3
bW& @ s~ d Z ddlZddlZddlZddlZddlZddlZddlm Z m
Z
m Z G dd dej j
ZG dd dej j
ZG d d
d
ej j
ZG d d d eZG d
d deZG dd deZG dd deZejjdZejjdZejjdZejjdZejjdZejjdZ ededede d ed ed iZ eZ d Z d Z d!Z!d"Z"dd#d$e fd%d&Z#dd#d$e fd'd(Z$d/d)d*Z%d+d, Z&d-d. Z'dS )0zDNS TSIG support. N )long string_types text_typec @ s e Zd ZdZdS )BadTimez8The current time is not within the TSIG's validity time.N)__name__
__module__ __qualname____doc__ r r /usr/lib/python3.6/tsig.pyr s r c @ s e Zd ZdZdS ) BadSignaturez#The TSIG signature fails to verify.N)r r r r
r r r r r
s r
c @ s e Zd ZdZdS ) PeerErrorz;Base class for all TSIG errors generated by the remote peerN)r r r r
r r r r r % s r c @ s e Zd ZdZdS )
PeerBadKeyz$The peer didn't know the key we usedN)r r r r
r r r r r * s r c @ s e Zd ZdZdS )PeerBadSignaturez*The peer didn't like the signature we sentN)r r r r
r r r r r / s r c @ s e Zd ZdZdS ) PeerBadTimez%The peer didn't like the time we sentN)r r r r
r r r r r 4 s r c @ s e Zd ZdZdS )PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentN)r r r r
r r r r r 9 s r zHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256z hmac-sha384z hmac-sha512ZSHA224ZSHA256ZSHA384ZSHA512ZSHA1ZMD5 FTc
C s t |tr|j }t| \}
}| r\tj||d} t|}|dkr\| jtj d| | j| tj d|}| j| | j| dd | r| j|j
| jtj dt j j
| jtj dd |td }|d? td@ }|td @ }tj d
|||}|
| }t|}|dkrtd tj d ||| }| rF| j| | j| n
| j| | j }tj dt|}|| | | | }|
rtj||d} t|}| jtj d| | j| nd} ||| fS )
aj Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
for the input parameters, the HMAC MAC calculated by applying the
TSIG signature algorithm, and the TSIG digest context.
@rtype: (string, string, hmac.HMAC object)
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
) digestmodr z!H Nz!I i l z!HIHz TSIG Other Data is > 65535 bytesz!HH)
isinstancer encode
get_algorithmhmacnewlenupdatestructpack
to_digestablednsZ
rdataclassANYr
ValueErrorZdigest)wirekeynamesecrettimefudge original_iderror
other_data request_macctxmultifirst algorithmZalgorithm_namer ZmlidZ long_time
upper_time
lower_timeZtime_macZpre_macZolZpost_macmacZmpack
tsig_rdatar r r signW sN
r9 c
C s t | ||||||||| |
| |
S )N)r9 )
r' r( r) r* r+ r, r- r. r/ r0 r1 r2 r3 r r r hmac_md5 s r: c C s t jd| dd \} | dkr&tjj| d8 } | dd t jd| | d| } |}
tjj| |
\}}|
| }
t jd| |
|
d \}}}}|td d> |td }|
d7 }
| |
|
| }|
|7 }
t jd| |
|
d \}}}|
d 7 }
| |
|
| }|
|7 }
|
|| kr tjj|dkrv|t kr:t
n<|t krJt n,|t
krZtn |tkrjtn td
| || }|| }||k s||krtt| |||||||||| |
|
\} } }| |krt|S ) a* Validate the specified TSIG rdata against the other input parameters.
@raises FormError: The TSIG is badly formed.
@raises BadTime: There is too much time skew between the client and the
server.
@raises BadSignature: The TSIG signature did not validate
@rtype: hmac.HMAC objectz!H
r r z!HIHHr z!HHH zunknown TSIG error code %d)r! unpackr$ exception FormErrorr" name from_wirer BADSIGr BADKEYr BADTIMEr BADTRUNCr r r r9 r
) r' r( r) Znowr/ Z
tsig_startr8
tsig_rdlenr0 r1 r2 ZadcountZnew_wirecurrentanameusedr5 r6 r+ mac_sizer* r7 r, r- Z
other_sizer. Ztime_lowZ time_highZjunkZour_macr r r validate sN
$
rL c C s\ t | trtjj| } y| j tjjt| fS t k
rV t
dt | d Y nX dS )zReturns the wire format string and the hash module to use for the
specified TSIG algorithm
@rtype: (string, hash constructor)
@raises NotImplementedError: I{algorithm} is not supported
zTSIG algorithm z is not supportedN) r r r$ rA from_textr# hashZhashes_hashesKeyErrorNotImplementedErrorstr)r3 r r r r s
r c C sz |}t jj| |\}}|| }tjd| ||d \}}}} |d7 }| ||| }
|| 7 }||| krrt jj||
fS )zlReturn the tsig algorithm for the specified tsig_rdata
@raises FormError: The TSIG is badly formed.
z!HIHHr; )r$ rA rB r! r> r? r@ ) r' r8 rG rH rI rJ r5 r6 r+ rK r7 r r r get_algorithm_and_mac s rS )NFT)(r
r r! Z
dns.exceptionr$ Zdns.hashZdns.rdataclassZdns.nameZ_compatr r r r? Z DNSExceptionr r
r r r r r rA rM ZHMAC_MD5Z HMAC_SHA1Z HMAC_SHA224Z HMAC_SHA256Z HMAC_SHA384Z HMAC_SHA512rO Zdefault_algorithmrC rD rE rF r9 r: rL r rS r r r r sL 5
5