�
;�>Sc @ s� d Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d d l Z d e j j
f d � � YZ d e j j
f d � � YZ d e j j
f d � � YZ
d e
f d
� � YZ d e
f d � � YZ d
e
f d � � YZ d e
f d � � YZ e j j d � Z e j j d � Z e j j d � Z e j j d � Z e j j d � Z e j j d � Z e Z d Z d Z d Z d Z d e e! e d � Z" d e e! e d � Z# d e e! d � Z$ d a% d � Z& d � Z' d � Z( d! � Z) d S(" s DNS TSIG support.i����Nt BadTimec B s e Z d Z RS( sB Raised if the current time is not within the TSIG's validity time.( t __name__t
__module__t __doc__( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR s t BadSignaturec B s e Z d Z RS( s- Raised if the TSIG signature fails to verify.( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR s t PeerErrorc B s e Z d Z RS( s; Base class for all TSIG errors generated by the remote peer( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR # s t
PeerBadKeyc B s e Z d Z RS( s. Raised if the peer didn't know the key we used( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR ' s t PeerBadSignaturec B s e Z d Z RS( s4 Raised if the peer didn't like the signature we sent( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR + s t PeerBadTimec B s e Z d Z RS( s/ Raised if the peer didn't like the time we sent( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR / s t PeerBadTruncationc B s e Z d Z RS( sG Raised if the peer didn't like amount of truncation in the TSIG we sent( R R R ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR 3 s s HMAC-MD5.SIG-ALG.REG.INTs hmac-sha1s hmac-sha224s hmac-sha256s hmac-sha384s hmac-sha512i i i i c
C sF t | � \ }
} | rq t j | d | �} t | � } | d k rq | j t j d | � � | j | � qq n t j d | � } | j | � | j | d � | r� | j | j � � | j t j d t j j
� � | j t j d d � � n | d } | d ?d @} | d @} t j d
| | | � } |
| } t | � } | d k r`t d � � n t j d
| | � | } | r�| j | � | j | � n
| j | � | j � } t j d t | � � } | | | | | } |
r3t j | d | �} t | � } | j t j d | � � | j | � n d } | | | f S( sj Return a (tsig_rdata, mac, ctx) tuple containing the HMAC TSIG rdata
for the input parameters, the HMAC MAC calculated by applying the
TSIG signature algorithm, and the TSIG digest context.
@rtype: (string, string, hmac.HMAC object)
@raises ValueError: I{other_data} is too long
@raises NotImplementedError: I{algorithm} is not supported
t digestmodi s !Hi s !Il i l � l �� s !HIHi�� s TSIG Other Data is > 65535 bytess !HHN( t
get_algorithmt hmact newt lent updatet structt packt
to_digestablet dnst
rdataclasst ANYt
ValueErrort digestt None( t wiret keynamet secrett timet fudget original_idt errort
other_datat request_mact ctxt multit firstt algorithmt algorithm_nameR
t mlt idt long_timet
upper_timet
lower_timet time_mact pre_mact olt post_mact mact mpackt
tsig_rdata( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt signG sJ
c
C s. t | | | | | | | | | | |
| | �
S( N( R3 (
R R R R R R R R R! R" R# R$ R% ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt hmac_md5z s c C s\ t j d | d d !� \ } | d k r7 t j j � n | d 8} | d d !t j d | � | d | !} | }
t j j | |
� \ } } |
| }
t j d | |
|
d !� \ } } } } | d d >| d } |
d 7}
| |
|
| !} |
| 7}
t j d | |
|
d
!� \ } } } |
d
7}
| |
|
| !} |
| 7}
|
| | k rbt j j � n | d k r�| t k r�t � q�| t
k r�t � q�| t k r�t
� q�| t k r�t � q�t d | � � n | | } | | } | | k s| | k r
t � n t | | | | | | | | | | | |
| �
\ } } } | | k rXt � n | S( s* Validate the specified TSIG rdata against the other input parameters.
@raises FormError: The TSIG is badly formed.
@raises BadTime: There is too much time skew between the client and the
server.
@raises BadSignature: The TSIG signature did not validate
@rtype: hmac.HMAC objects !Hi
i i i s !HIHHl i s !HHHi s unknown TSIG error code %d( R t unpackR t exceptiont FormErrorR t namet from_wiret BADSIGR t BADKEYR t BADTIMER t BADTRUNCR R R R3 R ( R R R t nowR! t
tsig_startR2 t
tsig_rdlenR" R# R$ t adcountt new_wiret currentt anamet usedR* R+ R t mac_sizeR R0 R R t
other_sizeR t time_lowt time_hight junkt our_mac( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt validate� sN
(
)
&
c C s2 y t j j | � t | <Wn t k
r- n Xd S( N( R t hasht gett _hashest KeyError( t tsig_algt hash_alg( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt _maybe_add_hash� s
c C sX i a t t d � t t d � t t d � t t d � t t d � t t d � d S( Nt SHA224t SHA256t SHA384t SHA512t SHA1t MD5( RO RS t HMAC_SHA224t HMAC_SHA256t HMAC_SHA384t HMAC_SHA512t HMAC_SHA1t HMAC_MD5( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt
_setup_hashes� s
c C s� t d k r t � n t | t t f � r@ t j j | � } n t j
d k r� | t k sg | t k r� t
d t | � d � � n y | j � t | f SWn+ t k
r� t
d t | � d � � n Xd S( s� Returns the wire format string and the hash module to use for the
specified TSIG algorithm
@rtype: (string, hash constructor)
@raises NotImplementedError: I{algorithm} is not supported
i s TSIG algorithm s requires Python 2.5.2 or laters is not supportedN( RO R R` t
isinstancet strt unicodeR R8 t from_textt syst
hexversionR\ R] t NotImplementedErrorR RP ( R% ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyR � s
c C s� | } t j j | | � \ } } | | } t j d | | | d !� \ } } } } | d 7} | | | | !}
| | 7} | | | k r� t j j � n | |
f S( sl Return the tsig algorithm for the specified tsig_rdata
@raises FormError: The TSIG is badly formed.
s !HIHHi
( R R8 R9 R R5 R6 R7 ( R R2 R@ RC RD RE R* R+ R RF R0 ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt get_algorithm_and_mac� s
)
(* R R R Re t
dns.exceptionR t dns.hasht dns.rdataclasst dns.nameR6 t DNSExceptionR R R R R R R R8 Rd R_ R^ RZ R[ R\ R] t default_algorithmR: R; R< R= R t Falset TrueR3 R4 RL RO RS R` R Rh ( ( ( s. /usr/lib64/python2.7/site-packages/dns/tsig.pyt <module> sF 2 4