o
    Þý°j8-  ã                   @   s  d Z ddlZddlZddlZddlZddlZddlZddlZddl	Zddl
ZG dd„ dejjƒZG dd„ dejjƒZG dd„ dejjƒZG d	d
„ d
ejjƒZG dd„ dejjƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZG dd„ deƒZej d¡Zej d¡Zej d¡Zej d¡Zej d¡Zej d¡Zej d¡Zej d¡Zej d¡Z ej d¡Z!eZ"eded ed!ed"ed#ed$ed%e d!ed"e!d&i
Z#G d'd(„ d(ƒZ$G d)d*„ d*ƒZ%G d+d,„ d,ƒZ&d:d-d.„Z'd/d0„ Z(d;d2d3„Z)	1d<d4d5„Z*d6d7„ Z+G d8d9„ d9ƒZ,dS )=zDNS TSIG support.é    Nc                   @   ó   e Zd ZdZdS )ÚBadTimez8The current time is not within the TSIG's validity time.N©Ú__name__Ú
__module__Ú__qualname__Ú__doc__© r	   r	   ú{/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/dns/tsig.pyr       ó    r   c                   @   r   )ÚBadSignaturez#The TSIG signature fails to verify.Nr   r	   r	   r	   r
   r   $   r   r   c                   @   r   )ÚBadKeyz2The TSIG record owner name does not match the key.Nr   r	   r	   r	   r
   r   (   r   r   c                   @   r   )ÚBadAlgorithmz*The TSIG algorithm does not match the key.Nr   r	   r	   r	   r
   r   ,   r   r   c                   @   r   )Ú	PeerErrorz;Base class for all TSIG errors generated by the remote peerNr   r	   r	   r	   r
   r   0   r   r   c                   @   r   )Ú
PeerBadKeyz$The peer didn't know the key we usedNr   r	   r	   r	   r
   r   4   r   r   c                   @   r   )ÚPeerBadSignaturez*The peer didn't like the signature we sentNr   r	   r	   r	   r
   r   8   r   r   c                   @   r   )ÚPeerBadTimez%The peer didn't like the time we sentNr   r	   r	   r	   r
   r   <   r   r   c                   @   r   )ÚPeerBadTruncationz=The peer didn't like amount of truncation in the TSIG we sentNr   r	   r	   r	   r
   r   @   r   r   zHMAC-MD5.SIG-ALG.REG.INTz	hmac-sha1zhmac-sha224zhmac-sha256zhmac-sha256-128zhmac-sha384zhmac-sha384-192zhmac-sha512zhmac-sha512-256úgss-tsigé   é   é    é   é0   é   é@   é€   c                   @   s0   e Zd ZdZdd„ Zdd„ Zdd„ Zdd	„ Zd
S )ÚGSSTSigaG  
    GSS-TSIG TSIG implementation.  This uses the GSS-API context established
    in the TKEY message handshake to sign messages using GSS-API message
    integrity codes, per the RFC.

    In order to avoid a direct GSSAPI dependency, the keyring holds a ref
    to the GSSAPI object required, rather than the key itself.
    c                 C   s   || _ d| _d| _d S )Nó    r   )Úgssapi_contextÚdataÚname)Úselfr   r	   r	   r
   Ú__init__k   s   
zGSSTSig.__init__c                 C   s   |  j |7  _ d S ©N)r    ©r"   r    r	   r	   r
   Úupdatep   s   zGSSTSig.updatec                 C   s   | j  | j¡S r$   )r   Úget_signaturer    )r"   r	   r	   r
   Úsigns   s   zGSSTSig.signc                 C   s&   z	| j  | j|¡W S  ty   t‚w r$   )r   Úverify_signaturer    Ú	Exceptionr   )r"   Úexpectedr	   r	   r
   Úverifyw   s
   þzGSSTSig.verifyN)r   r   r   r   r#   r&   r(   r,   r	   r	   r	   r
   r   a   s    	r   c                   @   s(   e Zd Zdd„ Zdd„ Zedd„ ƒZdS )ÚGSSTSigAdapterc                 C   s
   || _ d S r$   )Úkeyring)r"   r.   r	   r	   r
   r#   �   s   
zGSSTSigAdapter.__init__c                 C   sB   || j v r| j | }t|tƒr|jtkr|rt |||¡ |S d S r$   )r.   Ú
isinstanceÚKeyÚ	algorithmÚGSS_TSIGr-   Úparse_tkey_and_step)r"   ÚmessageÚkeynameÚkeyr	   r	   r
   Ú__call__„   s   

zGSSTSigAdapter.__call__c                 C   sV   z |  |j|tjjtjj¡}|r|d j}|j}| 	|¡W S W d S  t
y*   Y d S w )Nr   )Ú
find_rrsetÚanswerÚdnsÚ
rdataclassÚANYÚ	rdatatypeÚTKEYr6   ÚsecretÚstepÚKeyError)Úclsr6   r4   r5   ÚrrsetÚtokenr   r	   r	   r
   r3   Ž   s   ÿ
ýÿz"GSSTSigAdapter.parse_tkey_and_stepN)r   r   r   r#   r7   Úclassmethodr3   r	   r	   r	   r
   r-   €   s
    
r-   c                   @   sv   e Zd ZdZeejeeje	ej
eej
dfeejeejdfeejeejdfeeji	Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )ÚHMACTSigzo
    HMAC TSIG implementation.  This uses the HMAC python module to handle the
    sign/verify operations.
    r   éÀ   é   c                 C   sœ   z| j | }W n ty   td|› d�ƒ‚w t|tƒr,tj||d d�| _|d | _ntj||d�| _d | _| jj	| _	| jrL|  j	d| j› �7  _	d S d S )NzTSIG algorithm z is not supportedr   )Ú	digestmodé   ú-)
Ú_hashesrA   ÚNotImplementedErrorr/   ÚtupleÚhmacÚnewÚhmac_contextÚsizer!   )r"   r6   r1   Úhashinfor	   r	   r
   r#   ²   s   ÿ

ÿzHMACTSig.__init__c                 C   s   | j  |¡S r$   )rQ   r&   r%   r	   r	   r
   r&   Ã   s   zHMACTSig.updatec                 C   s&   | j  ¡ }| jr|d | jd … }|S )Né   )rQ   ÚdigestrR   )r"   rU   r	   r	   r
   r(   Æ   s   
zHMACTSig.signc                 C   s   |   ¡ }t ||¡st‚d S r$   )r(   rO   Úcompare_digestr   )r"   r+   Úmacr	   r	   r
   r,   Í   s   ÿzHMACTSig.verifyN)r   r   r   r   Ú	HMAC_SHA1ÚhashlibÚsha1ÚHMAC_SHA224Úsha224ÚHMAC_SHA256Úsha256ÚHMAC_SHA256_128ÚHMAC_SHA384Úsha384ÚHMAC_SHA384_192ÚHMAC_SHA512Úsha512ÚHMAC_SHA512_256ÚHMAC_MD5Úmd5rL   r#   r&   r(   r,   r	   r	   r	   r
   rF       s     


÷rF   c                 C   s<  |o| }|rt |ƒ}|r| t dt|ƒ¡¡ | |¡ |dus#J ‚| t d|j¡¡ | | dd… ¡ |rT| |j ¡ ¡ | t dtj	j
¡¡ | t dd¡¡ |du r[|j}|d? d@ }|d@ }	t d	||	|j¡}
t|jƒ}|dkr{td
ƒ‚|r—| |j ¡ |
 ¡ | t d|j|¡|j ¡ |S | |
¡ |S )zòReturn a context containing the TSIG rdata for the input parameters
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    ú!HNé   z!Ir   r   iÿÿ  l   ÿÿ z!HIHz TSIG Other Data is > 65535 bytesz!HH)Úget_contextr&   ÚstructÚpackÚlenÚoriginal_idr!   Úto_digestabler:   r;   r<   Útime_signedÚfudgeÚotherÚ
ValueErrorr1   Úerror)Úwirer6   ÚrdataÚtimeÚrequest_macÚctxÚmultiÚfirstÚ
upper_timeÚ
lower_timeÚtime_encodedÚ	other_lenr	   r	   r
   Ú_digestÔ   s6   



ÿr€   c                 C   s4   |rt | ƒ}| t dt|ƒ¡¡ | |¡ |S dS )z�If this is the first message in a multi-message sequence,
    start a new context.
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig object
    rh   N)rj   r&   rk   rl   rm   )r6   rW   rz   ry   r	   r	   r
   Ú_maybe_start_digestø   s   
r�   Fc           	      C   s:   t | ||||||ƒ}| ¡ }|j||d�}|t|||ƒfS )a~  Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
    for the input parameters, the HMAC MAC calculated by applying the
    TSIG signature algorithm, and the TSIG digest context.
    @rtype: (string, dns.tsig.HMACTSig or dns.tsig.GSSTSig object)
    @raises ValueError: I{other_data} is too long
    @raises NotImplementedError: I{algorithm} is not supported
    )rp   rW   )r€   r(   Úreplacer�   )	ru   r6   rv   rw   rx   ry   rz   rW   Útsigr	   r	   r
   r(     s   	r(   c	                 C   s  t  d| dd… ¡\}	|	dkrtjj‚|	d8 }	| dd… t  d|	¡ | d|…  }
|jdkrZ|jtjjkr7t	‚|jtjj
kr@t‚|jtjjkrIt‚|jtjjkrRt‚td|j› �ƒ‚t|j| ƒ|jkrft‚|j|krmt‚|j|jkrut‚t|
||d|||ƒ}| |j¡ t||j|ƒS )aF  Validate the specified TSIG rdata against the other input parameters.

    @raises FormError: The TSIG is badly formed.
    @raises BadTime: There is too much time skew between the client and the
    server.
    @raises BadSignature: The TSIG signature did not validate
    @rtype: dns.tsig.HMACTSig or dns.tsig.GSSTSig objectrh   é
   é   r   rJ   zunknown TSIG error code N)rk   Úunpackr:   Ú	exceptionÚ	FormErrorrl   rt   ÚrcodeÚBADSIGr   ÚBADKEYr   ÚBADTIMEr   ÚBADTRUNCr   r   Úabsrp   rq   r   r!   r   r1   r   r€   r,   rW   r�   )ru   r6   Úownerrv   Únowrx   Ú
tsig_startry   rz   ÚadcountÚnew_wirer	   r	   r
   Úvalidate  s0   $

r”   c                 C   s"   | j tkr
t| jƒS t| j| j ƒS )zŒReturns an HMAC context for the specified key.

    @rtype: HMAC context
    @raises NotImplementedError: I{algorithm} is not supported
    )r1   r2   r   r?   rF   )r6   r	   r	   r
   rj   <  s   

rj   c                   @   sJ   e Zd ZefdejjeB deeB dejjeB fdd„Z	dd„ Z
dd	„ Zd
S )r0   r!   r?   r1   c                 C   sZ   t |tƒrtj |¡}|| _t |tƒrt | ¡ ¡}|| _t |tƒr(tj |¡}|| _	d S r$   )
r/   Ústrr:   r!   Ú	from_textÚbase64ÚdecodebytesÚencoder?   r1   )r"   r!   r?   r1   r	   r	   r
   r#   J  s   



zKey.__init__c                 C   s.   t |tƒo| j|jko| j|jko| j|jkS r$   )r/   r0   r!   r?   r1   )r"   rr   r	   r	   r
   Ú__eq__Z  s   

ÿ
þ
üz
Key.__eq__c                 C   sN   d| j › d�d| j› d� }| jtkr!|dt | j¡ ¡ › d�7 }|d7 }|S )Nz<DNS key name='z', zalgorithm='ú'z
, secret='ú>)r!   r1   r2   r—   Ú	b64encoder?   Údecode)r"   Úrr	   r	   r
   Ú__repr__b  s
   
zKey.__repr__N)r   r   r   Údefault_algorithmr:   r!   ÚNamer•   Úbytesr#   rš   r    r	   r	   r	   r
   r0   I  s    ü
þý

ür0   )NNNN)NNNF)NF)-r   r—   rY   rO   rk   Údns.exceptionr:   Údns.nameÚ	dns.rcodeÚdns.rdataclassÚdns.rdatatyper‡   ÚDNSExceptionr   r   r   r   r   r   r   r   r   r!   r–   rf   rX   r[   r]   r_   r`   rb   rc   re   r2   r¡   Ú	mac_sizesr   r-   rF   r€   r�   r(   r”   rj   r0   r	   r	   r	   r
   Ú<module>   sf   ö 
4$

ÿ&