File: //home/arjun/projects/env/lib/python3.10/site-packages/dns/__pycache__/tsig.cpython-310.pyc
o
!we�, � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddl ZG dd� dej
j �Z G dd� dej
j �Z
G dd� dej
j �ZG d d
� d
ej
j �ZG d d � d ej
j �ZG d
d� de�ZG dd� de�ZG dd� de�ZG dd� de�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Zej�d�Z ej�d�Z ej�d �Z ej�d �Z ej�d �Z eZ!ed ed ed!ed"e d#e d$e d%e d!ed"e d&i
Z"G d'd(� d(�Z#G d)d*� d*�Z$G d+d,� d,�Z%d:d-d.�Z&d/d0� Z'd;d2d3�Z( 1d<d4d5�Z)d6d7� Z*G d8d9� d9�Z+dS )=zDNS TSIG support.� Nc @ � e Zd ZdZdS )�BadTimez8The current time is not within the TSIG's validity time.N��__name__�
__module__� __qualname__�__doc__� r r �A/home/arjun/projects/env/lib/python3.10/site-packages/dns/tsig.pyr � r c @ r )� BadSignaturez#The TSIG signature fails to verify.Nr r r r r
r $ r r c @ r )�BadKeyz2The TSIG record owner name does not match the key.Nr r r r r
r
) r r
c @ r )� BadAlgorithmz*The TSIG algorithm does not match the key.Nr r r r r
r . r r c @ r )� PeerErrorz;Base class for all TSIG errors generated by the remote peerNr r r r r
r 3 r r c @ r )�
PeerBadKeyz$The peer didn't know the key we usedNr r r r r
r 8 r r c @ r )�PeerBadSignaturez*The peer didn't like the signature we sentNr r r r r
r = r r c @ r )� PeerBadTimez%The peer didn't like the time we sentNr r r r r
r B r r c @ r )�PeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr r r r r
r G r r zHMAC-MD5.SIG-ALG.REG.INTz hmac-sha1z hmac-sha224z hmac-sha256zhmac-sha256-128z hmac-sha384zhmac-sha384-192z hmac-sha512zhmac-sha512-256�gss-tsig� � � � �0 � �@ � c @ s0 e Zd ZdZdd� Zdd� Zdd� Zdd � Zd
S ) �GSSTSigaG
GSS-TSIG TSIG implementation. This uses the GSS-API context established
in the TKEY message handshake to sign messages using GSS-API message
integrity codes, per the RFC.
In order to avoid a direct GSSAPI dependency, the keyring holds a ref
to the GSSAPI object required, rather than the key itself.
c C s || _ d| _d| _d S )N� r )�gssapi_context�data�name)�selfr r r r
�__init__s s
zGSSTSig.__init__c C s | j |7 _ d S �N)r �r" r r r r
�updatex s zGSSTSig.updatec C s | j �| j�S r$ )r �
get_signaturer )r" r r r
�sign{ s z GSSTSig.signc C s& z | j �| j|�W S ty t�w r$ )r �verify_signaturer � Exceptionr )r" �expectedr r r
�verify s
�zGSSTSig.verifyN)r r r r r# r& r( r, r r r r
r i s r c @ s( e Zd Zdd� Zdd� Zedd� �ZdS )�GSSTSigAdapterc C s
|| _ d S r$ )�keyring)r" r. r r r
r# � s
zGSSTSigAdapter.__init__c C sB || j v r | j | }t|t�r |jtkr |r t�|||� |S d S r$ )r. �
isinstance�Key� algorithm�GSS_TSIGr- �parse_tkey_and_step)r" �message�keyname�keyr r r
�__call__� s
zGSSTSigAdapter.__call__c C sV z |� |j|tjjtjj�}|r |d j}|j}|� |�W S W d S t
y* Y d S w )Nr ) �
find_rrset�answer�dns�
rdataclass�ANY� rdatatype�TKEYr6 �secret�step�KeyError)�clsr6 r4 r5 �rrset�tokenr r r r
r3 � s �
� �z"GSSTSigAdapter.parse_tkey_and_stepN)r r r r# r7 � classmethodr3 r r r r
r- � s
r- c @ sv e Zd ZdZeejeeje ej
e ej
dfe ej
eej
dfeejeejdfeeji Zdd� Zdd� Zd d
� Zd d � Zd
S )�HMACTSigzo
HMAC TSIG implementation. This uses the HMAC python module to handle the
sign/verify operations.
r � � c C s� z| j | }W n ty td|� d���w t|t�r,tj||d d�| _|d | _n tj||d�| _d | _| jj | _ | jrL| j d| j� �7 _ d S d S )NzTSIG algorithm z is not supportedr )� digestmod� �-)
�_hashesrA �NotImplementedErrorr/ �tuple�hmac�new� hmac_context�sizer! )r" r6 r1 �hashinfor r r
r# � s �
�zHMACTSig.__init__c C s | j �|�S r$ )rQ r& r% r r r
r& � s zHMACTSig.updatec C s& | j �� }| jr|d | jd � }|S )N� )rQ �digestrR )r" rU r r r
r( � s
z
HMACTSig.signc C s | � � }t�||�s t�d S r$ )r( rO �compare_digestr )r" r+ �macr r r
r, � s �zHMACTSig.verifyN)r r r r � HMAC_SHA1�hashlib�sha1� HMAC_SHA224�sha224� HMAC_SHA256�sha256�HMAC_SHA256_128� HMAC_SHA384�sha384�HMAC_SHA384_192� HMAC_SHA512�sha512�HMAC_SHA512_256�HMAC_MD5�md5rL r# r& r( r, r r r r
rF � s
� rF c C s0 |o| }|r t |�}|r |�t�dt|��� |�|� |�t�d|j�� |�| dd� � |rN|�|j�� � |�t�dtj j
�� |�t�dd�� |du rU|j }|d? d@ }|d@ } t�d || |j �}
t|j
�} | dkrutd
��|r�|�|j�� |
� |�t�d |j| �|j
� |S |�|
� |S ) z�Return a context containing the TSIG rdata for the input parameters
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
�!H� Nz!Ir r i�� l �� z!HIHz TSIG Other Data is > 65535 bytesz!HH)� get_contextr& �struct�pack�len� original_idr! �
to_digestabler: r; r< � time_signed�fudge�other�
ValueErrorr1 �error) �wirer6 �rdata�time� request_mac�ctx�multi�first�
upper_time�
lower_time� time_encoded� other_lenr r r
�_digest� s4
�r� c C s4 |rt | �}|�t�dt|��� |�|� |S dS )z�If this is the first message in a multi-message sequence,
start a new context.
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
rh N)rj r& rk rl rm )r6 rW rz ry r r r
�_maybe_start_digest� s
r� Fc C s: t | ||||||�}|�� }|j||d�}|t|||�fS )a~ Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
for the input parameters, the HMAC MAC calculated by applying the
TSIG signature algorithm, and the TSIG digest context.
@rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
)rp rW )r� r( �replacer� ) ru r6 rv rw rx ry rz rW �tsigr r r
r(
s r( c C s t �d| dd� �\} | dkrtjj�| d8 } | dd� t �d| � | d|� }
|jdkrY|jtjjkr7t �|jtjj
kr@t �|jtjj krIt
�|jtjjkrRt�td|j ��t|j| �|jkret�|j|krlt�|j|jkrtt�t|
||d|||�}|�|j� t ||j|�S )aF Validate the specified TSIG rdata against the other input parameters.
@raises FormError: The TSIG is badly formed.
@raises BadTime: There is too much time skew between the client and the
server.
@raises BadSignature: The TSIG signature did not validate
@rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrh �
� r rJ zunknown TSIG error code %dN) rk �unpackr: � exception� FormErrorrl rt �rcode�BADSIGr �BADKEYr �BADTIMEr �BADTRUNCr r �absrp rq r r! r
r1 r r� r, rW r� ) ru r6 �ownerrv �nowrx �
tsig_startry rz �adcount�new_wirer r r
�validate s0 $
r� c C s" | j tkr
t| j�S t| j| j �S )z�Returns an HMAC context for the specified key.
@rtype: HMAC context
@raises NotImplementedError: I{algorithm} is not supported
)r1 r2 r r? rF )r6 r r r
rj C s
rj c @ s( e Zd Zefdd�Zdd� Zdd� ZdS )r0 c C sZ t |t�r tj�|�}|| _t |t�rt�|�� �}|| _t |t�r(tj�|�}|| _ d S r$ )
r/ �strr: r! � from_text�base64� decodebytes�encoder? r1 )r" r! r? r1 r r r
r# Q s
z Key.__init__c C s. t |t�o| j|jko| j|jko| j|jkS r$ )r/ r0 r! r? r1 )r" rr r r r
�__eq__\ s
�
�
�z
Key.__eq__c C sN d| j � d�d| j� d� }| jtkr!|dt�| j��� � d�7 }|d7 }|S )Nz<DNS key name='z', z algorithm='�'z
, secret='�>)r! r1 r2 r� � b64encoder? �decode)r" �rr r r
�__repr__d s
z Key.__repr__N)r r r �default_algorithmr# r� r� r r r r
r0 P s r0 )NNNN)NNNF)NF),r r� rY rO rk �
dns.exceptionr: �dns.name� dns.rcode�dns.rdataclassr� � DNSExceptionr r r
r r r r r r r! r� rf rX r[ r] r_ r` rb rc re r2 r� � mac_sizesr r- rF r� r� r( r� rj r0 r r r r
�<module> sd �
4#
�&