrrsigtcandidate_keysRtrdatasetR+((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_find_candidate_keys�s 
















c

Cs|tt
tttfkS(
N(RR	RRR
(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_is_rsa�s
	

c

Cs|tt
fkS(
N(RR
(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_is_dsa�s
c

Csto|t
tfkS(
N(t_have_ecdsaRR(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt	_is_ecdsa�s
c

Cs
|tkS(
N(
R(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_is_md5�s
c

Cs|tt
ttfkS(
N(RR	R
R(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_is_sha1�s
	
c

Cs|tt
fkS(
N(RR(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt
_is_sha256�s
c

Cs
|tkS(
N(
R(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt
_is_sha384�s
c

Cs
|tkS(
N(
R
(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt
_is_sha512�s
c

Cs�t|�
rt
jjd
�
�St|�
r>t
jjd�
�St|�
r]t
jjd�
�St|�
r|t
jjd�
�St|�
r�t
jjd�
�Std|�dS(NtMD5R/R0tSHA384tSHA512sunknown hash for algorithm %u(	RUR1R2RRVRWRXRYR(
R&((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt
_make_hash�s










c
	Cs7
t|�
r-d
dddddddg}
n�t
|�
rQdd	d
ddg}
nmt|�
r�dddd
dd
ddd
g	}
n=t|�
r�dddd
dd
ddd
g	}
n
td|�t|
�
}t|�
j}dg
d||g
d|dgd|g|
ddgd|g}djt	t
|��
S(Ni*i�iHi�i
iii+iiii`i
ieisunknown algorithm %ui0iiit(RURVRWRYRR)R]tdigest_sizetjointmaptchr(R&toidtolentdlentidbytes((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_make_algorithm_id�s

!



$

$


H
c*Cszt|t
tf�r3tjj|tjj�}nx7t||
�D]&}|s[td
�nt|t	�r�|d}|d}n|j}|}|dkr�tj�}n|
j|kr�td�n|
j
|kr�td�nt|
j�
}t|
j�
r�
|j}	tjd|	dd!�\
}
|	d}	|
dkrc
tjd|	dd!�\
}
|	d}	n|	d|
!}|	|
}t|�
d	}
tjjjtjjj|�
tjjj|�
f�
}tjjj|
j�
f
}n�t|
j�
r(|j}	tjd|	dd!�\
}|	d}	d
|d	}|	dd!}|	d}	|	d|!}|	|}	|	d|!}|	|}	|	d|!}tjjjtjjj|�
tjjj|�
tjjj|�
tjjj|�
f�
}tjd|
jd�\}}tjjj|�
tjjj|�
f}nY
t|
j�
rq|
jt krat!j"j#}d
}d
}n3|
jt$kr�t!j"j%}d}d}n	td�|j}	tjjj|	d|!�
}tjjj|	||d!�
}t!j&j'|j(|||j)�}t!j*j+j,||�}t-||�}|
j| }|
j|} t!j!j.tjjj|�
tjjj| �
�}ntd|
j�|j/t0|
|�d �

|j/|
j1j2|�
�

|
j3t|�
dkr�|j4|
j3d�
d}!tjjd|!�}n|j2|�
}"tj5d|j6|j7|
j8�}#t9|�
}$xi|$D]a}%|j/|"�

|j/|#�

|%j2|�
}&tj5dt|&�
�}'|j/|'�

|j/|&�

qBW|j:�}(t|
j�
r"t;|
j�
|(}(|
d	t|(�
d})t<d�
t<d�
t<d�
|)t<d�
|(}(n1t|
j�
sSt|
j�
rCntd|
j�|j=|(|�rCdSqCWtd�dS(s�Validate an RRset against a single signature rdata

    The owner name of the rrsig is assumed to be the same as the owner name
    of the rrset.

    @param rrset: The RRset to validate
    @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
    tuple
    @param rrsig: The signature rdata
    @type rrsig: dns.rrset.Rdata
    @param keys: The key dictionary.
    @type keys: a dictionary keyed by dns.name.Name with node or rdataset values
    @param origin: The origin to use for relative names
    @type origin: dns.name.Name or None
    @param now: The time to use when validating the signatures.  The default
    is the current time.
    @type now: int
    sunknown keyii
texpireds
not yet valids!Bs!Hiii@is!20s20si i0sunknown ECDSA curvesunknown algorithm %uit
*s!HHIii�Nsverify failure(>R3RR4R1R5R6trootRPRttupleRttimet
expirationt	inceptionR]R&RQR*R:tunpackR)tCryptot	PublicKeytRSAt	constructtUtiltnumbert
bytes_to_longt	signatureRRRRTRtecdsatcurvestNIST256pRtNIST384pt
ellipticcurvetPointtcurvetorderRLtVerifyingKeytfrom_public_pointtECKeyWrappert	SignatureR7R%RDt
to_digestabletlabelstsplitR;trdtypetrdclasstoriginal_ttltsortedR9RgRbtverify(*trrsetRMRLRtnowt
candidate_keytrrnameROR2tkeyptrtbytestrsa_etrsa_ntkeylentpubkeytsigt
ttoctetstdsa_qtdsa_ptdsa_gtdsa_ytdsa_rtdsa_sR~tkey_lent
digest_lent
xt
ytpointt
verifying_keyt
rR$tsuffixt	rrnamebuftrrfixedtrrlisttrrtrrdatatrrlenR9tpadlen((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_validate_rrsig�s�






	






	

















	






























	



		
	

 !

	


























5



c
Cs
t|t
tf�r3tjj|tjj�}nt|t�rO|d
}n	|j}t|
t�r~|
d
}|
d}n|
j}|
}|j|�
}|j|�
}||kr�t	d�nxB|D]:}yt
|||||�
dSWq�t	k
r

}	
q�Xq�Wt	d�dS(sdValidate an RRset

    @param rrset: The RRset to validate
    @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
    tuple
    @param rrsigset: The signature RRset
    @type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset)
    tuple
    @param keys: The key dictionary.
    @type keys: a dictionary keyed by dns.name.Name with node or rdataset values
    @param origin: The origin to use for relative names
    @type origin: dns.name.Name or None
    @param now: The time to use when validating the signatures.  The default
    is the current time.
    @type now: int
    ii
sowner names do not matchNsno RRSIGs validated(R3RR4R1R5R6RjRktchoose_relativityRR�(
R�trrsigsetRLRR�R�t	rrsignamet
rrsigrdatasetRMt
e((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt	_validatea
s*


	



	










cOs
td
�dS(Ns#DNSSEC validation requires pycrypto(
tNotImplementedError(targstkwargs((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt_need_pycrypto�
s
R�c
BseZ
d�Zd
�ZRS(cCs|
|_||_
dS(
N(R*R�(tselfR*R�((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt__init__�
s
	
cCs+tj
jj|
�
}|jjj||�S(
N(RpRtRuRvR*R�tverifies(R�R9R�tdiglong((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyR��
s

(R
RR�R�(((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyR��
s
	(JRRR:Rlt
dns.exceptionR1tdns.hashtdns.nametdns.nodetdns.rdatasett	dns.rdatat
dns.rdatatypetdns.rdataclasst	exceptiontDNSExceptionRRRRRRR	R
RRR
RRRRRRtdictt	iteritemsR�R�RRRR%RR.RCRPRQRRRTRURVRWRXRYR]RgR�R�R�tCrypto.PublicKey.RSARptCrypto.PublicKey.DSAtCrypto.Util.numbertvalidatetvalidate_rrsigtTruet_have_pycryptotImportErrortFalseRxtecdsa.ecdsatecdsa.ellipticcurvet
ecdsa.keysRStobjectR�(((s0/usr/lib64/python2.7/site-packages/dns/dnssec.pyt<module>s�




































1					
										
	�.