⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.24
Server IP:
50.6.168.112
Server:
Linux server-617809.webnetzimbabwe.com 5.14.0-570.25.1.el9_6.x86_64 #1 SMP PREEMPT_DYNAMIC Wed Jul 9 04:57:09 EDT 2025 x86_64
Server Software:
Apache
PHP Version:
8.4.10
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3.9
/
site-packages
/
dns
/
__pycache__
/
View File Name :
dnssec.cpython-39.pyc
a Me @ s< d Z ddlZddlZddlZddlZddlZddlZddlmZ ddlm Z m Z m Z m Z m Z mZmZmZ ddlZddlZddlZddlZddlZddlZddlZddlZddlZddlZddl Zddl m Z m Z m Z ddlm!Z!m"Z"m#Z#m$Z$ ddl%m&Z& ddl'm(Z( dd l)m*Z* dd l+m,Z, dd l-m.Z.m/Z/ dd l0m1Z1 dd l2m3Z3m4Z4 ddl5m6Z6 ed Z7ed Z8e ej9j:ej;j<gdf Z=e>e dddZ?ee e@f e>dddZAeee>eBe@f e@dddZCee*e&f e@dddZDG d d d ZEG d d d eEZFeFe jGe jHe jIe jJhe jGe jHe jIhe jKe jLe jMhe jKhZNeFeO eO eO eO ZPeNZQdeeejRjSe>f ejTjUee e>f e ejRjS e eE eVe,d!d"d#ZWdfeejRjSe>f ejTjUee e>f e ejRjS e(d$d%d&ZXe ejRjSeejYjZej[j\f f e3e e e* d'd(d)Z]eej;j<eejRjSejYjZf f eejRjSejYjZf d*d+d,Z^e_e_e*dd-d.d/Z`dgeej;j<eejRjSejYjZf f e3e ejRjSeej[j\ejYjZf f e ejRjS e eB e eE dd0d1d2Zadheej;j<eejRjSejYjZf f eej;j<eejRjSejYjZf f e ejRjSeej[j\ejYjZf f e ejRjS e eB e eE dd3d4d5Zbdieej;j<eejRjSejYjZf f e8ejRjSe*e eee>e@eBf e eee>e@eBf e e@ eVe eE e ejRjS e3d6 d7d8Zcdjeej;j<eejRjSejYjZf f e3e ejRjS e_d9d:d;Zde6jed<fe7ee@e>f e@e@e*d=d>d?Zfe6jed<fe7ee@e>f e@e@e&d=d@dAZgeejRjSe>f e ee>e_f e@ee@e>f e>dBdCdDZhdkeej;j<eejRjSejYjZf f e ee e>f e ejRjS ejYjZdEdFdGZiejYjZejYjZdHdIdJZjdleejRjSe>f ejYjZee e>f e ejRjS ejYjZdKdLdMZkejYjZejYjZdHdNdOZldmej9j:ej;j<ejRjSe ee8e*f e ee8e*f e eee>e@eBf e eee>e@eBf e e@ e eE e ejRjS ddP dQdRZmdnejnjoe ej9j: e e ee8e*f eVe e@ e eee>e@eBf e eee>e@eBf e e@ e e1 e e= e eE ddT dUdVZpdoejnjoej9j:e e= ddWdXdYZqdZd[ Zrejstd\rdd]lumvZv dd^lwmxZx dd_lwmyZy dd`lwmzZz ddalwm{Z{ ddblwm|Z| ddcl}m~Z~mZ dddlmZmZ ebZeaZecZefZegZdSZnerZerZerZerZerZd Ze jGZGe jZe jHZHe jZe jZe jIZIe jZe jZe jZe jJZJe jZe jZe jZe jZe jZe jZe jZdS )pz.Common DNSSEC-related functions and constants. N)datetime)CallableDictListOptionalSetTupleUnioncast) AlgorithmDSDigest NSEC3Hash)AlgorithmKeyMismatchDeniedByPolicyUnsupportedAlgorithmValidationFailure)CDNSKEY)CDS)DNSKEY)DS)NSECBitmap) NSEC3PARAM)RRSIGsigtime_to_posixtime)Flag)GenericPublicKeyzrsa.RSAPublicKeyzec.EllipticCurvePublicKeyzed25519.Ed25519PublicKeyzed448.Ed448PublicKey)GenericPrivateKeyzrsa.RSAPrivateKeyzec.EllipticCurvePrivateKeyzed25519.Ed25519PrivateKeyzed448.Ed448PrivateKey)textreturnc C s t | S )zConvert text into a DNSSEC algorithm value. *text*, a ``str``, the text to convert to into an algorithm value. Returns an ``int``. )r from_text)r r! ./usr/lib/python3.9/site-packages/dns/dnssec.pyalgorithm_from_textL s r# )valuer c C s t | S )zConvert a DNSSEC algorithm value to text *value*, a ``dns.dnssec.Algorithm``. Returns a ``str``, the name of a DNSSEC algorithm. )r Zto_textr$ r! r! r" algorithm_to_textW s r& c C sT t | trt| S t | tr(t| S t | tr:t| S t | trH| S tddS )z%Convert various format to a timestampzUnsupported timestamp typeN) isinstancer intZ timestampstrr float TypeErrorr% r! r! r" to_timestampb s r, keyr c C s | }| jtjkr(|d d> |d S d}tt|d D ](}||d| d> |d| d 7 }q<t|d dkr||t|d d> 7 }||d? d@ 7 }|d@ S d S ) zReturn the key id (a 16-bit number) for the specified key. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` Returns an ``int`` between 0 and 65535 r i N)to_wire algorithmr RSAMD5rangelen)r. rdatatotalir! r! r" key_idp s &r= c @ sT e Zd Zdd ZeedddZeedddZeeddd Z eedd d Z d S ) Policyc C s d S Nr! )selfr! r! r" __init__ s zPolicy.__init__)_r c C s dS NFr! r@ rB r! r! r" ok_to_sign s zPolicy.ok_to_signc C s dS rC r! rD r! r! r" ok_to_validate s zPolicy.ok_to_validatec C s dS rC r! rD r! r! r" ok_to_create_ds s zPolicy.ok_to_create_dsc C s dS rC r! rD r! r! r" ok_to_validate_ds s zPolicy.ok_to_validate_dsN) __name__ __module__ __qualname__rA r boolrE rF r rG rH r! r! r! r" r> s r> c s\ e Zd Z fddZeedddZeedddZeedd d Z eedd d Z Z S ) SimpleDenyc s& t || _|| _|| _|| _d S r? )superrA _deny_sign_deny_validate_deny_create_ds_deny_validate_ds)r@ Z deny_signZ deny_validateZdeny_create_dsZdeny_validate_ds __class__r! r" rA s zSimpleDeny.__init__r- c C s |j | jvS r? )r6 rO r@ r. r! r! r" rE s zSimpleDeny.ok_to_signc C s |j | jvS r? )r6 rP rU r! r! r" rF s zSimpleDeny.ok_to_validate)r6 r c C s || j vS r? )rQ r@ r6 r! r! r" rG s zSimpleDeny.ok_to_create_dsc C s || j vS r? )rR rV r! r! r" rH s z SimpleDeny.ok_to_validate_ds) rI rJ rK rA r rL rE rF r rG rH __classcell__r! r! rS r" rM s rM F)namer. r6 originpolicy validatingr c C sZ |du r t }zt|tr$t| }W n tyD td| Y n0 |rR|j}n|j}||sdt t|t t fszt d|tj krt }n4|tjkrt }n |tjkrt }n td| t| trtj| |} | }|dusJ || ||j|d | } t dt ||j || } tj tj!j"tj#j$| dt%| } t&t$| S )a Create a DS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *validating*, a ``bool``. If ``True``, then policy is checked in validating mode, i.e. "Is it ok to validate using this digest algorithm?". Otherwise the policy is checked in creating mode, i.e. "Is it ok to create a DS with this digest algorithm?". Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Raises ``DeniedByPolicy`` if the algorithm is denied by policy. Returns a ``dns.rdtypes.ANY.DS.DS`` Nunsupported algorithm "%s"zkey is not a DNSKEY/CDNSKEYrY z!HBBr )'default_policyr' r) r upper Exceptionr rH rG r r r ValueErrorSHA1hashlibsha1ZSHA256Zsha256ZSHA384Zsha384dnsrX r canonicalizer5 updatedigeststructpackr= r6 r: Z from_wire rdataclassIN rdatatyper r9 r ) rX r. r6 rY rZ r[ checkZdshashZwirerh Zdsrdatadsr! r! r" make_ds sB % rp )rX r. r6 rY r c C s0 t | |||}t|jtjj|j|j|j|jdS )a Create a CDS record for a DNSSEC key. *name*, a ``dns.name.Name`` or ``str``, the owner name of the DS record. *key*, a ``dns.rdtypes.ANY.DNSKEY.DNSKEY`` or ``dns.rdtypes.ANY.DNSKEY.CDNSKEY``, the key the DS is about. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If *key* is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown. Returns a ``dns.rdtypes.ANY.DS.CDS`` rdclassrdtypekey_tagr6 digest_typerh ) rp r rr re rm rt r6 ru rh )rX r. r6 rY ro r! r! r" make_cds s rv )keysrrsigr c sR | j}t|tjjr0|tjjtj j }n|}|d u r@d S fdd|D S )Nc sL g | ]D}|j j krt| jkr|jtj@ tjkr|jd krtt|qS ) ) r6 r= rt flagsr ZONEprotocolr r ).0Zrdrx r! r" <listcomp>2 s z(_find_candidate_keys.<locals>.<listcomp>) getsignerr' re nodeNodeZ get_rdatasetrk rl rm r )rw rx r$ rdatasetr! r~ r" _find_candidate_keys( s r )rrsetr c C s( t | tr| d | d fS | j| fS d S )Nr r3 )r' tuplerX )r r! r! r" _get_rrname_rdataset< s r )sigdatar. r c C sD t |j}z||}W n ty2 tdY n0 || | d S )Nzinvalid public key) get_algorithm_cls_from_dnskey public_clsZ from_dnskeyra r verify)r r r. r public_keyr! r! r" _validate_signatureE s r )r rx rw rY nowrZ r c C s |du r t }t||}|du r&td|du r6t }|j|k rHtd|j|krZtdt| ||}|D ]B}||szqjzt|j || W dS t tfy Y qjY qj0 qjtddS )a Validate an RRset against a single signature rdata, throwing an exception if validation is not successful. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. *now*, a ``float`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz unknown keyZexpiredz not yet validzverify failure) r^ r r time expiration inception_make_rrsig_signature_datarF r signatureInvalidSignature) r rx rw rY r rZ Zcandidate_keysr Z candidate_keyr! r! r" _validate_rrsigN s* ( r )r rrsigsetrw rY r rZ r c C s |du r t }t|tr(tj|tjj}t| tr<| d }n| j}t|tr^|d }|d }n |j}|}||}||}||krt d|D ]H} t| t st dzt | | |||| W dS t t fy Y q0 qt ddS )a Validate an RRset against a signature RRset, throwing an exception if none of the signatures validate. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsigset*, the signature RRset. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *keys*, the key dictionary, used to find the DNSKEY associated with a given name. The dictionary is keyed by a ``dns.name.Name``, and has ``dns.node.Node`` or ``dns.rdataset.Rdataset`` values. *origin*, a ``dns.name.Name``, the origin to use for relative names; defaults to None. *now*, an ``int`` or ``None``, the time, in seconds since the epoch, to use as the current time when validating. If ``None``, the actual current time is used. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. Raises ``ValidationFailure`` if the signature is expired, not yet valid, the public key is invalid, the algorithm is unknown, the verification fails, etc. Nr r3 zowner names do not matchzexpected an RRSIGzno RRSIGs validated) r^ r' r) re rX r rootr Zchoose_relativityr r r r ) r r rw rY r rZ rrnameZ rrsignameZ rrsigrdatasetrx r! r! r" _validate s2 ' r ) r private_keyr dnskeyr r lifetimer rZ rY r c C sx |du r t }||stt| trL| d j} | d j} | d } | d j} n| j} | j} | j} | j} |durvt |}n t t }|durt |}n|dur|| }nt d| dur| | } t| d }| r|d8 }t| tjj| |j|| ||t||dd }tj| || }t|tr&|}n4zt|}||d}W n tyX tdY n0 |||}t t|j |d S ) a Sign RRset using private key. *rrset*, the RRset to validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *private_key*, the private key to use for signing, a ``cryptography.hazmat.primitives.asymmetric`` private key class applicable for DNSSEC. *signer*, a ``dns.name.Name``, the Signer's name. *dnskey*, a ``DNSKEY`` matching ``private_key``. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *verify*, a ``bool``. If set to ``True``, the signer will verify signatures after they are created; the default is ``False``. *policy*, a ``dns.dnssec.Policy`` or ``None``. If ``None``, the default policy, ``dns.dnssec.default_policy`` is used; this policy defaults to that of RFC 8624. *origin*, a ``dns.name.Name`` or ``None``. If ``None``, the default, then all names in the rrset (including its owner name) must be absolute; otherwise the specified origin will be used to make names absolute when signing. Raises ``DeniedByPolicy`` if the signature is denied by policy. Nr3 r z(expiration or lifetime must be specified ) rr rs Z type_coveredr6 labels original_ttlr r rt r r r. zUnsupported key algorithm)r ) r^ rE r r' r rr rs ttlrX r, r( r ra derelativizer9 is_wildr re rm r6 r= dnssecr r r r r+ signr replace)r r r r r r r r rZ rY rr rs r r Zrrsig_inceptionZrrsig_expirationr Zrrsig_templater Z signing_keyZ private_clsr r! r! r" _sign sb 5 r )r rx rY r c s t tr tj tjj |j}| sD du r:td| }t | \}}d}||j |ddd 7 }||j |7 }| s du rtd| }t |}| r|j|d krtd|d |jk rtd n2|j|d k r||jd d }tjd |}| } td |j|j|j} fd d |D } t| D ]6} || 7 }|| 7 }tdt | } || 7 }|| 7 }qF|S )a Create signature rdata. *rrset*, the RRset to sign/validate. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *rrsig*, a ``dns.rdata.Rdata``, the signature to validate, or the signature template used when signing. *origin*, a ``dns.name.Name`` or ``None``, the origin to use for relative names. Raises ``UnsupportedAlgorithm`` if the algorithm is recognized by dnspython but not implemented. Nz,relative RR name without an origin specifiedr r] r2 z&wild owner name has wrong label lengthr3 z#owner name longer than RRSIG labels*z!HHIc s g | ]}| qS r! ) to_digestable)r} r: r] r! r" r r z._make_rrsig_signature_data.<locals>.<listcomp>z!H)r' r) re rX r r r is_absoluter r r r5 r r9 r r splitri rj rs rr r sorted)r rx rY r r r r Zname_lensuffixZ rrnamebufZrrfixedZrdatasr: Zrrlenr! r] r" r U sB r ry )r r6 rz r| r c C sD t |}t| tr"| j||dS t|j}|| dj||dS dS )a Convert a public key to DNSKEY Rdata *public_key*, a ``PublicKey`` (``GenericPublicKey`` or ``cryptography.hazmat.primitives.asymmetric``) to convert. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return DNSKEY ``Rdata``. )rz r| r N)r Zmaker' r Z to_dnskeyget_algorithm_clsr )r r6 rz r| r r! r! r" _make_dnskey s r c C s0 t | |||}t|jtjj|j|j|j|jdS )a Convert a public key to CDNSKEY Rdata *public_key*, the public key to convert, a ``cryptography.hazmat.primitives.asymmetric`` public key class applicable for DNSSEC. *algorithm*, a ``str`` or ``int`` specifying the DNSKEY algorithm. *flags*: DNSKEY flags field as an integer. *protocol*: DNSKEY protocol field as an integer. Raises ``ValueError`` if the specified key algorithm parameters are not unsupported, ``TypeError`` if the key type is unsupported, `UnsupportedAlgorithm` if the algorithm is unknown and `AlgorithmKeyMismatch` if the algorithm does not match the key type. Return CDNSKEY ``Rdata``. rr rs rz r| r6 r. ) r r rr re rm rz r| r6 r. )r r6 rz r| r r! r! r" _make_cdnskey s r )domainsalt iterationsr6 r c C s t dd}zt|t r$t| }W n ty@ tdY n0 |tjkrTtd|du rbd}n4t|t rt|d dkrt |}qtdn|}t| t j j st j | } | }|dusJ t|| }t|D ]}t|| }qt|d } | |} | S ) a Calculate the NSEC3 hash, according to https://tools.ietf.org/html/rfc5155#section-5 *domain*, a ``dns.name.Name`` or ``str``, the name to hash. *salt*, a ``str``, ``bytes``, or ``None``, the hash salt. If a string, it is decoded as a hex string. *iterations*, an ``int``, the number of iterations. *algorithm*, a ``str`` or ``int``, the hash algorithm. The only defined algorithm is SHA1. Returns a ``str``, the encoded NSEC3 hash. Z ABCDEFGHIJKLMNOPQRSTUVWXYZ234567Z 0123456789ABCDEFGHIJKLMNOPQRSTUVz-Wrong hash algorithm (only SHA1 is supported)Nr r2 r zInvalid salt lengthzutf-8)r) maketransr' r r_ r` ra rb r9 bytesfromhexre rX Namer rf r5 rc rd rh r8 base64Z b32encodedecode translate) r r r r6 Zb32_conversionZ salt_encodedZdomain_encodedrh rB outputr! r! r" nsec3_hash s6 r )r algorithmsrY r c C s t | \}}|jtjjtjjtjjfvr0tdt }|D ]H}zt |t rVt | }W n t yv td| Y n0 || q:|jtjjkrg }t|D ]}|j|v r|| qt|dkrtdtj|j|S g }|D ]}|t|||| qtj|j|S )a Create a DS record from DNSKEY/CDNSKEY/CDS. *rrset*, the RRset to create DS Rdataset for. This can be a ``dns.rrset.RRset`` or a (``dns.name.Name``, ``dns.rdataset.Rdataset``) tuple. *algorithms*, a set of ``str`` or ``int`` specifying the hash algorithms. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. If the RRset is a CDS, only digest algorithms matching algorithms are accepted. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if any of the algorithms are unknown and ``ValueError`` if the given RRset is not usable. Returns a ``dns.rdataset.Rdataset`` z rrset not a DNSKEY/CDNSKEY/CDSr\ r z no acceptable CDS rdata found)r rs re rm r r r ra setr' r) r r_ r` r addcds_rdataset_to_ds_rdatasetru appendr9 r from_rdata_listr extend dnskey_rdataset_to_cds_rdataset) r r rY r r Z _algorithmsr6 resr: r! r! r" make_ds_rdataset s6 r )r r c C s\ | j tjjkrtdg }| D ],}|t|jtjj|j|j |j |j d q tj | j|S )zCreate a CDS record from DS. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. Raises ``ValueError`` if the rdataset is not CDS. Returns a ``dns.rdataset.Rdataset`` zrdataset not a CDSrq )rs re rm r ra r rr r rt r6 ru rh r r r r r r: r! r! r" r U s r )rX r r6 rY r c C sP |j tjjtjjfvr tdg }|D ]}|t| ||| q&tj |j |S )a Create a CDS record from DNSKEY/CDNSKEY. *name*, a ``dns.name.Name`` or ``str``, the owner name of the CDS record. *rdataset*, a ``dns.rdataset.Rdataset``, to create DS Rdataset for. *algorithm*, a ``str`` or ``int`` specifying the hash algorithm. The currently supported hashes are "SHA1", "SHA256", and "SHA384". Case does not matter for these strings. *origin*, a ``dns.name.Name`` or ``None``. If `key` is a relative name, then it will be made absolute using the specified origin. Raises ``UnsupportedAlgorithm`` if the algorithm is unknown or ``ValueError`` if the rdataset is not DNSKEY/CDNSKEY. Returns a ``dns.rdataset.Rdataset`` z rdataset not a DNSKEY/CDNSKEY) rs re rm r r ra r rv r r r )rX r r6 rY r r: r! r! r" r r s r c C sZ | j tjjkrtdg }| D ]*}|t| j| j |j|j |j |j d q tj | j|S )zCreate a CDNSKEY record from DNSKEY. *rdataset*, a ``dns.rdataset.Rdataset``, to create CDNSKEY Rdataset for. Returns a ``dns.rdataset.Rdataset`` zrdataset not a DNSKEYr )rs re rm r ra r r rr rz r| r6 r. r r r r r! r! r" #dnskey_rdataset_to_cdnskey_rdataset s r ) txnr r kskszsksr r r rZ rY r c C sr |j ttjjjtjjjtjjjgv r,|} n|} | D ]8\} } tjj || | |||||| d } | |j |j | q4dS )zDefault RRset signer) r r r r r r r rZ rY N) rs r re rm RdataTyper r r r r r rX r )r r r r r r r r rZ rY rw r r rx r! r! r" default_rrset_signer s* r T) zoner rw add_dnskey dnskey_ttlr r r nsec3 rrset_signerrZ r c C sB g } g } |rN|D ]*} | d j tj@ r0| | q| | q| sD|} | sR|} ng }|rbt|}n| }|}|r|du r|| jt j j }|r|j }n|| jt j j }|j }|D ]\}}|| j|| q|rtdn@| ptjt| j| | |||| | jd }t| ||W d S W d n1 s40 Y dS )a? Sign zone. *zone*, a ``dns.zone.Zone``, the zone to sign. *txn*, a ``dns.transaction.Transaction``, an optional transaction to use for signing. *keys*, a list of (``PrivateKey``, ``DNSKEY``) tuples, to use for signing. KSK/ZSK roles are assigned automatically if the SEP flag is used, otherwise all RRsets are signed by all keys. *add_dnskey*, a ``bool``. If ``True``, the default, all specified DNSKEYs are automatically added to the zone on signing. *dnskey_ttl*, a``int``, specifies the TTL for DNSKEY RRs. If not specified the TTL of the existing DNSKEY RRset used or the TTL of the SOA RRset. *inception*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature inception time. If ``None``, the current time is used. If a ``str``, the format is "YYYYMMDDHHMMSS" or alternatively the number of seconds since the UNIX epoch in text form; this is the same the RRSIG rdata's text form. Values of type `int` or `float` are interpreted as seconds since the UNIX epoch. *expiration*, a ``datetime``, ``str``, ``int``, ``float`` or ``None``, the signature expiration time. If ``None``, the expiration time will be the inception time plus the value of the *lifetime* parameter. See the description of *inception* above for how the various parameter types are interpreted. *lifetime*, an ``int`` or ``None``, the signature lifetime in seconds. This parameter is only meaningful if *expiration* is ``None``. *nsec3*, a ``NSEC3PARAM`` Rdata, configures signing using NSEC3. Not yet implemented. *rrset_signer*, a ``Callable``, an optional function for signing RRsets. The function requires two arguments: transaction and RRset. If the not specified, ``dns.dnssec.default_rrset_signer`` will be used. Returns ``None``. r3 Nz&Signing with NSEC3 not yet implemented)r r r r r r rZ rY )rz r ZSEPr contextlib nullcontextwriterr rY re rm r r ZSOAr NotImplementedError functoolspartialr _sign_zone_nsec)r r rw r r r r r r r rZ r r r. cmZ_txnr ZsoarB Z _rrset_signerr! r! r" sign_zone sN 6 r )r r r r c C s8 dt jjt jjtt jj t jjttt dddd}| j }d}d}t | D ]}|rh||rhqRn$||t jjr|| jkr|}nd}|r||}|r|jD ]N} | jt jjkrqq|r| jt jjkrqqt jj|| jg| R } ||| q|dur||||| j|| |}qR|r4|||| j| j|| dS )zNSEC zone signerN)r rX next_securerr r r r c S s t tjjjtjjjg}| |}|r|rt dd |jD |B }t t |} tj ||t|tjjj|| d} | | |r|| | dS )zNSEC zone signer helperc S s g | ] }|j qS r! )rs )r} r r! r! r" r V r z:_sign_zone_nsec.<locals>._txn_add_nsec.<locals>.<listcomp>)rr rs nextwindowsN)r re rm r r r get_node rdatasetsr Z from_rdtypeslistr from_rdatar ) r rX r rr r r Zmandatory_typesr typesr r r! r! r" _txn_add_nsecG s* z&_sign_zone_nsec.<locals>._txn_add_nsec)N) re transaction TransactionrX r r rk Z RdataClassr( RRsetSignerZget_soaZminimumr Z iterate_namesZ is_subdomainr rm ZNSrY r r rs r r r r r rr ) r r r r Z rrsig_ttlZ delegationZ last_securerX r r r r! r! r" r @ sH r c O s t dd S )Nz.DNSSEC validation requires python cryptography) ImportError)argskwargsr! r! r" _need_pyca s r r )r )dsa)ec)ed448)rsa)ed25519)r r )r r )NNF)N)NNN)NNN)NNNFNN)N)N)N)NNNNN) NNTNNNNNNN)N)__doc__r r r rc ri r r typingr r r r r r r r Z dns._featuresre Z dns.exceptionZdns.nameZdns.nodeZ dns.rdataZdns.rdataclassZ dns.rdatasetZ dns.rdatatypeZ dns.rrsetZdns.transactionZdns.zoneZdns.dnssectypesr r r r r r r Zdns.rdtypes.ANY.CDNSKEYr Zdns.rdtypes.ANY.CDSr Zdns.rdtypes.ANY.DNSKEYr Zdns.rdtypes.ANY.DSr Zdns.rdtypes.ANY.NSECr r Zdns.rdtypes.ANY.NSEC3PARAMr Zdns.rdtypes.ANY.RRSIGr r Zdns.rdtypes.dnskeybaser Z PublicKeyZ PrivateKeyr r r ZRRsetr r) r# r( r& r* r, r= r> rM r7 ZDSAZ DSANSEC3SHA1ZECCGOSTZNULLrb ZGOSTZrfc_8624_policyr Zallow_all_policyr^ rX r r: ZRdatarL rp rv r ZRdatasetr r r r r r r r r r r{ r r r r r r r r r ZZoner r r Z _featuresZhaveZcryptography.exceptionsr Z)cryptography.hazmat.primitives.asymmetricr r r r r Zdns.dnssecalgsr r Zdns.dnssecalgs.baser r ZvalidateZvalidate_rrsigr Z make_dnskeyZ make_cdnskeyZ _have_pycaZDHZECCZRSASHA1ZRSASHA1NSEC3SHA1Z RSASHA256Z RSASHA512ZECDSAP256SHA256ZECDSAP384SHA384ZED25519ZED448ZINDIRECTZ PRIVATEDNSZ PRIVATEOIDr! r! r! r" <module> s ( P % I N | D % ' @ ; ! " ! * m O