관리-도구
편집 파일: dnssec.cpython-36.opt-1.pyc
3 �b�W�9 � @ sH d Z ddlmZ ddlZddlZddlZddlZddlZddl Zddl Zddl Zddl Zddl ZddlmZ G dd� dejj�ZG dd � d ejj�ZdZd Zd Zd Zd ZdZdZdZdZ dZ dZ dZ dZ dZ!eeeeeeeee e e e e e!d�Z"e#dd� e"j$� D ��Z%dd� Z&d d � Z'd d � Z(dDd d!�Z)dEd"d#�Z*d$d%� Z+d&d'� Z,d(d)� Z-d*d+� Z.d,d-� Z/d.d/� Z0d0d1� Z1d2d3� Z2d4d5� Z3d6d7� Z4d8d9� Z5dFd:d;�Z6dGd<d=�Z7d>d?� Z8y(ddl9Z:ddl;Z:ddl<Z:e7Z=e6Z>d@Z?W n" e@k �r� e8Z=e8Z>dAZ?Y nX y8ddlAZAddlBZAddlCZAddlDZAd@ZEG dBdC� dCeF�ZGW n e@k �rB dAZEY nX dS )Hz.Common DNSSEC-related functions and constants.� )�BytesION� )� string_typesc @ s e Zd ZdZdS )�UnsupportedAlgorithmz&The DNSSEC algorithm is not supported.N)�__name__� __module__� __qualname__�__doc__� r r � /usr/lib/python3.6/dnssec.pyr ! s r c @ s e Zd ZdZdS )�ValidationFailurez The DNSSEC signature is invalid.N)r r r r r r r r r & s r � � � � � � � � � � � � � )�RSAMD5�DH�DSA�ECC�RSASHA1� DSANSEC3SHA1�RSASHA1NSEC3SHA1� RSASHA256� RSASHA512�INDIRECT�ECDSAP256SHA256�ECDSAP384SHA384� PRIVATEDNS� PRIVATEOIDc c s | ]\}}||fV qd S )Nr )�.0�x�yr r r � <genexpr>N s r+ c C s" t j| j� �}|dkr t| �}|S )z:Convert text into a DNSSEC algorithm value @rtype: intN)�_algorithm_by_text�get�upper�int)�text�valuer r r �algorithm_from_textQ s r2 c C s t j| �}|dkrt| �}|S )z;Convert a DNSSEC algorithm value to text @rtype: stringN)�_algorithm_by_valuer- �str)r1 r0 r r r �algorithm_to_text[ s r5 c C s t � }| j||d� |j� S )N)�origin)r �to_wire�getvalue)�recordr6 �sr r r � _to_rdatae s r; c C s� t | |�}t|�}| jtkr0|d d> |d S d}x<tt|�d �D ](}||d| d> |d| d 7 }qFW t|�d dkr�||t|�d d> 7 }||d? d@ 7 }|d@ S d S ) Nr r r r r � i�� ������)r; � bytearray� algorithmr �range�len)�keyr6 �rdataZtotal�ir r r �key_idk s rF c C s� |j � dkr d}tjjd � }n,|j � dkr@d}tjjd � }n td| ��t| t�rdtjj| |�} |j | j � j � � |j t ||�� |j � }tjdt|�|j|�| }tjjtjjtjj|dt|��S )N�SHA1r �SHA256r zunsupported algorithm "%s"z!HBBr )r. �dns�hash�hashesr � isinstancer �name� from_text�updateZ canonicalizer7 r; �digest�struct�packrF r@ rD Z from_wire� rdataclass�IN� rdatatypeZDSrB )rM rC r@ r6 ZdsalgrJ rP Zdsrdatar r r �make_ds{ s rV c C s� g }| j |j�}|d kr d S t|tjj�rZy|jtjjtj j �}W q^ t k rV d S X n|}x0|D ](}|j |j krdt |�|jkrd|j|� qdW |S )N)r- �signerrL rI ZnodeZNodeZ find_rdatasetrS rT rU ZDNSKEY�KeyErrorr@ rF Zkey_tag�append)�keys�rrsigZcandidate_keysr1 �rdatasetrD r r r �_find_candidate_keys� s r] c C s | t ttttfkS )N)r r r r! r" )r@ r r r �_is_rsa� s r^ c C s | t tfkS )N)r r )r@ r r r �_is_dsa� s r_ c C s t o| ttfkS )N)� _have_ecdsar$ r% )r@ r r r � _is_ecdsa� s ra c C s | t kS )N)r )r@ r r r �_is_md5� s rb c C s | t tttfkS )N)r r r r )r@ r r r �_is_sha1� s rc c C s | t tfkS )N)r! r$ )r@ r r r � _is_sha256� s rd c C s | t kS )N)r% )r@ r r r � _is_sha384� s re c C s | t kS )N)r" )r@ r r r � _is_sha512� s rf c C s~ t | �rtjjd � S t| �r,tjjd � S t| �rBtjjd � S t| �rXtjjd � S t| �rntjjd � S td| ��d S )NZMD5rG rH ZSHA384ZSHA512z unknown hash for algorithm %u) rb rI rJ rK rc rd re rf r )r@ r r r � _make_hash� s rg c C s� t | �r ddddddddg}ndt| �r6dd d dd g}nLt| �rVd ddd dd ddd g }n,t| �rvd ddd dd ddd g }n td| ��t|�}t| �j}dgd| | g d|d g d|g | ddg d|g }tj dt|� f|�� S )N�* � �H � r r r �+ r r � �` r �e r zunknown algorithm %u�0 r r r z!%dB) rb rc rd rf r rB rg Z digest_sizerQ rR )r@ ZoidZolenZdlenZidbytesr r r �_make_algorithm_id� s <rq c ) C s� t |t�r tjj|tjj�}�x�t||�D �]�}|s<td��t | t�rX| d }| d }n | j}| }|dkrrt j � }|j |k r�td��|j |kr�td��t |j �}t|j ��r`|j} tjd| dd� �\} | dd� } | dk�r tjd| dd � �\} | d d� } | d| � } | | d� } t| �d } tjjjtjjj| �tjjj| �f�}tjjj|j�f}�nt|j ��rj|j} tjd| dd� �\}| dd� } d |d }| dd � }| d d� } | d|� }| |d� } | d|� }| |d� } | d|� }tjj jtjjj|�tjjj|�tjjj|�tjjj|�f�}tjd |jdd� �\}}tjjj|�tjjj|�f}n�t |j ��rX|j t k�r�t j j!}d}n"|j t"k�r�t j j#}d}ntd��|j} tjjj| d|� �}tjjj| ||d � �}t j$j%|j&|||j'�} t j(j)j*| |�} t+| |�}|jd|� } |j|d� } t j j,tjjj| �tjjj| ��}ntd|j ��|j-t.||�dd� � |j-|j/j0|�� |j1t|�d k �r�|j2|j1d �d } tjjd| �}|j0|�}!tj3d|j4|j5|j6�}"t7|�}#xP|#D ]H}$|j-|!� |j-|"� |$j0|�}%tj3dt|%��}&|j-|&� |j-|%� �q�W |j8� }'t|j ��r�t9|j �|' }'| d t|'� d }(tj3dd |( d fddgdg|( dg �� |' }'n(t|j ��s�t |j ��r�ntd|j ��|j:|'|�r*dS q*W td��dS )a� Validate an RRset against a single signature rdata The owner name of the rrsig is assumed to be the same as the owner name of the rrset. @param rrset: The RRset to validate @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param rrsig: The signature rdata @type rrsig: dns.rrset.Rdata @param keys: The key dictionary. @type keys: a dictionary keyed by dns.name.Name with node or rdataset values @param origin: The origin to use for relative names @type origin: dns.name.Name or None @param now: The time to use when validating the signatures. The default is the current time. @type now: int z unknown keyr r NZexpiredz not yet validz!Bz!Hr r �@ � z!20s20s� rp zunknown ECDSA curvezunknown algorithm %u� �*z!HHIr z!%dB� zverify failure);rL r rI rM rN �rootr] r �tuple�timeZ expirationZ inceptionrg r@ r^ rC rQ �unpackrB �CryptoZ PublicKeyZRSAZ construct�Util�number� bytes_to_longZ signaturer_ r ra r$ �ecdsaZcurvesZNIST256pr% ZNIST384pZ ellipticcurveZPoint�curve�orderrZ Z VerifyingKeyZfrom_public_point� ECKeyWrapperZ SignaturerO r; rW Z to_digestableZlabels�splitrR ZrdtypeZrdclassZ original_ttl�sortedrP rq �verify))�rrsetr[ rZ r6 �nowZ candidate_key�rrnamer\ rJ ZkeyptrZbytes_Zrsa_eZrsa_nZkeylen�pubkey�sig�tZoctetsZdsa_qZdsa_pZdsa_gZdsa_yZdsa_rZdsa_sr� �key_lenr) r* ZpointZ verifying_key�rr: �suffixZ rrnamebufZrrfixedZrrlistZrrZrrdataZrrlenrP Zpadlenr r r �_validate_rrsig� s� " r� c C s� t |t�r tjj|tjj�}t | t�r0| d }n| j}t |t�rR|d }|d }n |j}|}|j|�}|j|�}||kr�td��x6|D ].}yt | ||||� dS tk r� Y q�X q�W td��dS )ah Validate an RRset @param rrset: The RRset to validate @type rrset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param rrsigset: The signature RRset @type rrsigset: dns.rrset.RRset or (dns.name.Name, dns.rdataset.Rdataset) tuple @param keys: The key dictionary. @type keys: a dictionary keyed by dns.name.Name with node or rdataset values @param origin: The origin to use for relative names @type origin: dns.name.Name or None @param now: The time to use when validating the signatures. The default is the current time. @type now: int r r zowner names do not matchNzno RRSIGs validated) rL r rI rM rN rx ry Zchoose_relativityr r� ) r� ZrrsigsetrZ r6 r� r� Z rrsignameZ rrsigrdatasetr[ r r r � _validatex s* r� c O s t d��d S )Nz#DNSSEC validation requires pycrypto)�NotImplementedError)�args�kwargsr r r �_need_pycrypto� s r� TFc @ s e Zd Zdd� Zdd� ZdS )r� c C s || _ || _d S )N)rC r� )�selfrC r� r r r �__init__� s zECKeyWrapper.__init__c C s t jjj|�}| jjj||�S )N)r| r} r~ r rC r� Zverifies)r� rP r� Zdiglongr r r r� � s zECKeyWrapper.verifyN)r r r r� r� r r r r r� � s r� )N)N)NN)NN)Hr �ior rQ rz Z dns.exceptionrI Zdns.hashZdns.nameZdns.nodeZ dns.rdatasetZ dns.rdataZ dns.rdatatypeZdns.rdataclassZ_compatr Z exceptionZ DNSExceptionr r r r r r r r r r! r" r$ r% r# r& r' r, �dict�itemsr3 r2 r5 r; rF rV r] r^ r_ ra rb rc rd re rf rg rq r� r� r� ZCrypto.PublicKey.RSAr| ZCrypto.PublicKey.DSAZCrypto.Util.numberZvalidateZvalidate_rrsigZ_have_pycrypto� ImportErrorr� Z ecdsa.ecdsaZecdsa.ellipticcurveZ ecdsa.keysr` �objectr� r r r r �<module> s� 0